Edit tour

Windows Analysis Report
#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe

Overview

General Information

Sample name:	#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe renamed because original name is a hash value
Original sample name:	_.hpw.scr.exe
Analysis ID:	1543679
MD5:	697d9c4f0800f93a19b89bf923d4135a
SHA1:	6d77a6b41de8d1f24bee70ea628029fe7784077f
SHA256:	8071c7b74e7ca2769f3746ec8cc007caee65474bb77808b7a84c84f877452605
Tags:	exeuser-zhuzhu0009
Infos:

Detection

Score:	69
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	31
Range:	0 - 100

Signatures

Detected unpacking (changes PE section rights)

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Suricata IDS alerts for network traffic

Detected PE file pumping (to bypass AV & sandboxing)

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking mutex)

Injects a PE file into a foreign processes

Sigma detected: Execution from Suspicious Folder

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious Program Location with Network Connections

Contains functionality to delete services

Contains functionality to enumerate running services

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

EXE planting / hijacking vulnerabilities found

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Explorer Process Tree Break

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe (PID: 7480 cmdline: "C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe" MD5: 697D9C4F0800F93A19B89BF923D4135A)

explorer.exe (PID: 7540 cmdline: C:\Windows\explorer.exe C:\Users\Public\Music\LI1L1K MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 7568 cmdline: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding MD5: 662F4F92FDE3557E86D110526BB578D5)

TASLogin.exe (PID: 7988 cmdline: "C:\Users\Public\Documents\A9Q9P9\TASLogin.exe" MD5: E6A3CACCBD9CA82F38A14BD0D4428240)

TASLogin.exe (PID: 8016 cmdline: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe MD5: E6A3CACCBD9CA82F38A14BD0D4428240)

rundll32.exe (PID: 7628 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

OpenWith.exe (PID: 7744 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: E4A834784FA08C17D47A1E72429C5109)

TASLogin.exe (PID: 1620 cmdline: "C:\Users\Public\Documents\A9Q9P9\TASLogin.exe" MD5: E6A3CACCBD9CA82F38A14BD0D4428240)

TASLogin.exe (PID: 3384 cmdline: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe MD5: E6A3CACCBD9CA82F38A14BD0D4428240)

TASLogin.exe (PID: 2084 cmdline: "C:\Users\Public\Documents\A9Q9P9\TASLogin.exe" MD5: E6A3CACCBD9CA82F38A14BD0D4428240)

TASLogin.exe (PID: 3512 cmdline: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe MD5: E6A3CACCBD9CA82F38A14BD0D4428240)

cleanup

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Documents\A9Q9P9\TASLogin.exe" , CommandLine: "C:\Users\Public\Documents\A9Q9P9\TASLogin.exe" , CommandLine|base64offset|contains: , Image: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe, NewProcessName: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe, OriginalFileName: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe, ParentCommandLine: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 7568, ParentProcessName: explorer.exe, ProcessCommandLine: "C:\Users\Public\Documents\A9Q9P9\TASLogin.exe" , ProcessId: 7988, ProcessName: TASLogin.exe

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe, EventID: 13, EventType: SetValue, Image: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe, ProcessId: 7988, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IFfmsjhgsda

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 137.220.137.85, DestinationIsIpv6: false, DestinationPort: 24818, EventID: 3, Image: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe, Initiated: true, ProcessId: 8016, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49740

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe, EventID: 13, EventType: SetValue, Image: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe, ProcessId: 7988, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IFfmsjhgsda

Sigma detected: Explorer Process Tree Break

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @gott_cyber: Data: Command: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding, CommandLine: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding, CommandLine|base64offset|contains: Iyb, Image: C:\Windows\explorer.exe, NewProcessName: C:\Windows\explorer.exe, OriginalFileName: C:\Windows\explorer.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 752, ProcessCommandLine: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding, ProcessId: 7568, ProcessName: explorer.exe

Suricata Signatures

ET MALWARE Backdoor family PCRat/Gh0st CnC traffic

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T09:05:22.603593+0100	2016922	1	Malware Command and Control Activity Detected	192.168.2.4	49740	137.220.137.85	24818	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe

EXE: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Jump to behavior

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe

EXE: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Jump to behavior

Uses 32bit PE files

Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

PE / OLE file has a valid certificate

Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe

Static PE information: certificate valid

Binary contains paths to debug symbols

Source:	Binary string: c:\Users\86130\Desktop\cert\debug\cert.pdb source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1718229560.0000000005E48000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe, 00000008.00000002.1858149624.0000000010299000.00000002.00000001.01000000.0000000F.sdmp, TASLogin.exe, 0000000C.00000002.1957609639.0000000010299000.00000002.00000001.01000000.0000000F.sdmp, TASLogin.exe, 0000000E.00000002.2037664334.0000000010299000.00000002.00000001.01000000.0000000F.sdmp, TASLoginBase.dll.0.dr
Source:	Binary string: D:\Workspace\p-2ed35f15174943f6b676502b51f53d81\Output\TASLogin.pdb source: TASLogin.exe, TASLogin.exe, 0000000E.00000000.2034919769.000000000044A000.00000002.00000001.01000000.0000000E.sdmp, TASLogin.exe, 0000000F.00000000.2035415053.000000000044A000.00000002.00000001.01000000.0000000E.sdmp, TASLogin.exe.0.dr

Spreading

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_00408694 FindFirstFileW,FindClose,	9_2_00408694
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_004080C8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	9_2_004080C8
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 13_2_00408694 FindFirstFileW,FindClose,	13_2_00408694
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 13_2_004080C8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	13_2_004080C8
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 15_2_00408694 FindFirstFileW,FindClose,	15_2_00408694
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 15_2_004080C8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	15_2_004080C8

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Code function: 9_2_00427EE0 GetLogicalDriveStringsW,QueryDosDeviceW,lstrlenW,StrCmpNIW,

9_2_00427EE0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2016922 - Severity 1 - ET MALWARE Backdoor family PCRat/Gh0st CnC traffic : 192.168.2.4:49740 -> 137.220.137.85:24818

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.4:49740 -> 137.220.137.85:24818

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: BCPL-SGBGPNETGlobalASNSG BCPL-SGBGPNETGlobalASNSG

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Code function: 9_2_0042B0E8 recv,

9_2_0042B0E8

Source: global traffic

DNS traffic detected: DNS query: 24818.windows-updata.com

Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695127501.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695127501.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695264229.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, TASLogin.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695127501.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695264229.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695127501.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695264229.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, TASLogin.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, TASLogin.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, TASLogin.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695127501.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695127501.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695264229.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695127501.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695264229.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, TASLogin.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: TASLogin.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695127501.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695127501.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695264229.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695127501.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695127501.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695264229.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695127501.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695264229.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695127501.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695127501.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695264229.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695127501.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695264229.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, TASLogin.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, TASLogin.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695127501.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0L
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695127501.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695264229.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, TASLogin.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	String found in binary or memory: http://ocsp.sectigo.com04
Source: explorer.exe, 00000002.00000002.2960243626.0000000005D92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.mDD
Source: explorer.exe, 00000002.00000002.2960243626.0000000005D92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsof
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695127501.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695264229.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695127501.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe.0.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	String found in binary or memory: https://support.google.com/chrome/?p=usage_stats_crash_reports
Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695127501.00000000058EE000.00000004.00000020.00020000.00000000.sdmp, #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1695264229.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe.0.dr	String found in binary or memory: https://www.digicert.com/CPS0

System Summary

Contains functionality to delete services

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Code function: 9_2_0042D600 OpenSCManagerW,OpenServiceW,StartServiceW,ControlService,DeleteService,ChangeServiceConfigW,CloseServiceHandle,CloseServiceHandle,

9_2_0042D600

Detected potential crypto function

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_004208F4	9_2_004208F4
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_004250A3	9_2_004250A3
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_0041E0A4	9_2_0041E0A4
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_004248B4	9_2_004248B4
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_0042215C	9_2_0042215C
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_0041E9D4	9_2_0041E9D4
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_00425496	9_2_00425496
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_00424DF9	9_2_00424DF9
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_00424600	9_2_00424600
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_004256E7	9_2_004256E7
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 13_2_004208F4	13_2_004208F4
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 13_2_004250A3	13_2_004250A3
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 13_2_0041E0A4	13_2_0041E0A4
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 13_2_004248B4	13_2_004248B4
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 13_2_0042215C	13_2_0042215C
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 13_2_0041E9D4	13_2_0041E9D4
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 13_2_00425496	13_2_00425496
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 13_2_00424DF9	13_2_00424DF9
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 13_2_00424600	13_2_00424600
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 13_2_004256E7	13_2_004256E7
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 15_2_004208F4	15_2_004208F4
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 15_2_004250A3	15_2_004250A3
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 15_2_0041E0A4	15_2_0041E0A4
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 15_2_004248B4	15_2_004248B4
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 15_2_0042215C	15_2_0042215C
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 15_2_0041E9D4	15_2_0041E9D4
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 15_2_00425496	15_2_00425496
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 15_2_00424DF9	15_2_00424DF9
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 15_2_00424600	15_2_00424600
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 15_2_004256E7	15_2_004256E7

Dropped file seen in connection with other malware

Source: Joe Sandbox View

Dropped File: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe CA1F26619B4483F4BDA6B4D352B58A9C4F30C2E985E62E761B7D6F3440922264

Found potential string decryption / allocating functions

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: String function: 00406000 appears 33 times
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: String function: 00406A80 appears 39 times
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: String function: 00406BB8 appears 31 times
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: String function: 00406060 appears 42 times
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: String function: 004063A0 appears 36 times
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: String function: 00406824 appears 582 times
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: String function: 004090B0 appears 39 times
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: String function: 0040ADB8 appears 600 times

PE file contains executable resources (Code or Archives)

Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe

Static PE information: Resource name: ZIP type: Zip archive data, at least v2.0 to extract, compression method=deflate

Uses 32bit PE files

Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: TASLogin.exe.0.dr	Static PE information: Section: .ace ZLIB complexity 0.99965625
Source: TASLogin.exe.0.dr	Static PE information: Section: .tvm0 ZLIB complexity 0.9984584530651341

Source: classification engine

Classification label: mal69.evad.winEXE@16/21@1/1

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Code function: 9_2_0043BC08 LookupPrivilegeValueW,AdjustTokenPrivileges,

9_2_0043BC08

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Code function: 9_2_0043D53C GetDiskFreeSpaceW,

9_2_0043D53C

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Code function: 9_2_0040BA58 GetModuleHandleW,FindResourceW,LoadResource,LockResource,FreeResource,

9_2_0040BA58

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Code function: 9_2_0042D600 OpenSCManagerW,OpenServiceW,StartServiceW,ControlService,DeleteService,ChangeServiceConfigW,CloseServiceHandle,CloseServiceHandle,

9_2_0042D600

Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe

File created: C:\Users\Public\BRBUAU

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7744:120:WilError_03
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Mutant created: \Sessions\1\BaseNamedObjects\$0_4BF0F494

Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Process created: C:\Windows\explorer.exe	Jump to behavior

Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe "C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe"
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe C:\Users\Public\Music\LI1L1K
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: C:\Windows\explorer.exe	Process created: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe "C:\Users\Public\Documents\A9Q9P9\TASLogin.exe"
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Process created: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe C:\Users\Public\Documents\A9Q9P9\TASLogin.exe
Source: unknown	Process created: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe "C:\Users\Public\Documents\A9Q9P9\TASLogin.exe"
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Process created: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe C:\Users\Public\Documents\A9Q9P9\TASLogin.exe
Source: unknown	Process created: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe "C:\Users\Public\Documents\A9Q9P9\TASLogin.exe"
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Process created: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe C:\Users\Public\Documents\A9Q9P9\TASLogin.exe
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe C:\Users\Public\Music\LI1L1K	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe "C:\Users\Public\Documents\A9Q9P9\TASLogin.exe"	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Process created: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Process created: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Process created: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Jump to behavior

Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.fileexplorer.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cldapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uiribbon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositoryclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: structuredquery.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: tasloginbase.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: schedcli.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: tasloginbase.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: schedcli.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: tasloginbase.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: schedcli.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

PE / OLE file has a valid certificate

Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe

Static file information: File size 57700088 > 1048576

PE file has a big raw section

Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x368b000

Binary contains paths to debug symbols

Source:	Binary string: c:\Users\86130\Desktop\cert\debug\cert.pdb source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, 00000000.00000003.1718229560.0000000005E48000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe, 00000008.00000002.1858149624.0000000010299000.00000002.00000001.01000000.0000000F.sdmp, TASLogin.exe, 0000000C.00000002.1957609639.0000000010299000.00000002.00000001.01000000.0000000F.sdmp, TASLogin.exe, 0000000E.00000002.2037664334.0000000010299000.00000002.00000001.01000000.0000000F.sdmp, TASLoginBase.dll.0.dr
Source:	Binary string: D:\Workspace\p-2ed35f15174943f6b676502b51f53d81\Output\TASLogin.pdb source: TASLogin.exe, TASLogin.exe, 0000000E.00000000.2034919769.000000000044A000.00000002.00000001.01000000.0000000E.sdmp, TASLogin.exe, 0000000F.00000000.2035415053.000000000044A000.00000002.00000001.01000000.0000000E.sdmp, TASLogin.exe.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Unpacked PE file: 9.2.TASLogin.exe.400000.0.unpack .ace:ER;.ace:R;.ace:W;.ace:R;.ace:W;.ace:R;.tvm0:ER;.ace:R;.ace:EW; vs .text:ER;.itext:ER;.data:W;.bss:W;.idata:W;.didata:W;.tls:W;.rdata:R;.reloc:R;.rsrc:R;
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Unpacked PE file: 13.2.TASLogin.exe.400000.0.unpack .ace:ER;.ace:R;.ace:W;.ace:R;.ace:W;.ace:R;.tvm0:ER;.ace:R;.ace:EW; vs .text:ER;.itext:ER;.data:W;.bss:W;.idata:W;.didata:W;.tls:W;.rdata:R;.reloc:R;.rsrc:R;
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Unpacked PE file: 15.2.TASLogin.exe.400000.0.unpack .ace:ER;.ace:R;.ace:W;.ace:R;.ace:W;.ace:R;.tvm0:ER;.ace:R;.ace:EW; vs .text:ER;.itext:ER;.data:W;.bss:W;.idata:W;.didata:W;.tls:W;.rdata:R;.reloc:R;.rsrc:R;

Entry point lies outside standard sections

Source: initial sample

Static PE information: section where entry point is pointing to: .ace

PE file contains sections with non-standard names

Source: TASLogin.exe.0.dr	Static PE information: section name: .ace
Source: TASLogin.exe.0.dr	Static PE information: section name: .ace
Source: TASLogin.exe.0.dr	Static PE information: section name: .ace
Source: TASLogin.exe.0.dr	Static PE information: section name: .ace
Source: TASLogin.exe.0.dr	Static PE information: section name: .ace
Source: TASLogin.exe.0.dr	Static PE information: section name: .ace
Source: TASLogin.exe.0.dr	Static PE information: section name: .tvm0
Source: TASLogin.exe.0.dr	Static PE information: section name: .ace
Source: TASLogin.exe.0.dr	Static PE information: section name: .ace
Source: TASLoginBase.dll.0.dr	Static PE information: section name: .textbss
Source: TASLoginBase.dll.0.dr	Static PE information: section name: .didat

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Code function: 0_3_05BBB761 push FFFFFFA6h; iretd	0_3_05BBB76B
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Code function: 0_3_05BBB761 push FFFFFFA6h; iretd	0_3_05BBB76B
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Code function: 0_3_05BBB761 push FFFFFFA6h; iretd	0_3_05BBB76B
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Code function: 0_3_05BBB7E1 push FFFFFFA6h; iretd	0_3_05BBB76B
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Code function: 0_3_05BBB7E1 push FFFFFFA6h; iretd	0_3_05BBB76B
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Code function: 0_3_05BBB7E1 push FFFFFFA6h; iretd	0_3_05BBB76B
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Code function: 0_3_05BBB761 push FFFFFFA6h; iretd	0_3_05BBB76B
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Code function: 0_3_05BBB761 push FFFFFFA6h; iretd	0_3_05BBB76B
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Code function: 0_3_05BBB761 push FFFFFFA6h; iretd	0_3_05BBB76B
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Code function: 0_3_05BBB7E1 push FFFFFFA6h; iretd	0_3_05BBB76B
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Code function: 0_3_05BBB7E1 push FFFFFFA6h; iretd	0_3_05BBB76B
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Code function: 0_3_05BBB7E1 push FFFFFFA6h; iretd	0_3_05BBB76B
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Code function: 0_3_05BBB761 push FFFFFFA6h; iretd	0_3_05BBB76B
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Code function: 0_3_05BBB761 push FFFFFFA6h; iretd	0_3_05BBB76B
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Code function: 0_3_05BBB761 push FFFFFFA6h; iretd	0_3_05BBB76B
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Code function: 0_3_05BBB7E1 push FFFFFFA6h; iretd	0_3_05BBB76B
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Code function: 0_3_05BBB7E1 push FFFFFFA6h; iretd	0_3_05BBB76B
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Code function: 0_3_05BBB7E1 push FFFFFFA6h; iretd	0_3_05BBB76B
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 8_2_0044CD4D push esi; ret	8_2_0044CD56
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_00426840 push ecx; mov dword ptr [esp], ecx	9_2_00426845
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_00443318 push 004433B5h; ret	9_2_004433AD
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_00426448 push ecx; mov dword ptr [esp], edx	9_2_00426449
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_00426408 push ecx; mov dword ptr [esp], edx	9_2_00426409
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_00431070 push 004310B8h; ret	9_2_004310B0
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_0043E8C0 push 0043E935h; ret	9_2_0043E92D
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_0042C0EC push 0042C138h; ret	9_2_0042C130
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_0042B0AC push 0042B0E4h; ret	9_2_0042B0DC
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_004159E0 push ecx; mov dword ptr [esp], eax	9_2_004159E2
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_004079FD pushfd ; retf	9_2_004079FE
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_00415AA4 push ecx; mov dword ptr [esp], eax	9_2_00415AA6
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_0042C380 push 0042C3B8h; ret	9_2_0042C3B0

Source: TASLogin.exe.0.dr	Static PE information: section name: .ace entropy: 7.998370715747767
Source: TASLogin.exe.0.dr	Static PE information: section name: .tvm0 entropy: 7.997724175014119
Source: TASLogin.exe.0.dr	Static PE information: section name: .ace entropy: 7.977928914872778

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	File created: C:\Users\Public\Documents\A9Q9P9\TASLoginBase.dll			Jump to dropped file
Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	File created: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe			Jump to dropped file

Boot Survival

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Code function: 9_2_0042D600 OpenSCManagerW,OpenServiceW,StartServiceW,ControlService,DeleteService,ChangeServiceConfigW,CloseServiceHandle,CloseServiceHandle,

9_2_0042D600

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run IFfmsjhgsda			Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run IFfmsjhgsda			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: icon122.png

Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Detected PE file pumping (to bypass AV & sandboxing)

Source: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe

Static PE information: Resource name: RT_RCDATA size: 0x335c318

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_13-18111

Contains functionality to enumerate running services

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Code function: OpenSCManagerW,EnumServicesStatusExW,OpenServiceW,QueryServiceConfigW,QueryServiceConfig2W,CloseServiceHandle,CloseServiceHandle,

9_2_0042D1D4

Contains functionality to query network adapater information

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: VirtualAlloc,GetAdaptersInfo,lstrlenW,VirtualFree,	9_2_0040B0EC
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: VirtualAlloc,GetAdaptersInfo,lstrlenW,VirtualFree,	9_2_0040B0EA
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: VirtualAlloc,GetAdaptersInfo,lstrlenW,VirtualFree,	9_2_0040AEE0

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Window / User API: threadDelayed 6667

Jump to behavior

Found large amount of non-executed APIs

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	API coverage: 9.1 %
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	API coverage: 9.1 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe TID: 8044

Thread sleep time: -66670s >= -30000s

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Last function: Thread delayed

Sleep loop found (likely to delay execution)

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Thread sleep count: Count: 6667 delay: -10

Jump to behavior

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_00408694 FindFirstFileW,FindClose,	9_2_00408694
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 9_2_004080C8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	9_2_004080C8
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 13_2_00408694 FindFirstFileW,FindClose,	13_2_00408694
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 13_2_004080C8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	13_2_004080C8
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 15_2_00408694 FindFirstFileW,FindClose,	15_2_00408694
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: 15_2_004080C8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	15_2_004080C8

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Code function: 9_2_00427EE0 GetLogicalDriveStringsW,QueryDosDeviceW,lstrlenW,StrCmpNIW,

9_2_00427EE0

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Code function: 9_2_00408F10 GetSystemInfo,

9_2_00408F10

Source: TASLogin.exe, 00000009.00000002.2959716114.0000000000598000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllzzrb
Source: explorer.exe, 00000002.00000002.2960624197.00000000067B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}a
Source: TASLogin.exe, 0000000D.00000002.1956635036.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllJ
Source: explorer.exe, 00000002.00000002.2960624197.00000000067B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA
Source: TASLogin.exe, 0000000F.00000002.2036518898.0000000000528000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll}}

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	API call chain: ExitProcess graph end node	graph_9-15813
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	API call chain: ExitProcess graph end node	graph_13-15782
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	API call chain: ExitProcess graph end node	graph_13-17591
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	API call chain: ExitProcess graph end node	graph_13-17818
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	API call chain: ExitProcess graph end node	graph_15-15782
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	API call chain: ExitProcess graph end node	graph_15-17591
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	API call chain: ExitProcess graph end node	graph_15-17818

Source: C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_9-15882

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Code function: 9_2_0042CD20 GetProcessHeap,lstrlenW,

9_2_0042CD20

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Memory written: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Memory written: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Memory written: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe base: 400000 value starts with: 4D5A	Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Process created: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Process created: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Process created: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Jump to behavior

Source: TASLogin.exe, 00000009.00000002.2960043554.0000000000A5F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program ManagerA
Source: TASLogin.exe, 00000009.00000003.1861289737.000000000063C000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe, 00000009.00000003.1861511431.000000000063C000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe, 00000009.00000003.1861556411.000000000063C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $2024-10-28 04:05:21$4515531$Program Manager$$3535539496$zxcv12321$1111111$x
Source: TASLogin.exe, 00000009.00000002.2960043554.0000000000A2B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: $2024-10-28 04:05:21$4515531$Program Manager$$3535539496$zxcv12321$1111111$host.exe
Source: TASLogin.exe, 00000009.00000002.2959716114.000000000063C000.00000004.00000020.00020000.00000000.sdmp, TASLogin.exe, 00000009.00000002.2959716114.00000000005E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $2024-10-28 04:05:21$4515531$Program Manager$$3535539496$zxcv12321$1111111$

Language, Device and Operating System Detection

Contains functionality to query CPU information (cpuid)

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Code function: 9_2_004046A0 cpuid

9_2_004046A0

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	9_2_004087CC
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: GetLocaleInfoW,	9_2_0041A844
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: GetLocaleInfoW,	9_2_0041D2E0
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_00407C6C
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: EnumSystemLocalesW,	9_2_0041D4C8
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: GetLocaleInfoW,	9_2_0041A7F8
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	13_2_004087CC
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: GetLocaleInfoW,	13_2_0041A844
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: GetLocaleInfoW,	13_2_0041D2E0
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	13_2_00407C6C
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: EnumSystemLocalesW,	13_2_0041D4C8
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: GetLocaleInfoW,	13_2_0041A7F8
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	15_2_004087CC
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: GetLocaleInfoW,	15_2_0041A844
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: GetLocaleInfoW,	15_2_0041D2E0
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	15_2_00407C6C
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: EnumSystemLocalesW,	15_2_0041D4C8
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Code function: GetLocaleInfoW,	15_2_0041A7F8

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Code function: 9_2_0041A7A8 GetLocalTime,

9_2_0041A7A8

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Code function: 9_2_0043B588 GetUserNameW,

9_2_0043B588

Source: C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Code function: 9_2_0041C9BC GetVersionExW,

9_2_0041C9BC

Stealing of Sensitive Information

Searches for user specific document files

Source: C:\Windows\explorer.exe	Directory queried: C:\Users\Public\Documents	Jump to behavior
Source: C:\Windows\explorer.exe	Directory queried: C:\Users\Public\Documents\A9Q9P9	Jump to behavior
Source: C:\Windows\explorer.exe	Directory queried: C:\Users\Public\Documents\A9Q9P9	Jump to behavior
Source: C:\Windows\explorer.exe	Directory queried: C:\Users\Public\Documents	Jump to behavior
Source: C:\Windows\explorer.exe	Directory queried: C:\Users\Public\Documents\A9Q9P9	Jump to behavior
Source: C:\Windows\explorer.exe	Directory queried: C:\Users\Public\Documents\A9Q9P9	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Service Execution	1 DLL Search Order Hijacking	1 DLL Search Order Hijacking	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Windows Service	1 Access Token Manipulation	12 Software Packing	Security Account Manager	1 System Service Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	11 Windows Service	1 DLL Side-Loading	NTDS	13 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	112 Process Injection	1 DLL Search Order Hijacking	LSA Secrets	35 System Information Discovery	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	11 Masquerading	Cached Domain Credentials	211 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Virtualization/Sandbox Evasion	DCSync	22 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Rundll32	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	3%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	0%	ReversingLabs
C:\Users\Public\Documents\A9Q9P9\TASLoginBase.dll	3%	ReversingLabs

Source	Detection	Scanner	Label
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
24818.windows-updata.com	137.220.137.85	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	false	URL Reputation: safe	unknown
http://schemas.mDD	explorer.exe, 00000002.00000002.2960243626.0000000005D92000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sectigo.com/CPS0	#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=usage_stats_crash_reports	#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	false		unknown
http://schemas.microsof	explorer.exe, 00000002.00000002.2960243626.0000000005D92000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com04	#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
137.220.137.85	24818.windows-updata.com	Singapore		64050	BCPL-SGBGPNETGlobalASNSG	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543679
Start date and time:	2024-10-28 09:04:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe renamed because original name is a hash value
Original Sample Name:	_.hpw.scr.exe
Detection:	MAL
Classification:	mal69.evad.winEXE@16/21@1/1
EGA Information:	Successful, ratio: 42.9%
HCA Information:	Successful, ratio: 70% Number of executed functions: 100 Number of non-executed functions: 193
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe, PID 7480 because there are no executed function
Execution Graph export aborted for target TASLogin.exe, PID 1620 because there are no executed function
Execution Graph export aborted for target TASLogin.exe, PID 2084 because there are no executed function
Execution Graph export aborted for target TASLogin.exe, PID 7988 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe

Simulations

Behavior and APIs

Time	Type	Description
04:05:11	API Interceptor	1x Sleep call for process: explorer.exe modified
04:05:16	API Interceptor	1x Sleep call for process: OpenWith.exe modified
04:05:22	API Interceptor	3701x Sleep call for process: TASLogin.exe modified
08:05:22	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run IFfmsjhgsda C:\Users\Public\Documents\A9Q9P9\TASLogin.exe
08:05:30	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run IFfmsjhgsda C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
137.220.137.85	SirixWxjKO.exe	Get hash	malicious	Unknown	Browse
137.220.137.85	SirixWxjKO.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
24818.windows-updata.com	SirixWxjKO.exe	Get hash	malicious	Unknown	Browse	137.220.137.85
24818.windows-updata.com	SirixWxjKO.exe	Get hash	malicious	Unknown	Browse	137.220.137.85

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BCPL-SGBGPNETGlobalASNSG	ppc.elf	Get hash	malicious	Unknown	Browse	134.122.132.94
	libcurl64.dll.bin.dll	Get hash	malicious	Unknown	Browse	27.124.45.155
	M4.1vserup-Setup_Install.exe	Get hash	malicious	Unknown	Browse	27.124.45.155
	M4.1vserup-Setup_Install.exe	Get hash	malicious	Unknown	Browse	27.124.45.155
	WzqSn6cjzD.elf	Get hash	malicious	Rekoobe	Browse	134.122.129.15
	InBM8iB3GY.elf	Get hash	malicious	Unknown	Browse	134.122.129.38
	RINLZ08tM6.elf	Get hash	malicious	ConnectBack	Browse	134.122.176.216
	oVkL551lD3.elf	Get hash	malicious	ConnectBack	Browse	134.122.176.216
	na.elf	Get hash	malicious	Rekoobe	Browse	27.124.45.146
	na.elf	Get hash	malicious	Rekoobe	Browse	27.124.45.146

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	SirixWxjKO.exe	Get hash	malicious	Unknown	Browse
C:\Users\Public\Documents\A9Q9P9\TASLogin.exe	SirixWxjKO.exe	Get hash	malicious	Unknown	Browse
C:\Users\Public\Documents\A9Q9P9\TASLoginBase.dll	SirixWxjKO.exe	Get hash	malicious	Unknown	Browse
C:\Users\Public\Documents\A9Q9P9\TASLoginBase.dll	SirixWxjKO.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\gz.txt

Download File

Process:	C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.5216406363433186
Encrypted:	false
SSDEEP:	3:4sm:45
MD5:	3A910712891157EEA6A3244E09C71327
SHA1:	DC4F35ADF281441C6F289D7DC2DF3176200CCB89
SHA-256:	D6DFEBF391F795583510D07C8C1078FC240F1CE0490C379202B05FC47C1A3184
SHA-512:	A11832E10155EB0F4AFCCB1AF942816CEAA30CA5A6218D81FF023B3098D9FE854152989A73AEF6B439A7CE03A3B8839DF101AB26DBADA8834D4169D5C90E715A
Malicious:	false
Preview:	exe,hwp

C:\Users\Public\BRBUAU

Download File

Process:	C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	2084675
Entropy (8bit):	7.858929675721841
Encrypted:	false
SSDEEP:	49152:er57pncZYCvtokiIs5pc+hhdtP6I7D2Sk:er5m2gtDiBH2
MD5:	B8AA59AE7DACA08C83F3C1D833BC2CA9
SHA1:	DA85B9EF05D8B786CAEF59DFB987B869A0872295
SHA-256:	B25C78CED002AC56D45792272487BAEBDFEEC643634D26C2F95070FBE1AD4044
SHA-512:	4B9F9C1711855F5884E36C76E0BBE72E6616BDA2D4387CC750403C4EA0D6B025E826F213CD5953C0AAC8E83C06ADFCBED6AE3564BC8087CC5C82D8AAAF48ACA1
Malicious:	false
Preview:	PK........a.6Y..>.E..........winzipper/gii.png.\i\.G..]..N.}..7.....L......P....c....$..b.......1...W.H....ApDT.@..@.(.. ...W.3...o?,.tu.z..W.^.:.='..[Q.Uq(..(....\Y...?....).....6.r..`Sxxc.....z.N....j......N..N.....8.....Y.o(.'..2E...R.77.a..'.V...5..L.a.R..H1=.;).....J.R&.q.r.r.......n...#.ez.-.4;..!....t9..w.:.v. ..u.\.Ak..!m_n.k.R.?..@Q..p^G..S..D.^....K.....:jF..P.r.f.....}.GQ.m.k70&....n0..x7.k.h#o......O;..z..m.^0..\|{t.9\...a7.+...z..CE..3..#..&...=.=@C..}..A:.fz....go..?.S}.'....Lk.in'..h..3..jcO.5..Z..z.T..%n...k;.z8..4u?.V...p.l.;.w9[Nu.9s..V.eY.l.]....[.k.As.B..u..5..<~...:z....xv...<(.../....i?...L...........NY.X.....sQw......V`.H...T....p0.F...+Z+.].[o?..:...iu.r....zzZO.xM.8..,muKgG....?...}...U.... 2......oo%.. <.p.s.....?C"...G..W...rv..!....9.E.. .6...LWo..u&.....Z..7...~...5.]w...x:....q+#.S..[z.].......~......e..t.9.].-.W..:.[. %.Ok>.^.F.V_G.eT......./...S.LE...k.g.. .T[..e...k;.rE.D...8.,...D.h.....2.

C:\Users\Public\Documents\A9Q9P9\TASLogin.KInf

Download File

Process:	C:\Users\Public\Documents\A9Q9P9\TASLogin.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	3.8464484274890114
Encrypted:	false
SSDEEP:	6:fTHNlKnGK1Mg1ftsoPf21kDxfnLQyw+/THNlKnGV/B1ftsoPf21kDxfnLQywc:rH3KqStJSOLi+LH3KAtJSOLic
MD5:	70DA3A34D12F090D3EEE3BE320E77E37
SHA1:	4BBF76873DCAA58F4F7F1C14A0AB0EA4153AC46C
SHA-256:	F0E89736800249D2359A266F9CB2E6CDDD22570D45FA2B6A39AE92477401C594
SHA-512:	0B8A6F6B5D4352577B36291334DBF4C8A3C5F0E8948EB01639378F1994B46DA302618E7A9B72B027154C9DB318F3C3CFCEF724E85449C95179D6C8B83BCA5FB5
Malicious:	false
Preview:	..........K..u.M..0.". .".$.=.!. .=.".(.0. .$.. .%..".(.....K..x..M..0.B.e.~.....K....OM..0.S..L.G.y.~.t...g.c.L.u.h.`.\|...b.u.b.>.u.h.u.....K..A.KM..0.b.K.G.Y.^.M.........K..u.M..0.". .".$.=.!. .=.".(.0. .$.. .%..#.&.....K..x..M..0.B.e.~.....K....OM..0.S..L.G.y.~.t...g.c.L.u.h.`.\|...b.u.b.>.u.h.u.....K..A.KM..0.b.K.G.Y.^.M.

C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

Download File

Process:	C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	581584
Entropy (8bit):	6.872912235056943
Encrypted:	false
SSDEEP:	6144:vSB3SqIVGOto+XBwwcr7oegM5BZvzx/LH2V9TBipz1ze5H7wOgyS64GdPgdYuR:vSBXLODdcdqXTUpz1Kbsyb4FdYG
MD5:	E6A3CACCBD9CA82F38A14BD0D4428240
SHA1:	63937051B04582255505261D512A80AB40513B5F
SHA-256:	CA1F26619B4483F4BDA6B4D352B58A9C4F30C2E985E62E761B7D6F3440922264
SHA-512:	21FBC87528DBC6B0F4AEE165D9B812595AD1D30AF434C401F4BC86D8BD6A209DA950523CF00E7AE5FB1676350CD299D96E0E7A0255E6EBF53AEB7E51DD5D133E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SirixWxjKO.exe, Detection: malicious, Browse Filename: SirixWxjKO.exe, Detection: malicious, Browse
Preview:	MZ......................@.......H.......:..e............................!..L.!This program cannot be run in DOS mode....$.............]...]...].!/]...].!-]'..].!,]...]...\...]...\...]...\...]..]]...]..M]...]...]...]...\...]..!]...]...\...]Rich...]........................PE..L....Wod....................."......N.............@............................................................................(.......................)..........PI..p....................J.......I..@............................................ace............................... ..`.ace....6...........................@..@.ace....\(..........................@....ace................................@..@.ace................................@....ace................................@..@.tvm0....@.......................... ..`.ace.....0....... ..................@..B.ace....T}...0...~.................. ...........................................................................................................................

C:\Users\Public\Documents\A9Q9P9\TASLoginBase.dll

Download File

Process:	C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	55734272
Entropy (8bit):	5.679064125230232
Encrypted:	false
SSDEEP:	24576:geiVTsbha1Ap4sB8n4ypNqb5GWKHuVFtNjHYPQhNzl+qNLCWhFBIIb7SCeU:9iVyCCMHYTce9NmuISSjU
MD5:	4792F8361D50D90955C0525A2BFF1625
SHA1:	9C304B2CDA0F6701F89AFA21C8F8521E6B0BB22C
SHA-256:	44FED379DC48CEEEFF46FD463CBC19015ADAF625FCF6279675724A600520E345
SHA-512:	52FAE02210C88F90634D711E20B1CC2BA3F4DBDE6801B41942E8538E8E7EABD2D7AB1D9938EB180C092DC92F4B466FB2629F8A604F4CE6B3769DC39C593B9A2A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: SirixWxjKO.exe, Detection: malicious, Browse Filename: SirixWxjKO.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D.......................'"...'"....'"....'"...'".......'"...Rich..........................PE..L....-%f...........!.....0...06......m........................................`.....................................0~7.R.... 8.......8.@.%...................^..Q....)..............................................18.......8.@....................textbss.A...............................text....$...`...0.................. ..`.rdata........)......@..............@..@.data...t.....7..P...0.............@....idata...[... 8..`.................@....didat........8....................@....rsrc...@.%...8...%................@..@.reloc........^.......P.............@..B................................................................................................................................................................................

C:\Users\Public\Documents\A9Q9P9\gii.png

Download File

Process:	C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe
File Type:	data
Category:	dropped
Size (bytes):	324608
Entropy (8bit):	6.519141819659315
Encrypted:	false
SSDEEP:	6144:sDERrfEH1INKtzWc9yijT0OPFJXpLxytqGjd17:2ERAHSszWcEif0+FRBwtp7
MD5:	469CAF4D761A34C793201A577963E414
SHA1:	3ED245D3C96E36F4E7E6A08AD4C66E8ECA65F7A5
SHA-256:	F76F68C9E3AFB0D4D5B5AEFFF62D76024C8C2CB50D7BFCB8E11AFA297F5B5CB0
SHA-512:	B8117428DD401C7E16860C92D5C73DE68FD16C708E9AB7F06A51E63A738CB790722CE281C85043D3455B3E05D15B7E450FAF8CD8CB4C92AB137048C9A0AA9F58
Malicious:	false
Preview:	...{.{{{.{.{rr{{3{{{{{{{.{.{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{.{{=.{../.@.3..@......................................{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{.{{..{.j..{{{{{{{{[{......{..{{U{{{{{{w..{{.{{{..{{{.{{.{{{.{{x{{{{{{{x{{{{{{{{..{{.{{{{{{.{{{{{.{{.{{{{.{{.{{{{{{.{{{{{{{{{{{{.{..{{{..{W.{{{{{{{{{{{{{{{{{{{;.{w.{{{{{{{{{{{{{{{{{{{{{{{{{{{+.{.{{{{{{{{{{{{{{{{{{{...{.{{{..{.{{{{{{{{{{{{{{{{{{.....{{{..{{.{{{..{{.{{{{{{{{{{{{{{.{{......{{wy{{{..{{.{{{..{{{{{{{{{{{{{.{{.....{{{..{{{..{{.{{{..{{{{{{{{{{{{{.{{;....{{{{.G.{{..{{{{{{..{{{{{{{{{{{{{{{{;......{{..{{{.{{.{{{..{{{{{{{{{{{{{.{{;.......{.{{{..{{.{{{..{{{{{{{{{{{{{.{{;....{{{{.{{{{..{{{{{{..{{{{{{{{{{{{{{{{;......{{.{{{{+.{{.{{{..{{{{{{{{{{{{{.{{.......{{w.{{{;.{{.{{{..{{{{{{{{{{{{{.{{.....{{{W.{{{..{{.{{{I.{{{{{{{{{{{{{.{{.{{{{{{{{{{{{{..{{{{{{u.{{{{{{{{{{{{{.{{.{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{

C:\Users\Public\Documents\A9Q9P9\lee0923.hwp

Download File

Process:	C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe
File Type:	Hangul (Korean) Word Processor File 5.x
Category:	dropped
Size (bytes):	200704
Entropy (8bit):	7.855367666447655
Encrypted:	false
SSDEEP:	3072:ySVmSJYhsV+O9JXWIfRNFyrQ2KGw4wI3m6QfZMOBUyMO+wiloOy81Ty:BXKhsV+GJXxLzGwo3mjhb8O+wc1Ty
MD5:	A2758B91909ECAAF1E3948EC6596B023
SHA1:	1287B543FA62039150BDC876FB4ED5A73A6D0093
SHA-256:	5D41A54E8E24725CE1A0237A1254B197AFD13F40D1A049F90D9F04D8902801B4
SHA-512:	AB0B98E4A99D623E38D803BDE23F1A00F7F036E3C673BD157FEF04DF803819B61156D1840C615BFC0AC642DB277B202773D36C80C6076D1A8446FB28B3C40DE3
Malicious:	false
Preview:	......................>...........................................................p...........................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.............................................................................................................F.i.l.e.H.e.a.d.e.r.................................................................................................G.............H.w.p.S.u.m.m.a.r.y.I.n.f.o.r.m.a.t.i.o.n.........................................................................>...........D.o.c.I.n.f.o...........................................................................................

C:\Users\Public\Music\LI1L1K\1YH1H1.url

Download File

Process:	C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:\\\C:\Users\Public\Documents\A9Q9P9\lee0923.hwp>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	130
Entropy (8bit):	4.933813966373562
Encrypted:	false
SSDEEP:	3:HRAbABGQYmHmRDaHF5hdCl+D10AqSVyyKTLwkPaHF5hdCl+D1Vvn:HRYFVmoaH9dClApVh0BPaH9dCGn
MD5:	A95FA9F0434DA0FE1747F3A9EAFD2445
SHA1:	05D283F953397C91C3D8C0365878D1B4BA0DF0FE
SHA-256:	B35102AFB23B03D3E9489B76A92855ED3AC7D72AE3F87D1AC5367FC40F1FD8D0
SHA-512:	62F232737B4C95F12B60B1176EC06A161AE8121CAF41D3281BA72061A8AF22FA476C28370F52584A2D9794A1228C024F6B48C5EEE19EE8B7CA03B95F5682DC92
Malicious:	false
Preview:	[InternetShortcut]..URL=file:\\\C:\Users\Public\Documents\A9Q9P9\lee0923.hwp..WorkingDirectory=C:\Users\Public\Documents\A9Q9P9\..

C:\Users\Public\Music\LI1L1K\4N7N6N.url

Download File

Process:	C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:\\\C:\Users\Public\Documents\A9Q9P9\lee0923.hwp>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	130
Entropy (8bit):	4.933813966373562
Encrypted:	false
SSDEEP:	3:HRAbABGQYmHmRDaHF5hdCl+D10AqSVyyKTLwkPaHF5hdCl+D1Vvn:HRYFVmoaH9dClApVh0BPaH9dCGn
MD5:	A95FA9F0434DA0FE1747F3A9EAFD2445
SHA1:	05D283F953397C91C3D8C0365878D1B4BA0DF0FE
SHA-256:	B35102AFB23B03D3E9489B76A92855ED3AC7D72AE3F87D1AC5367FC40F1FD8D0
SHA-512:	62F232737B4C95F12B60B1176EC06A161AE8121CAF41D3281BA72061A8AF22FA476C28370F52584A2D9794A1228C024F6B48C5EEE19EE8B7CA03B95F5682DC92
Malicious:	false
Preview:	[InternetShortcut]..URL=file:\\\C:\Users\Public\Documents\A9Q9P9\lee0923.hwp..WorkingDirectory=C:\Users\Public\Documents\A9Q9P9\..

C:\Users\Public\Music\LI1L1K\52M2L5.url

Download File

Process:	C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:\\\C:\Users\Public\Documents\A9Q9P9\lee0923.hwp>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	130
Entropy (8bit):	4.933813966373562
Encrypted:	false
SSDEEP:	3:HRAbABGQYmHmRDaHF5hdCl+D10AqSVyyKTLwkPaHF5hdCl+D1Vvn:HRYFVmoaH9dClApVh0BPaH9dCGn
MD5:	A95FA9F0434DA0FE1747F3A9EAFD2445
SHA1:	05D283F953397C91C3D8C0365878D1B4BA0DF0FE
SHA-256:	B35102AFB23B03D3E9489B76A92855ED3AC7D72AE3F87D1AC5367FC40F1FD8D0
SHA-512:	62F232737B4C95F12B60B1176EC06A161AE8121CAF41D3281BA72061A8AF22FA476C28370F52584A2D9794A1228C024F6B48C5EEE19EE8B7CA03B95F5682DC92
Malicious:	false
Preview:	[InternetShortcut]..URL=file:\\\C:\Users\Public\Documents\A9Q9P9\lee0923.hwp..WorkingDirectory=C:\Users\Public\Documents\A9Q9P9\..

C:\Users\Public\Music\LI1L1K\84O4N7.url

Download File

Process:	C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:\\\C:\Users\Public\Documents\A9Q9P9\lee0923.hwp>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	130
Entropy (8bit):	4.933813966373562
Encrypted:	false
SSDEEP:	3:HRAbABGQYmHmRDaHF5hdCl+D10AqSVyyKTLwkPaHF5hdCl+D1Vvn:HRYFVmoaH9dClApVh0BPaH9dCGn
MD5:	A95FA9F0434DA0FE1747F3A9EAFD2445
SHA1:	05D283F953397C91C3D8C0365878D1B4BA0DF0FE
SHA-256:	B35102AFB23B03D3E9489B76A92855ED3AC7D72AE3F87D1AC5367FC40F1FD8D0
SHA-512:	62F232737B4C95F12B60B1176EC06A161AE8121CAF41D3281BA72061A8AF22FA476C28370F52584A2D9794A1228C024F6B48C5EEE19EE8B7CA03B95F5682DC92
Malicious:	false
Preview:	[InternetShortcut]..URL=file:\\\C:\Users\Public\Documents\A9Q9P9\lee0923.hwp..WorkingDirectory=C:\Users\Public\Documents\A9Q9P9\..

C:\Users\Public\Music\LI1L1K\96P9P8.url

Download File

Process:	C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:\\\C:\Users\Public\Documents\A9Q9P9\TASLogin.exe>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	131
Entropy (8bit):	4.876320183147702
Encrypted:	false
SSDEEP:	3:HRAbABGQYmHmRDaHF5hdCl+D1MkOKPSxXjLwkPaHF5hdCl+D1Vvn:HRYFVmoaH9dCdkhSxTBPaH9dCGn
MD5:	83EF7F4389E982E161E52FE111E992B2
SHA1:	198BDCAA7B6BD89DF4A0F9AECCFCD08A8937C44B
SHA-256:	0146331AC469E8527473D768840FFD205BD751C11E98FA1C98F9CB81834B0222
SHA-512:	D161046CF16DC76308AAF342E7B221723A2C841C7711D5C0741772B5AFC2BCA132398021AA040D31D9E627BB909C4224525EA8BE3658795EBF01426DAC66900C
Malicious:	false
Preview:	[InternetShortcut]..URL=file:\\\C:\Users\Public\Documents\A9Q9P9\TASLogin.exe..WorkingDirectory=C:\Users\Public\Documents\A9Q9P9\..

C:\Users\Public\Music\LI1L1K\ARAUAU.url

Download File

Process:	C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:\\\C:\Users\Public\Documents\A9Q9P9\TASLogin.exe>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	131
Entropy (8bit):	4.876320183147702
Encrypted:	false
SSDEEP:	3:HRAbABGQYmHmRDaHF5hdCl+D1MkOKPSxXjLwkPaHF5hdCl+D1Vvn:HRYFVmoaH9dCdkhSxTBPaH9dCGn
MD5:	83EF7F4389E982E161E52FE111E992B2
SHA1:	198BDCAA7B6BD89DF4A0F9AECCFCD08A8937C44B
SHA-256:	0146331AC469E8527473D768840FFD205BD751C11E98FA1C98F9CB81834B0222
SHA-512:	D161046CF16DC76308AAF342E7B221723A2C841C7711D5C0741772B5AFC2BCA132398021AA040D31D9E627BB909C4224525EA8BE3658795EBF01426DAC66900C
Malicious:	false
Preview:	[InternetShortcut]..URL=file:\\\C:\Users\Public\Documents\A9Q9P9\TASLogin.exe..WorkingDirectory=C:\Users\Public\Documents\A9Q9P9\..

C:\Users\Public\Music\LI1L1K\CSBSBV.url

Download File

Process:	C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:\\\C:\Users\Public\Documents\A9Q9P9\lee0923.hwp>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	130
Entropy (8bit):	4.933813966373562
Encrypted:	false
SSDEEP:	3:HRAbABGQYmHmRDaHF5hdCl+D10AqSVyyKTLwkPaHF5hdCl+D1Vvn:HRYFVmoaH9dClApVh0BPaH9dCGn
MD5:	A95FA9F0434DA0FE1747F3A9EAFD2445
SHA1:	05D283F953397C91C3D8C0365878D1B4BA0DF0FE
SHA-256:	B35102AFB23B03D3E9489B76A92855ED3AC7D72AE3F87D1AC5367FC40F1FD8D0
SHA-512:	62F232737B4C95F12B60B1176EC06A161AE8121CAF41D3281BA72061A8AF22FA476C28370F52584A2D9794A1228C024F6B48C5EEE19EE8B7CA03B95F5682DC92
Malicious:	false
Preview:	[InternetShortcut]..URL=file:\\\C:\Users\Public\Documents\A9Q9P9\lee0923.hwp..WorkingDirectory=C:\Users\Public\Documents\A9Q9P9\..

C:\Users\Public\Music\LI1L1K\DXGXG0.url

Download File

Process:	C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:\\\C:\Users\Public\Documents\A9Q9P9\TASLogin.exe>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	131
Entropy (8bit):	4.876320183147702
Encrypted:	false
SSDEEP:	3:HRAbABGQYmHmRDaHF5hdCl+D1MkOKPSxXjLwkPaHF5hdCl+D1Vvn:HRYFVmoaH9dCdkhSxTBPaH9dCGn
MD5:	83EF7F4389E982E161E52FE111E992B2
SHA1:	198BDCAA7B6BD89DF4A0F9AECCFCD08A8937C44B
SHA-256:	0146331AC469E8527473D768840FFD205BD751C11E98FA1C98F9CB81834B0222
SHA-512:	D161046CF16DC76308AAF342E7B221723A2C841C7711D5C0741772B5AFC2BCA132398021AA040D31D9E627BB909C4224525EA8BE3658795EBF01426DAC66900C
Malicious:	false
Preview:	[InternetShortcut]..URL=file:\\\C:\Users\Public\Documents\A9Q9P9\TASLogin.exe..WorkingDirectory=C:\Users\Public\Documents\A9Q9P9\..

C:\Users\Public\Music\LI1L1K\N6M6P6.url

Download File

Process:	C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:\\\C:\Users\Public\Documents\A9Q9P9\lee0923.hwp>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	130
Entropy (8bit):	4.933813966373562
Encrypted:	false
SSDEEP:	3:HRAbABGQYmHmRDaHF5hdCl+D10AqSVyyKTLwkPaHF5hdCl+D1Vvn:HRYFVmoaH9dClApVh0BPaH9dCGn
MD5:	A95FA9F0434DA0FE1747F3A9EAFD2445
SHA1:	05D283F953397C91C3D8C0365878D1B4BA0DF0FE
SHA-256:	B35102AFB23B03D3E9489B76A92855ED3AC7D72AE3F87D1AC5367FC40F1FD8D0
SHA-512:	62F232737B4C95F12B60B1176EC06A161AE8121CAF41D3281BA72061A8AF22FA476C28370F52584A2D9794A1228C024F6B48C5EEE19EE8B7CA03B95F5682DC92
Malicious:	false
Preview:	[InternetShortcut]..URL=file:\\\C:\Users\Public\Documents\A9Q9P9\lee0923.hwp..WorkingDirectory=C:\Users\Public\Documents\A9Q9P9\..

C:\Users\Public\Music\LI1L1K\QAT9TC.url

Download File

Process:	C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:\\\C:\Users\Public\Documents\A9Q9P9\TASLogin.exe>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	131
Entropy (8bit):	4.876320183147702
Encrypted:	false
SSDEEP:	3:HRAbABGQYmHmRDaHF5hdCl+D1MkOKPSxXjLwkPaHF5hdCl+D1Vvn:HRYFVmoaH9dCdkhSxTBPaH9dCGn
MD5:	83EF7F4389E982E161E52FE111E992B2
SHA1:	198BDCAA7B6BD89DF4A0F9AECCFCD08A8937C44B
SHA-256:	0146331AC469E8527473D768840FFD205BD751C11E98FA1C98F9CB81834B0222
SHA-512:	D161046CF16DC76308AAF342E7B221723A2C841C7711D5C0741772B5AFC2BCA132398021AA040D31D9E627BB909C4224525EA8BE3658795EBF01426DAC66900C
Malicious:	false
Preview:	[InternetShortcut]..URL=file:\\\C:\Users\Public\Documents\A9Q9P9\TASLogin.exe..WorkingDirectory=C:\Users\Public\Documents\A9Q9P9\..

C:\Users\Public\Music\LI1L1K\SBRBRB.url

Download File

Process:	C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:\\\C:\Users\Public\Documents\A9Q9P9\TASLogin.exe>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	131
Entropy (8bit):	4.876320183147702
Encrypted:	false
SSDEEP:	3:HRAbABGQYmHmRDaHF5hdCl+D1MkOKPSxXjLwkPaHF5hdCl+D1Vvn:HRYFVmoaH9dCdkhSxTBPaH9dCGn
MD5:	83EF7F4389E982E161E52FE111E992B2
SHA1:	198BDCAA7B6BD89DF4A0F9AECCFCD08A8937C44B
SHA-256:	0146331AC469E8527473D768840FFD205BD751C11E98FA1C98F9CB81834B0222
SHA-512:	D161046CF16DC76308AAF342E7B221723A2C841C7711D5C0741772B5AFC2BCA132398021AA040D31D9E627BB909C4224525EA8BE3658795EBF01426DAC66900C
Malicious:	false
Preview:	[InternetShortcut]..URL=file:\\\C:\Users\Public\Documents\A9Q9P9\TASLogin.exe..WorkingDirectory=C:\Users\Public\Documents\A9Q9P9\..

C:\Users\Public\Music\LI1L1K\T9SCSC.url

Download File

Process:	C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:\\\C:\Users\Public\Documents\A9Q9P9\lee0923.hwp>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	130
Entropy (8bit):	4.933813966373562
Encrypted:	false
SSDEEP:	3:HRAbABGQYmHmRDaHF5hdCl+D10AqSVyyKTLwkPaHF5hdCl+D1Vvn:HRYFVmoaH9dClApVh0BPaH9dCGn
MD5:	A95FA9F0434DA0FE1747F3A9EAFD2445
SHA1:	05D283F953397C91C3D8C0365878D1B4BA0DF0FE
SHA-256:	B35102AFB23B03D3E9489B76A92855ED3AC7D72AE3F87D1AC5367FC40F1FD8D0
SHA-512:	62F232737B4C95F12B60B1176EC06A161AE8121CAF41D3281BA72061A8AF22FA476C28370F52584A2D9794A1228C024F6B48C5EEE19EE8B7CA03B95F5682DC92
Malicious:	false
Preview:	[InternetShortcut]..URL=file:\\\C:\Users\Public\Documents\A9Q9P9\lee0923.hwp..WorkingDirectory=C:\Users\Public\Documents\A9Q9P9\..

C:\Users\Public\Music\LI1L1K\WS8SBS.url

Download File

Process:	C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:\\\C:\Users\Public\Documents\A9Q9P9\TASLogin.exe>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	131
Entropy (8bit):	4.876320183147702
Encrypted:	false
SSDEEP:	3:HRAbABGQYmHmRDaHF5hdCl+D1MkOKPSxXjLwkPaHF5hdCl+D1Vvn:HRYFVmoaH9dCdkhSxTBPaH9dCGn
MD5:	83EF7F4389E982E161E52FE111E992B2
SHA1:	198BDCAA7B6BD89DF4A0F9AECCFCD08A8937C44B
SHA-256:	0146331AC469E8527473D768840FFD205BD751C11E98FA1C98F9CB81834B0222
SHA-512:	D161046CF16DC76308AAF342E7B221723A2C841C7711D5C0741772B5AFC2BCA132398021AA040D31D9E627BB909C4224525EA8BE3658795EBF01426DAC66900C
Malicious:	false
Preview:	[InternetShortcut]..URL=file:\\\C:\Users\Public\Documents\A9Q9P9\TASLogin.exe..WorkingDirectory=C:\Users\Public\Documents\A9Q9P9\..

C:\Users\Public\Music\LI1L1K\WTCWCW.url

Download File

Process:	C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:\\\C:\Users\Public\Documents\A9Q9P9\TASLogin.exe>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	131
Entropy (8bit):	4.876320183147702
Encrypted:	false
SSDEEP:	3:HRAbABGQYmHmRDaHF5hdCl+D1MkOKPSxXjLwkPaHF5hdCl+D1Vvn:HRYFVmoaH9dCdkhSxTBPaH9dCGn
MD5:	83EF7F4389E982E161E52FE111E992B2
SHA1:	198BDCAA7B6BD89DF4A0F9AECCFCD08A8937C44B
SHA-256:	0146331AC469E8527473D768840FFD205BD751C11E98FA1C98F9CB81834B0222
SHA-512:	D161046CF16DC76308AAF342E7B221723A2C841C7711D5C0741772B5AFC2BCA132398021AA040D31D9E627BB909C4224525EA8BE3658795EBF01426DAC66900C
Malicious:	false
Preview:	[InternetShortcut]..URL=file:\\\C:\Users\Public\Documents\A9Q9P9\TASLogin.exe..WorkingDirectory=C:\Users\Public\Documents\A9Q9P9\..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.778961878652255
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe
File size:	57'700'088 bytes
MD5:	697d9c4f0800f93a19b89bf923d4135a
SHA1:	6d77a6b41de8d1f24bee70ea628029fe7784077f
SHA256:	8071c7b74e7ca2769f3746ec8cc007caee65474bb77808b7a84c84f877452605
SHA512:	a699819be46329980047f50b819b84ce585115871b2a8e41c61a8cd66dcf4739213e195d280e993716d6ba0b0f8b15954b77330e0e97acd57029624895faa145
SSDEEP:	49152:29oGEDr57pncZYCvtokiIs5pc+hhdtP6I7D2SGcCyEq9DRho/ctH01Ws74rA4RUS:29rgr5m2gtDiBHG5qFb0I+0PqkW6
TLSH:	53C77BE5EBB67553E861E63418F16778A567321BA370DD8630AC92398F857C04F8F08E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4...Z...Z...Z.6.....Z.6.....Z...[...Z..d'...Z..d7.4.Z..d4.S.Z..d&...Z..d"...Z.Rich..Z.........PE..L......f...................

File Icon


Icon Hash:	80829e9e9a9e8c91

Static PE Info

General

Entrypoint:	0x440cf2
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x66F00D2E [Sun Sep 22 12:27:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f77f649cebbc2879c7b68076eb63bc11

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	08/05/2024 01:00:00 09/05/2025 00:59:59
Subject Chain	CN=DAVINCI VISION LIMITED, O=DAVINCI VISION LIMITED, S=\u9999\u6e2f\u7279\u522b\u884c\u653f\u533a, C=CN, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Hong Kong SAR, OID.1.3.6.1.4.1.311.60.2.1.3=CN, SERIALNUMBER=73087152
Version:	3
Thumbprint MD5:	1545B69C7993DB703C90CD929857CB8B
Thumbprint SHA-1:	81458929D258DB62735B3A6D56577FED725C2A02
Thumbprint SHA-256:	1F8381B50B8366D3BD0DF428CA6DCDFA69C26116B81A58CA43A1464EDFA6F5FE
Serial:	00FEF386AC9C1D8636CB370C8C247F44FA

Entrypoint Preview

Instruction
call 00007F33C06301B3h
jmp 00007F33C06271CBh
push 00000000h
push dword ptr [esp+14h]
push dword ptr [esp+14h]
push dword ptr [esp+14h]
push dword ptr [esp+14h]
call 00007F33C063022Bh
add esp, 14h
ret
mov eax, dword ptr [esp+04h]
xor ecx, ecx
cmp eax, dword ptr [00474EE8h+ecx*8]
je 00007F33C06273C4h
inc ecx
cmp ecx, 2Dh
jl 00007F33C06273A3h
lea ecx, dword ptr [eax-13h]
cmp ecx, 11h
jnbe 00007F33C06273BEh
push 0000000Dh
pop eax
ret
mov eax, dword ptr [00474EECh+ecx*8]
ret
add eax, FFFFFF44h
push 0000000Eh
pop ecx
cmp ecx, eax
sbb eax, eax
and eax, ecx
add eax, 08h
ret
call 00007F33C0629888h
test eax, eax
jne 00007F33C06273B8h
mov eax, 00475050h
ret
add eax, 08h
ret
call 00007F33C0629875h
test eax, eax
jne 00007F33C06273B8h
mov eax, 00475054h
ret
add eax, 0Ch
ret
push esi
call 00007F33C062739Ch
mov ecx, dword ptr [esp+08h]
push ecx
mov dword ptr [eax], ecx
call 00007F33C0627342h
pop ecx
mov esi, eax
call 00007F33C0627375h
mov dword ptr [eax], esi
pop esi
ret
call 00007F33C062917Ch
push dword ptr [esp+04h]
call 00007F33C0628FD3h
push dword ptr [00475058h]
call 00007F33C06296A9h
push 000000FFh
call eax
add esp, 0Ch

Rich Headers

Programming Language:

[ASM] VS2005 build 50727
[ C ] VS2005 build 50727
[C++] VS2005 build 50727
[RES] VS2005 build 50727
[LNK] VS2005 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x722b4	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7b000	0x368ac84	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x3702000	0x4ef8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x66458	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x60000	0x42c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x7222c	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5e1a4	0x5f000	b92461ad663671071019fb20093c4505	False	0.4565403988486842	data	6.476084791222863	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x60000	0x13902	0x14000	4ef4a007f5ead19f60aa4494ae216eac	False	0.35657958984375	data	4.689943254518714	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x74000	0x6264	0x3000	946ebd3e93aff950f8bacd1eee5afbfb	False	0.23575846354166666	data	3.2699659458180044	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7b000	0x368ac84	0x368b000	bf9991bfec032c13dd4873dedbe72114	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
ZIP	0x7bf04	0x1fcf43	Zip archive data, at least v2.0 to extract, compression method=deflate	Chinese	China	0.99932861328125
RT_CURSOR	0x278e48	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	Chinese	China	0.4805194805194805
RT_CURSOR	0x278f7c	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	Chinese	China	0.7
RT_CURSOR	0x279030	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.36363636363636365
RT_CURSOR	0x279164	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.35714285714285715
RT_CURSOR	0x279298	0x134	data	Chinese	China	0.37337662337662336
RT_CURSOR	0x2793cc	0x134	data	Chinese	China	0.37662337662337664
RT_CURSOR	0x279500	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x279634	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.37662337662337664
RT_CURSOR	0x279768	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x27989c	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.38636363636363635
RT_CURSOR	0x2799d0	0x134	data	Chinese	China	0.44155844155844154
RT_CURSOR	0x279b04	0x134	data	Chinese	China	0.4155844155844156
RT_CURSOR	0x279c38	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.5422077922077922
RT_CURSOR	0x279d6c	0x134	data	Chinese	China	0.2662337662337662
RT_CURSOR	0x279ea0	0x134	data	Chinese	China	0.2824675324675325
RT_CURSOR	0x279fd4	0x134	data	Chinese	China	0.3246753246753247
RT_BITMAP	0x27a108	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	Chinese	China	0.44565217391304346
RT_BITMAP	0x27a1c0	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.37962962962962965
RT_ICON	0x27a304	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors			0.180956678700361
RT_ICON	0x27abac	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors			0.18280346820809248
RT_ICON	0x27b114	0xdac	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.8914285714285715
RT_ICON	0x27bec0	0xdac	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.8914285714285715
RT_ICON	0x27cc6c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.06887966804979254
RT_ICON	0x27f214	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.11092870544090057
RT_ICON	0x2802bc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.20656028368794327
RT_DIALOG	0x280724	0xcc	data	Chinese	China	0.7107843137254902
RT_DIALOG	0x2807f0	0xe2	data	Chinese	China	0.6637168141592921
RT_DIALOG	0x2808d4	0x34	data	Chinese	China	0.9038461538461539
RT_STRING	0x280908	0x54	data	Chinese	China	0.8571428571428571
RT_STRING	0x28095c	0x2c	data	Chinese	China	0.5909090909090909
RT_STRING	0x280988	0x82	data	Chinese	China	0.8769230769230769
RT_STRING	0x280a0c	0x1d0	data	Chinese	China	0.8060344827586207
RT_STRING	0x280bdc	0x164	data	Chinese	China	0.48314606741573035
RT_STRING	0x280d40	0x132	data	Chinese	China	0.6405228758169934
RT_STRING	0x280e74	0x50	data	Chinese	China	0.725
RT_STRING	0x280ec4	0x40	data	Chinese	China	0.65625
RT_STRING	0x280f04	0x6a	data	Chinese	China	0.7452830188679245
RT_STRING	0x280f70	0x1d6	data	Chinese	China	0.6723404255319149
RT_STRING	0x281148	0x110	data	Chinese	China	0.625
RT_STRING	0x281258	0x24	data	Chinese	China	0.4444444444444444
RT_STRING	0x28127c	0x30	data	Chinese	China	0.625
RT_RCDATA	0x2812ac	0x335c318	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=8, orientation=upper-left, xresolution=110, yresolution=118, resolutionunit=2, software=ACDSee Pro 6, datetime=2023:10:27 16:07:55], baseline, precision 8, 55x67, components 3			0.012384414672851562
RT_RCDATA	0x35dd5c4	0x80	MSVC .res	Chinese	China	0.640625
RT_RCDATA	0x35dd644	0x122bd8	MSVC .res	Chinese	China	1.0003061294555664
RT_GROUP_CURSOR	0x370021c	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	0.9705882352941176
RT_GROUP_CURSOR	0x3700240	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x3700254	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x3700268	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x370027c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x3700290	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x37002a4	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x37002b8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x37002cc	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x37002e0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x37002f4	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x3700308	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x370031c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x3700330	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x3700344	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_ICON	0x3700358	0x5a	data			0.7333333333333333
RT_HTML	0x37003b4	0x2b6	ASCII text	Chinese	China	0.4755043227665706
RT_HTML	0x370066c	0x216	ASCII text	Chinese	China	0.4700374531835206
RT_HTML	0x3700884	0x8f0	HTML document, Unicode text, UTF-8 text	Chinese	China	0.4785839160839161
RT_HTML	0x3701174	0x973	HTML document, Unicode text, UTF-8 (with BOM) text	Chinese	China	0.4803637866887143
RT_HTML	0x3701ae8	0x7f4	HTML document, Unicode text, UTF-8 text	Chinese	China	0.4764243614931238
RT_HTML	0x37022dc	0x859	HTML document, Unicode text, UTF-8 (with BOM) text	Chinese	China	0.48713149274684137
RT_HTML	0x3702b38	0x7e6	HTML document, Unicode text, UTF-8 text	Chinese	China	0.46439169139465875
RT_HTML	0x3703320	0x815	HTML document, Unicode text, UTF-8 text	Chinese	China	0.471725471242146
RT_HTML	0x3703b38	0x9bc	HTML document, Unicode text, UTF-8 (with BOM) text	Chinese	China	0.47752808988764045
RT_HTML	0x37044f4	0x7b7	HTML document, ASCII text	Chinese	China	0.4450632911392405
RT_HTML	0x3704cac	0x792	HTML document, ASCII text	Chinese	China	0.45562435500515996
RT_HTML	0x3705440	0x7ec	HTML document, Unicode text, UTF-8 text	Chinese	China	0.4723865877712032
RT_MANIFEST	0x3705c2c	0x56	ASCII text, with CRLF line terminators	English	United States	1.0232558139534884

Imports

DLL	Import
KERNEL32.dll	GetCurrentProcess, GetCPInfo, GetOEMCP, SetErrorMode, GetFileAttributesA, HeapAlloc, HeapFree, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapReAlloc, RaiseException, VirtualAlloc, RtlUnwind, GetCommandLineA, GetProcessHeap, GetStartupInfoA, ExitProcess, HeapSize, SetEndOfFile, VirtualFree, HeapDestroy, HeapCreate, GetStdHandle, SetHandleCount, GetFileType, GetConsoleCP, GetConsoleMode, GetACP, LCMapStringA, LCMapStringW, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetSystemTimeAsFileTime, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetStdHandle, GetStringTypeA, GetStringTypeW, GetUserDefaultLCID, EnumSystemLocalesA, IsValidLocale, IsValidCodePage, GetLocaleInfoW, FlushFileBuffers, SetFilePointer, ReadFile, GlobalFlags, WritePrivateProfileStringA, InterlockedIncrement, TlsFree, DeleteCriticalSection, LocalReAlloc, TlsSetValue, TlsAlloc, InitializeCriticalSection, GlobalHandle, GlobalReAlloc, EnterCriticalSection, TlsGetValue, LeaveCriticalSection, LocalAlloc, FreeResource, GlobalGetAtomNameA, GlobalFindAtomA, lstrcmpW, GetVersionExA, InterlockedDecrement, GetModuleFileNameW, GetCurrentProcessId, GlobalAddAtomA, GetCurrentThread, GetCurrentThreadId, ConvertDefaultLocale, GetModuleFileNameA, EnumResourceLanguagesA, GetLocaleInfoA, lstrcmpA, GlobalDeleteAtom, GetModuleHandleA, GlobalFree, GlobalAlloc, GlobalLock, GlobalUnlock, FormatMessageA, LocalFree, MulDiv, SetLastError, lstrcpyA, Sleep, GetThreadLocale, FreeLibrary, GetProcAddress, LoadLibraryA, GetTickCount, WriteFile, SetFileTime, LocalFileTimeToFileTime, CreateDirectoryA, CloseHandle, CreateFileA, SystemTimeToFileTime, lstrlenA, CreateFileW, CompareStringA, GetVersion, FindResourceA, LoadResource, LockResource, SizeofResource, GetLastError, WideCharToMultiByte, MultiByteToWideChar, InterlockedExchange
USER32.dll	GetClassNameA, SetPropA, GetPropA, RemovePropA, IsWindow, SetFocus, GetWindowTextA, GetForegroundWindow, SetActiveWindow, GetDlgItem, GetTopWindow, DestroyWindow, GetMessagePos, MapWindowPoints, SetForegroundWindow, UpdateWindow, GetMenu, CreateWindowExA, GetClassInfoExA, GetClassInfoA, RegisterClassA, GetSysColor, AdjustWindowRectEx, CopyRect, PtInRect, GetDlgCtrlID, DefWindowProcA, SetWindowLongA, SetWindowPos, SystemParametersInfoA, GetWindowPlacement, GetWindowRect, GetWindow, UnhookWindowsHookEx, GetWindowThreadProcessId, GetWindowLongA, GetLastActivePopup, IsWindowEnabled, MessageBoxA, SetCursor, SetWindowsHookExA, CallNextHookEx, GetMessageA, TranslateMessage, DispatchMessageA, GetActiveWindow, IsWindowVisible, GetKeyState, PeekMessageA, GetCursorPos, ValidateRect, SetMenuItemBitmaps, GetMenuCheckMarkDimensions, LoadBitmapA, GetFocus, GetParent, ModifyMenuA, EnableMenuItem, CheckMenuItem, PostMessageA, PostQuitMessage, GetMenuState, GetMenuItemID, GetMenuItemCount, GetSubMenu, LoadCursorA, GetSysColorBrush, GetSystemMetrics, EnableWindow, LoadIconA, GetClientRect, IsIconic, SendMessageA, DrawIcon, wsprintfA, GetDesktopWindow, DestroyMenu, UnregisterClassA, CallWindowProcA, EndPaint, BeginPaint, ReleaseDC, GetDC, ClientToScreen, GrayStringA, DrawTextExA, DrawTextA, TabbedTextOutA, ShowWindow, SetWindowTextA, IsDialogMessageA, CreateDialogIndirectParamA, GetNextDlgTabItem, EndDialog, RegisterWindowMessageA, SendDlgItemMessageA, WinHelpA, GetCapture, GetClassLongA, GetMessageTime
GDI32.dll	SetMapMode, DeleteObject, PtVisible, RectVisible, TextOutA, ExtTextOutA, Escape, SelectObject, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowExtEx, ScaleWindowExtEx, DeleteDC, GetStockObject, RestoreDC, SaveDC, GetObjectA, SetBkColor, SetTextColor, GetClipBox, CreateBitmap, GetDeviceCaps
WINSPOOL.DRV	ClosePrinter, DocumentPropertiesA, OpenPrinterA
ADVAPI32.dll	RegSetValueExA, RegCreateKeyExA, RegQueryValueA, RegEnumKeyA, RegDeleteKeyA, RegOpenKeyExA, RegQueryValueExA, RegOpenKeyA, RegCloseKey
SHLWAPI.dll	PathFindFileNameA, PathFindExtensionA
OLEAUT32.dll	VariantInit, VariantChangeType, VariantClear

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T09:05:22.603593+0100	2016922	ET MALWARE Backdoor family PCRat/Gh0st CnC traffic	1	192.168.2.4	49740	137.220.137.85	24818	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 09:05:22.158482075 CET	49740	24818	192.168.2.4	137.220.137.85
Oct 28, 2024 09:05:22.163866997 CET	24818	49740	137.220.137.85	192.168.2.4
Oct 28, 2024 09:05:22.163953066 CET	49740	24818	192.168.2.4	137.220.137.85
Oct 28, 2024 09:05:22.603593111 CET	49740	24818	192.168.2.4	137.220.137.85
Oct 28, 2024 09:05:22.610053062 CET	24818	49740	137.220.137.85	192.168.2.4
Oct 28, 2024 09:05:23.049129963 CET	24818	49740	137.220.137.85	192.168.2.4
Oct 28, 2024 09:05:23.095026016 CET	49740	24818	192.168.2.4	137.220.137.85
Oct 28, 2024 09:06:23.048217058 CET	49740	24818	192.168.2.4	137.220.137.85
Oct 28, 2024 09:06:23.053555012 CET	24818	49740	137.220.137.85	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 09:05:22.119610071 CET	55245	53	192.168.2.4	1.1.1.1
Oct 28, 2024 09:05:22.154263020 CET	53	55245	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 09:05:22.119610071 CET	192.168.2.4	1.1.1.1	0x33fe	Standard query (0)	24818.windows-updata.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 09:05:22.154263020 CET	1.1.1.1	192.168.2.4	0x33fe	No error (0)	24818.windows-updata.com		137.220.137.85	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	04:05:03
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe"
Imagebase:	0x400000
File size:	57'700'088 bytes
MD5 hash:	697D9C4F0800F93A19B89BF923D4135A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:05:08
Start date:	28/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe C:\Users\Public\Music\LI1L1K
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:05:08
Start date:	28/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	04:05:09
Start date:	28/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff6bd680000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:05:16
Start date:	28/10/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff612240000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:05:20
Start date:	28/10/2024
Path:	C:\Users\Public\Documents\A9Q9P9\TASLogin.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Documents\A9Q9P9\TASLogin.exe"
Imagebase:	0x7ff71e800000
File size:	581'584 bytes
MD5 hash:	E6A3CACCBD9CA82F38A14BD0D4428240
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:05:21
Start date:	28/10/2024
Path:	C:\Users\Public\Documents\A9Q9P9\TASLogin.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Documents\A9Q9P9\TASLogin.exe
Imagebase:	0x400000
File size:	581'584 bytes
MD5 hash:	E6A3CACCBD9CA82F38A14BD0D4428240
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	04:05:30
Start date:	28/10/2024
Path:	C:\Users\Public\Documents\A9Q9P9\TASLogin.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Documents\A9Q9P9\TASLogin.exe"
Imagebase:	0x400000
File size:	581'584 bytes
MD5 hash:	E6A3CACCBD9CA82F38A14BD0D4428240
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	04:05:31
Start date:	28/10/2024
Path:	C:\Users\Public\Documents\A9Q9P9\TASLogin.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Documents\A9Q9P9\TASLogin.exe
Imagebase:	0x400000
File size:	581'584 bytes
MD5 hash:	E6A3CACCBD9CA82F38A14BD0D4428240
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:05:38
Start date:	28/10/2024
Path:	C:\Users\Public\Documents\A9Q9P9\TASLogin.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Documents\A9Q9P9\TASLogin.exe"
Imagebase:	0x400000
File size:	581'584 bytes
MD5 hash:	E6A3CACCBD9CA82F38A14BD0D4428240
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:05:39
Start date:	28/10/2024
Path:	C:\Users\Public\Documents\A9Q9P9\TASLogin.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Documents\A9Q9P9\TASLogin.exe
Imagebase:	0x400000
File size:	581'584 bytes
MD5 hash:	E6A3CACCBD9CA82F38A14BD0D4428240
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	34

Executed Functions

Function 0040AEE0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 328
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

F, xrefs: 0040B0FB
0.0.0.0, xrefs: 0040B1C5

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID:
String ID: 0.0.0.0$F
API String ID: 0-452060436
Opcode ID: 2a6c131034388f8d9889459684d51d086998981654a91101e349bcbbc586d5cc
Instruction ID: 7c67fad2cec015ab4b7a5546781026ce6c847b665e773b684073d7118db0c2e7
Opcode Fuzzy Hash: 2a6c131034388f8d9889459684d51d086998981654a91101e349bcbbc586d5cc
Instruction Fuzzy Hash: A4B1046114E3C15FD7139B7498A169ABFB0EE17214B1E00E7D4C0EF1E3D66C195AC3AA

Function 0043B588 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 280COMMON

Download Yara Rule

APIs

Part of subcall function 00427BF0: RegOpenKeyW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,?,?,00486680,?), ref: 00427C1A

GetUserNameW.ADVAPI32(?,00000200), ref: 0043B72B

Part of subcall function 0040B0EC: VirtualAlloc.KERNEL32(00000000,00001400,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B123
Part of subcall function 0040B0EC: GetAdaptersInfo.IPHLPAPI(00000000,00001400,00000000,0040B211,?,00000000,00001400,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000), ref: 0040B152
Part of subcall function 0040B0EC: lstrlenW.KERNEL32(00000000,?,?,00000000,00001400,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0040B1DF
Part of subcall function 0040B0EC: VirtualFree.KERNEL32(00000000,00000000,00008000,0040B218,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B20B

Part of subcall function 0040ACA4: lstrlenW.KERNEL32(00000000,?,?,00486730,?), ref: 0040ACDD

Part of subcall function 0043C2AC: GlobalMemoryStatusEx.KERNEL32 ref: 0043C2B7

Part of subcall function 0043C2D4: RegOpenKeyW.ADVAPI32(80000002,HARDWARE\DESCRIPTION\System\CentralProcessor,?,00000000,0043C469,?,00000002,00486680), ref: 0043C318
Part of subcall function 0043C2D4: RegEnumKeyW.ADVAPI32(?,?,?,00000040,00000000,0043C447,?,?,00000002,00486680), ref: 0043C351
Part of subcall function 0043C2D4: RegOpenKeyW.ADVAPI32(80000002,00000000,0000003A,?,?,00000002,00486680), ref: 0043C390
Part of subcall function 0043C2D4: RegQueryValueExW.KERNEL32(0000003A,~MHz,00000000,00000000,?,00000040,00000000,0043C425,?,?,?,00000002,00486680), ref: 0043C3C4

Part of subcall function 0043C658: InternetGetConnectedState.WININET(?,00000000,?,00486680,0043B873,0043BA34,00A4294C,0043BA34,00A4292C,0043BA34,?,0043BA34,?,0043BA34, MB,?), ref: 0043C66A

Part of subcall function 0043B35C: GetForegroundWindow.USER32(?,000003FF,00486680,0043B8B9,0043BA34,?,00000000,00000000), ref: 0043B36F
Part of subcall function 0043B35C: GetWindowTextW.USER32(00000000,?,000003FF), ref: 0043B375

Strings

MB, xrefs: 0043B822
@gH, xrefs: 0043B622
C:\, xrefs: 0043B6C6
@gH, xrefs: 0043B657

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Open$VirtualWindowlstrlen$AdaptersAllocConnectedEnumForegroundFreeGlobalInfoInternetMemoryNameQueryStateStatusTextUserValue
String ID: MB$@gH$@gH$C:\
API String ID: 3434385230-2973181092
Opcode ID: 4f48c9de3cda0115ec832ecf11d9d9feee6ff355f540fe7681a8a34cc361780f
Instruction ID: 7cb58423bf7c1c3c0e2f814128eb90f27155dc95f18c3384b941ec3d68523260
Opcode Fuzzy Hash: 4f48c9de3cda0115ec832ecf11d9d9feee6ff355f540fe7681a8a34cc361780f
Instruction Fuzzy Hash: 51B15271A002189FCB11EB65CC42BDE77B5EF88308F5050BBB608B6192DB789E549F9D

Function 0040B0EC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114memorystringCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001400,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B123
GetAdaptersInfo.IPHLPAPI(00000000,00001400,00000000,0040B211,?,00000000,00001400,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000), ref: 0040B152
lstrlenW.KERNEL32(00000000,?,?,00000000,00001400,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0040B1DF
VirtualFree.KERNEL32(00000000,00000000,00008000,0040B218,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B20B

Strings

0.0.0.0, xrefs: 0040B1C5

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Virtual$AdaptersAllocFreeInfolstrlen
String ID: 0.0.0.0
API String ID: 918083892-3771769585
Opcode ID: 46efe75c8fefb3497d33d61d65303aa8220a8ebf35c6b56fbaafddf4be0a787a
Instruction ID: d9e483307b11907a1b336cc8d58400cd9b3fb6a4ef8d040ba9d6bd8e813edc8e
Opcode Fuzzy Hash: 46efe75c8fefb3497d33d61d65303aa8220a8ebf35c6b56fbaafddf4be0a787a
Instruction Fuzzy Hash: DC419270A40209AFEB01EB95CC92B9E77B8EB48304F5044BAF101F72D1D778AE14DB99

Function 0040B0EA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79memorystringCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001400,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B123
GetAdaptersInfo.IPHLPAPI(00000000,00001400,00000000,0040B211,?,00000000,00001400,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000), ref: 0040B152
lstrlenW.KERNEL32(00000000,?,?,00000000,00001400,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0040B1DF
VirtualFree.KERNEL32(00000000,00000000,00008000,0040B218,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B20B

Strings

0.0.0.0, xrefs: 0040B1C5

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Virtual$AdaptersAllocFreeInfolstrlen
String ID: 0.0.0.0
API String ID: 918083892-3771769585
Opcode ID: 48b6070fba64015d418916281c6685b59ad927041b6f855332d054a9411848ba
Instruction ID: 345194b246f3f78a7eeabf9d29f519d3052a89449da55eb1e22a777874124a90
Opcode Fuzzy Hash: 48b6070fba64015d418916281c6685b59ad927041b6f855332d054a9411848ba
Instruction Fuzzy Hash: 26217C70640204AFEB11EBA9CCA6BAE77A8EB49304F1044BAF500F73D1D778AD50C69D

Function 00427EE0 Relevance: 6.1, APIs: 4, Instructions: 82stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32(00000202,?,00000000,00428009), ref: 00427F25
QueryDosDeviceW.KERNEL32(00000000,?,?,00000072,00000202,?,00000000,00428009), ref: 00427F7B
lstrlenW.KERNEL32(?,00000000,?,?,00000072,00000202,?,00000000,00428009), ref: 00427F87
StrCmpNIW.SHLWAPI(?,?,00000000,?,00000000,?,?,00000072,00000202,?,00000000,00428009), ref: 00427F97

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: DeviceDriveLogicalQueryStringslstrlen
String ID:
API String ID: 243930641-0
Opcode ID: a7e4fb706dae23cce2e3905365d5b76be73495882ece122b121f7eb275b18a5a
Instruction ID: c93e83704bf87b4d3c7b7635578ed03522896ac4e1c9abb0733d05025df9e800
Opcode Fuzzy Hash: a7e4fb706dae23cce2e3905365d5b76be73495882ece122b121f7eb275b18a5a
Instruction Fuzzy Hash: 51318775A052189FDB60EB25DC49A9E73B8EB48300F5185FBF409E3251EE38DE548F58

Function 0042B0E8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,00000000), ref: 0042B125

Strings

L', xrefs: 0042B166
HfH, xrefs: 0042B1E5

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: recv
String ID: HfH$L'
API String ID: 1507349165-3701047491
Opcode ID: 0272ce9c849f8c6d811af1e5df7b7681194580765fc890da592de9060105d8cb
Instruction ID: 49d7582d12393c64e2f5e9e79eb284682d70d8ba065f8d5d5eb48f77bec2bdeb
Opcode Fuzzy Hash: 0272ce9c849f8c6d811af1e5df7b7681194580765fc890da592de9060105d8cb
Instruction Fuzzy Hash: D5513E34700624DFC710DF99E884A6E73E4EF49354FA080AAF958D7361C738AD45DBA9

Function 004087CC Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,0040888C,?,?), ref: 004087FE
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,0040888C,?,?), ref: 00408807

Part of subcall function 00408694: FindFirstFileW.KERNEL32(00000000,?,00000000,004086F2,?,00000001), ref: 004086C7
Part of subcall function 00408694: FindClose.KERNEL32(00000000,00000000,?,00000000,004086F2,?,00000001), ref: 004086D7

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: b74bd6e88f2ca2989f644b2d03fbc3aabc39af979b7b3b976e283b47028c6e25
Instruction ID: 27674f643491317e8211ebe2d51140b4d1dfb9d7c3ccf30eb47042a46c7f6e4d
Opcode Fuzzy Hash: b74bd6e88f2ca2989f644b2d03fbc3aabc39af979b7b3b976e283b47028c6e25
Instruction Fuzzy Hash: 67116070A001099FDB04FBA6D982AAEB3B8EF44304F51847FF945B32C1DB785E148A69

Function 0043BC08 Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,?,00486734,00486680), ref: 0043BC22
AdjustTokenPrivileges.KERNELBASE(?,00000000,00000001,00000000,00000000,?), ref: 0043BC44

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 3615134276-0
Opcode ID: b46e0a6c81155ca4765af0d3e3cb63a2714ab48b711c5c54f844778fbb357d1b
Instruction ID: a9ba86f5f9e92247e91d8cbb9874f1db19a78722b72bb73f6d4517b978c5305e
Opcode Fuzzy Hash: b46e0a6c81155ca4765af0d3e3cb63a2714ab48b711c5c54f844778fbb357d1b
Instruction Fuzzy Hash: 6EF01272650118AFE700DB98DC81FBF73ECE749714F100165F914E7290DAB16E0487A5

Function 00408694 Relevance: 3.0, APIs: 2, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,004086F2,?,00000001), ref: 004086C7
FindClose.KERNEL32(00000000,00000000,?,00000000,004086F2,?,00000001), ref: 004086D7

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: d5e053f3a7f238d708fda4e07e630be6dcb5cbe159ac088ae637e70b0fe2281d
Instruction ID: 4a504121526f8a262ed7674ff1de7294a9ef20f3b8a82b9cde2a0df277819a23
Opcode Fuzzy Hash: d5e053f3a7f238d708fda4e07e630be6dcb5cbe159ac088ae637e70b0fe2281d
Instruction Fuzzy Hash: 39F0E271500308AFC710FBB5CE1298EB7ECEB48314BA248BBB404F26C2EA3D9E10951C

Function 00408F10 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00408F14

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 229177a228d713a9a14fcff98108d9cc5e97c52a54c35a4239ee1928f04f60af
Instruction ID: 2d2288808e5448b03cee85edb9978ee3a4aa03205f7dde6b98229f7bffd1799a
Opcode Fuzzy Hash: 229177a228d713a9a14fcff98108d9cc5e97c52a54c35a4239ee1928f04f60af
Instruction Fuzzy Hash: CCA012104085020BC908E7294D4340F31801940118FC402247C5CA96C2E62D856442DB

Function 0040BDE8 Relevance: 220.0, APIs: 8, Strings: 117, Instructions: 1214
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(00000000,00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000,?,0043F7AA,00000000,0043FD8B,?,?,00486664), ref: 0040C220
LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000,?,0043F7AA,00000000,0043FD8B), ref: 0040C26E
LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000,?,0043F7AA,00000000,0043FD8B), ref: 0040CC32
LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000,?,0043F7AA,00000000,0043FD8B), ref: 0040CE58
LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000,?,0043F7AA,00000000), ref: 0040CEA6
LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000,?,0043F7AA), ref: 0040D030
LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000), ref: 0040D0CC
LoadLibraryW.KERNEL32(00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000,?,0043F7AA,00000000,0043FD8B,?,?,00486664,00000000), ref: 0040BE1D

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,00000000), ref: 0040A4F2

Strings

Nl}Hmhy}l{z@gof, xrefs: 0040CE69
[lnFylgBlp^, xrefs: 0040CCE3
~`g`gl}'MEE, xrefs: 0040CE90
A}}yX|l{p@gof^, xrefs: 0040CF30
Nl}Je`ykfh{mMh}h, xrefs: 0040C147
Oehza^`gmf~, xrefs: 0040BE92
JefzlJe`ykfh{m, xrefs: 0040C168
Lg|d^`gmf~z, xrefs: 0040C060
^h`}Of{Z`gnelFkclj}, xrefs: 0040C8E9
zae~hy`'MEE, xrefs: 0040D01A
YllbGhdlmY`yl, xrefs: 0040C763
Dhy_`{}|heBlp^, xrefs: 0040C01E
Nl}Y{fjlzz]`dlz, xrefs: 0040C826
NefkheDldf{pZ}h}|z, xrefs: 0040C6A0
bl{gle:;'MEE, xrefs: 0040C258
|zl{:;'MEE, xrefs: 0040BE0A
Nl}Dlzzhnl^, xrefs: 0040BF58
[lelhzlMJ, xrefs: 0040C189
@g}l{gl}Fylg^, xrefs: 0040CEE2
@g}l{gl}Nl}Jffb`l^, xrefs: 0040CFCC
Efjb[lzf|{jl, xrefs: 0040CA96
ZANl}Yh}aO{fd@ME`z}^, xrefs: 0040D12B
Fylg@gy|}Mlzb}fy, xrefs: 0040C081
@g}l{gl}Fylg\{e^, xrefs: 0040CF09
[lhmY{fjlzzDldf{p, xrefs: 0040C31F
JfypO`el^, xrefs: 0040C58F
[lnLg|dBlp^, xrefs: 0040CD31
Zl}J|{zf{Yfz, xrefs: 0040BFBB
ZaleeLqlj|}l^, xrefs: 0040D0DD
O`gmO`{z}O`el^, xrefs: 0040CB59
Nl}HzpgjBlpZ}h}l, xrefs: 0040C1CB
J{lh}lO`el^, xrefs: 0040C3E2
[lelhzlD|}lq, xrefs: 0040C9AC
[lnZl}_he|lLq^, xrefs: 0040CDA6
Lq`}^`gmf~zLq, xrefs: 0040C03F
J{lh}lY`yl, xrefs: 0040C73C
Nl}Dfm|elO`elGhdl^, xrefs: 0040C78A
O`el]`dl]fEfjheO`el]`dl, xrefs: 0040C874
Yh}aO`elLq`z}z^, xrefs: 0040D041
@g}l{gl}Zl}Jffb`l^, xrefs: 0040CFA5
O`gmGlq}O`el^, xrefs: 0040CB80
Nl}Zpz}ldDl}{`jz, xrefs: 0040C1AA
O`gm^`gmf~Lq^, xrefs: 0040BED4
Nl}^`gmf~]a{lhmY{fjlzz@m, xrefs: 0040C0E4
^{`}lO`el, xrefs: 0040C457
@g}l{gl}Zl}Fy}`fg^, xrefs: 0040CFF3
Nl}BlpZ}h}l, xrefs: 0040C1EC
Nl}]`jbJf|g}, xrefs: 0040C3BB
[lnMlel}lBlp^, xrefs: 0040CDF4
ez}{jyp^, xrefs: 0040CBF5
@g}l{gl}Nl}Jfgglj}lmZ}h}l, xrefs: 0040CEBB
Nl}JehzzGhdl^, xrefs: 0040BE2F
\[EDFG'MEE, xrefs: 0040C20D
O`gm[lzf|{jl^, xrefs: 0040CA48
Z}{JdyG@^, xrefs: 0040D068
Zl}L{{f{Dfml, xrefs: 0040CB0B
Nl}J|{{lg}Y{fjlzz@m, xrefs: 0040C7B1
^{`}lY{fjlzzDldf{p, xrefs: 0040C346
Jefzl^`gmf~, xrefs: 0040BE50
O`gmJefzl, xrefs: 0040CBA7
_`{}|heHeefjLq, xrefs: 0040C2D1
]l{d`gh}lY{fjlzz, xrefs: 0040C652
[lnJ{lh}lBlp^, xrefs: 0040CDCD
Nl}EfgnYh}aGhdl^, xrefs: 0040C715
Lq`}Y{fjlzz, xrefs: 0040C9D3
FylgD|}lq^, xrefs: 0040C985
O`gm^`gmf~^, xrefs: 0040BEB3
Nl}_fe|dl@gof{dh}`fg^, xrefs: 0040C937
\[EMf~gefhm]fO`el^, xrefs: 0040C231
Efhm[lzf|{jl, xrefs: 0040CA6F
Nl}O`elZ`sl, xrefs: 0040C430
Nl}_l{z`fgLq^, xrefs: 0040C6C7
Dhy_`l~FoO`el, xrefs: 0040C4F3
[lhmO`el, xrefs: 0040C47E
J{lh}lD|}lq^, xrefs: 0040C95E
ZANl}Zylj`heOfeml{Efjh}`fg, xrefs: 0040D104
^`gLqlj, xrefs: 0040CA21
J{lh}l]a{lhm, xrefs: 0040C9FA
Nl}Jfdy|}l{Ghdl^, xrefs: 0040CBCE
FylgY{fjlzz]fblg, xrefs: 0040CC6E
Zl}]a{lhmJfg}lq}, xrefs: 0040C36D
Yh}a@zM`{lj}f{p^, xrefs: 0040D08F
Nl}\zl{Ghdl^, xrefs: 0040CC47
J{lh}lO`elDhyy`gn^, xrefs: 0040C4CC
Kefjb@gy|}, xrefs: 0040BEF5
FylgY{fjlzz, xrefs: 0040C283
O`el]`dl]fZpz}ld]`dl, xrefs: 0040C84D
[lnJefzlBlp, xrefs: 0040CD0A
FylgJe`ykfh{m, xrefs: 0040C126
zalee:;'MEE, xrefs: 0040D0B6
J{lh}lY{fjlzz^, xrefs: 0040C2AA
JefzlAhgmel, xrefs: 0040C4A5
Nl}M`zbO{llZyhjlLq^, xrefs: 0040CB32
[lz|dl]a{lhm, xrefs: 0040C394
Zpz}ldYh{hdl}l{z@gof^, xrefs: 0040BF37
]{hgzeh}lDlzzhnl, xrefs: 0040BF79
Zl}Zpz}ldJ|{zf{, xrefs: 0040BF16
[lnLg|d_he|l^, xrefs: 0040CD58
Zl}O`elYf`g}l{, xrefs: 0040C409
Nl}Zpz}ld]`dlHzO`el]`dl, xrefs: 0040C7FF
O{ll[lzf|{jl, xrefs: 0040CABD
@g}l{gl}JefzlAhgmel, xrefs: 0040CF7E
@yAeyHy`'MEE, xrefs: 0040CE42
Nl}Mlzb}fy^`gmf~, xrefs: 0040C105
Zl}O`elH}}{`k|}lz^, xrefs: 0040C910
\gdhy_`l~FoO`el, xrefs: 0040C51A
[lnX|l{p_he|lLq^, xrefs: 0040CD7F
Zl}]a{lhmMlzb}fy, xrefs: 0040C0A2
Nl}J|{{lg}Y{fjlzz, xrefs: 0040C7D8
J{lh}lM`{lj}f{p^, xrefs: 0040C62B
[lnMlel}l_he|l^, xrefs: 0040CE1B
@g}l{gl}[lhmO`el, xrefs: 0040CF57
M`zyh}jaDlzzhnl^, xrefs: 0040BF9A
]l{d`gh}l]a{lhm, xrefs: 0040C679
Mlel}lO`el^, xrefs: 0040C604
JefzlMlzb}fy, xrefs: 0040C0C3
Nl}]a{lhmJfg}lq}, xrefs: 0040C2F8

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: LibraryLoad$AddressProc$lstrlen
String ID: @g}l{gl}Fylg\{e^$@g}l{gl}Fylg^$@g}l{gl}JefzlAhgmel$@g}l{gl}Nl}Jffb`l^$@g}l{gl}Nl}Jfgglj}lmZ}h}l$@g}l{gl}Zl}Fy}`fg^$@g}l{gl}Zl}Jffb`l^$@g}l{gl}[lhmO`el$@yAeyHy`'MEE$A}}yX|l{p@gof^$Dhy_`l~FoO`el$Dhy_`{}|heBlp^$Efhm[lzf|{jl$Efjb[lzf|{jl$Fylg@gy|}Mlzb}fy$FylgD|}lq^$FylgJe`ykfh{m$FylgY{fjlzz$FylgY{fjlzz]fblg$JefzlAhgmel$JefzlJe`ykfh{m$JefzlMlzb}fy$Jefzl^`gmf~$JfypO`el^$J{lh}lD|}lq^$J{lh}lM`{lj}f{p^$J{lh}lO`elDhyy`gn^$J{lh}lO`el^$J{lh}lY`yl$J{lh}lY{fjlzz^$J{lh}l]a{lhm$Kefjb@gy|}$Lg|d^`gmf~z$Lq`}Y{fjlzz$Lq`}^`gmf~zLq$M`zyh}jaDlzzhnl^$Mlel}lO`el^$NefkheDldf{pZ}h}|z$Nl}BlpZ}h}l$Nl}Dfm|elO`elGhdl^$Nl}Dlzzhnl^$Nl}EfgnYh}aGhdl^$Nl}Hmhy}l{z@gof$Nl}HzpgjBlpZ}h}l$Nl}Je`ykfh{mMh}h$Nl}JehzzGhdl^$Nl}Jfdy|}l{Ghdl^$Nl}J|{{lg}Y{fjlzz$Nl}J|{{lg}Y{fjlzz@m$Nl}M`zbO{llZyhjlLq^$Nl}Mlzb}fy^`gmf~$Nl}O`elZ`sl$Nl}Y{fjlzz]`dlz$Nl}Zpz}ldDl}{`jz$Nl}Zpz}ld]`dlHzO`el]`dl$Nl}\zl{Ghdl^$Nl}]`jbJf|g}$Nl}]a{lhmJfg}lq}$Nl}^`gmf~]a{lhmY{fjlzz@m$Nl}_fe|dl@gof{dh}`fg^$Nl}_l{z`fgLq^$O`el]`dl]fEfjheO`el]`dl$O`el]`dl]fZpz}ld]`dl$O`gmGlq}O`el^$O`gmJefzl$O`gmO`{z}O`el^$O`gm[lzf|{jl^$O`gm^`gmf~Lq^$O`gm^`gmf~^$Oehza^`gmf~$O{ll[lzf|{jl$Yh}a@zM`{lj}f{p^$Yh}aO`elLq`z}z^$YllbGhdlmY`yl$ZANl}Yh}aO{fd@ME`z}^$ZANl}Zylj`heOfeml{Efjh}`fg$ZaleeLqlj|}l^$Zl}J|{zf{Yfz$Zl}L{{f{Dfml$Zl}O`elH}}{`k|}lz^$Zl}O`elYf`g}l{$Zl}Zpz}ldJ|{zf{$Zl}]a{lhmJfg}lq}$Zl}]a{lhmMlzb}fy$Zpz}ldYh{hdl}l{z@gof^$Z}{JdyG@^$[lelhzlD|}lq$[lelhzlMJ$[lhmO`el$[lhmY{fjlzzDldf{p$[lnFylgBlp^$[lnJefzlBlp$[lnJ{lh}lBlp^$[lnLg|dBlp^$[lnLg|d_he|l^$[lnMlel}lBlp^$[lnMlel}l_he|l^$[lnX|l{p_he|lLq^$[lnZl}_he|lLq^$[lz|dl]a{lhm$\[EDFG'MEE$\[EMf~gefhm]fO`el^$\gdhy_`l~FoO`el$]l{d`gh}lY{fjlzz$]l{d`gh}l]a{lhm$]{hgzeh}lDlzzhnl$^`gLqlj$^h`}Of{Z`gnelFkclj}$^{`}lO`el$^{`}lY{fjlzzDldf{p$_`{}|heHeefjLq$bl{gle:;'MEE$ez}{jyp^$zae~hy`'MEE$zalee:;'MEE$|zl{:;'MEE$~`g`gl}'MEE
API String ID: 2738378989-3024355689
Opcode ID: 425d9794fa0212803315e0c732f6b49e0cda1e53e6c546beca72f7af03797b15
Instruction ID: 4438aff9bfd592f4c2ae5199af2438c9166828cfa366d28cfe1c4cb90c63c00d
Opcode Fuzzy Hash: 425d9794fa0212803315e0c732f6b49e0cda1e53e6c546beca72f7af03797b15
Instruction Fuzzy Hash: 19A2AFB49113049BC740BBB6CCC29DD76ADEF45318F40857BB405BB282DA7C9D648BAE

Function 00428F34 Relevance: 76.0, APIs: 7, Strings: 36, Instructions: 733
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(0000000A,00000000,00429EB6), ref: 00429BCF

Strings

[F2], xrefs: 00429969, 00429974
[Spacebar], xrefs: 00429749, 00429754
[Enter], xrefs: 00429769, 00429774
[PageUp], xrefs: 004298E9
[F7], xrefs: 00429A09, 00429A14
[F6], xrefs: 004299E9, 004299F4
[Back], xrefs: 00429B09, 00429B14
[F12], xrefs: 00429AA9, 00429AB4
[Pause Break], xrefs: 00429B29, 00429B34
[PageuUp], xrefs: 004298F4
[End], xrefs: 00429929, 00429934
[F1], xrefs: 00429949, 00429954
[F11], xrefs: 00429A89, 00429A94
[Shift], xrefs: 00429829, 00429834
[Tab], xrefs: 004297A9, 004297B4
[F9], xrefs: 00429A49, 00429A54
[Clear], xrefs: 00429AE9, 00429AF4
[Scroll Lock], xrefs: 00429B89, 00429B94
[Insert], xrefs: 00429889, 00429894
[F5], xrefs: 004299C9, 004299D4
e, xrefs: 00429BD4
[F3], xrefs: 00429989, 00429994
[F4], xrefs: 004299A9, 004299B4
[Num Lock], xrefs: 00429B69, 00429B74
[Delete], xrefs: 004298A9, 004298B4
[F10], xrefs: 00429A69, 00429A74
[Home], xrefs: 004298C9, 004298D4
[Print Screen], xrefs: 00429B49, 00429B54
[CTRL], xrefs: 004297E9, 004297F4
[BackSpace], xrefs: 00429809, 00429814
[Menu], xrefs: 00429AC9, 00429AD4
[Esc], xrefs: 00429789, 00429794
[F8], xrefs: 00429A29, 00429A34
[Alt], xrefs: 004297C9, 004297D4
[PageDown], xrefs: 00429909, 00429914
[WIN], xrefs: 00429849, 00429854, 00429869, 00429874

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Sleep
String ID: [Alt]$[BackSpace]$[Back]$[CTRL]$[Clear]$[Delete]$[End]$[Enter]$[Esc]$[F10]$[F11]$[F12]$[F1]$[F2]$[F3]$[F4]$[F5]$[F6]$[F7]$[F8]$[F9]$[Home]$[Insert]$[Menu]$[Num Lock]$[PageDown]$[PageUp]$[PageuUp]$[Pause Break]$[Print Screen]$[Scroll Lock]$[Shift]$[Spacebar]$[Tab]$[WIN]$e
API String ID: 3472027048-2255270817
Opcode ID: 50002126579f975027b60eaadddd517dd50aebb1f2973432fdbf9623df31c46a
Instruction ID: 7a769bc3b6039aef3f797a9a906739d524dcf141c6a805c23f595b0cd5203b06
Opcode Fuzzy Hash: 50002126579f975027b60eaadddd517dd50aebb1f2973432fdbf9623df31c46a
Instruction Fuzzy Hash: 6982BBB0B01A56AFD784CF38E544795FAE4FB09304F81822BA52CDB340D779A964CF99

Function 00431870 Relevance: 33.4, APIs: 3, Strings: 16, Instructions: 168
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(00000000,00000000,00431AB5,?,00486680,00000000,00000000,?,00437EA6,?,00000000,00437F69,?,00000000,00000000,00000000), ref: 004318A4
GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004319C9

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,00000000), ref: 0040A4F2

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00431A4D

Strings

Mlel}lMJ, xrefs: 00431995
M~dLghkelJfdyfz`}`fg, xrefs: 00431A7C
Nl}MJ, xrefs: 004319D7
Nl}J|{{lg}Fkclj}, xrefs: 004318AE
Mlel}lFkclj}, xrefs: 004318F0
Nl}M@K`}z, xrefs: 004318CF
J{lh}lJfdyh}`kelMJ, xrefs: 00431911
M^DHY@'MEE, xrefs: 00431A3A
K`}Ke}, xrefs: 00431974
nm`:;'MEE, xrefs: 00431891
|zl{:;'MEE, xrefs: 004319B6
Nl}J|{zf{@gof, xrefs: 00431A19
Nl}J|{zf{Yfz, xrefs: 004319F8
M~d@zJfdyfz`}`fgLghkelm, xrefs: 00431A5B
Zlelj}Fkclj}, xrefs: 00431953
J{lh}lM@KZlj}`fg, xrefs: 00431932

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: AddressLibraryLoadProc$HandleModulelstrlen
String ID: J{lh}lJfdyh}`kelMJ$J{lh}lM@KZlj}`fg$K`}Ke}$M^DHY@'MEE$Mlel}lFkclj}$Mlel}lMJ$M~d@zJfdyfz`}`fgLghkelm$M~dLghkelJfdyfz`}`fg$Nl}J|{zf{@gof$Nl}J|{zf{Yfz$Nl}J|{{lg}Fkclj}$Nl}M@K`}z$Nl}MJ$Zlelj}Fkclj}$nm`:;'MEE$|zl{:;'MEE
API String ID: 9417994-4209024249
Opcode ID: 46f01f209ac1517e14f76089b48cfb9a6098342ea4fa0bf20f801332cc3d7d5f
Instruction ID: d210e15e72295cd6b726f6c75a30a71111ee1474a08510ed185e98678324d597
Opcode Fuzzy Hash: 46f01f209ac1517e14f76089b48cfb9a6098342ea4fa0bf20f801332cc3d7d5f
Instruction Fuzzy Hash: CB517D759113049BCB40FBA6CC828DE77ADEF48318F41993BB401B6396EA7C98144BAD

Function 00428C28 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 172
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(00000000,00428E6C), ref: 00428C51
GetWindowTextW.USER32(?,?,00000200), ref: 00428C9C

Part of subcall function 00428094: IsWow64Process.KERNEL32(00000000,?,?,00000000,00428168), ref: 00428115

EnterCriticalSection.KERNEL32(00486718,[,?,[,?,[,?,[), ref: 00428D2A
lstrlenW.KERNEL32(00000000,00000000,00428DB4,?,00486718,[,?,[,?,[,?,[), ref: 00428D46
SetFilePointer.KERNEL32(0000022C,00000000,00000000,00000002,00000000,00000000,00428DB4,?,00486718,[,?,[,?,[,?,[), ref: 00428D74
WriteFile.KERNEL32(0000022C,00000000,00000000,?,00000000,?,00486718,[,?,[,?,[,?,[), ref: 00428D96
LeaveCriticalSection.KERNEL32(00486718,00428DBB,?,[,?,[,?,[), ref: 00428DAE
lstrlenW.KERNEL32(?,00000000,00428E6C), ref: 00428DBF
EnterCriticalSection.KERNEL32(00486718,?,00000000,00428E6C), ref: 00428DDB
SetFilePointer.KERNEL32(0000022C,00000000,00000000,00000002,00000000,00428E3F,?,00486718,?,00000000,00428E6C), ref: 00428E04
WriteFile.KERNEL32(0000022C,?,00000000,?,00000000,?,00486718,?,00000000,00428E6C), ref: 00428E21
LeaveCriticalSection.KERNEL32(00486718,00428E46,00000000,00428E6C), ref: 00428E39

Part of subcall function 0040BAE8: FileTimeToLocalFileTime.KERNEL32(?,?,00000000,0040BC14,?,?,?,00486680), ref: 0040BB24
Part of subcall function 0040BAE8: FileTimeToSystemTime.KERNEL32(?,?,?,?,?,00486680), ref: 0040BB3A

Strings

[, xrefs: 00428CF8
4gH, xrefs: 00428C62, 00428D18, 00428D21, 00428D64, 00428D86, 00428DA5, 00428DD2, 00428DF4, 00428E11, 00428E30
[, xrefs: 00428D00
[, xrefs: 00428CD7
[, xrefs: 00428CCF

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: File$CriticalSectionTime$EnterLeavePointerWindowWritelstrlen$ForegroundLocalProcessSystemTextWow64
String ID: [$[$[$[$4gH
API String ID: 3089754618-4231738031
Opcode ID: 516d951e6b0bf63265b8909b6487c8250a738bae045213ac14c3181f4215715e
Instruction ID: cd6cea95f2fdff4dc38500494d2ec49a0396264a133fbde8197061e77fe4df3e
Opcode Fuzzy Hash: 516d951e6b0bf63265b8909b6487c8250a738bae045213ac14c3181f4215715e
Instruction Fuzzy Hash: B2511975700608AFDB00DF99DC85E8EBBF9EB49304F814069F504E72A2DB38ED548B68

Function 004082B8 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,004084DD,?,?), ref: 004082F1
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,004084DD,?,?), ref: 0040833A
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,004084DD,?,?), ref: 0040835C
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 0040837A
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 00408398
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 004083B6
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 004083D4
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,004084C0,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,004084DD), ref: 00408414
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,004084C0,?,80000001), ref: 0040843F
RegCloseKey.ADVAPI32(?,004084C7,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,004084C0,?,80000001,Software\Embarcadero\Locales), ref: 004084BA

Strings

Software\Embarcadero\Locales, xrefs: 00408330, 00408352
Software\Borland\Locales, xrefs: 004083AC
Software\CodeGear\Locales, xrefs: 00408370, 0040838E
Software\Borland\Delphi\Locales, xrefs: 004083CA

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: 014a0b9b99b7be46c737f40711a5b5c9164359921bb32e17d70cbc9f2a686574
Instruction ID: f754047bae0af19bad0102a25d5850afbc03eb5733155dacdeeb846caf687fb8
Opcode Fuzzy Hash: 014a0b9b99b7be46c737f40711a5b5c9164359921bb32e17d70cbc9f2a686574
Instruction Fuzzy Hash: A5513975B402097FEB20DAA5CD46FAE73BCEB08704F50447BBA44F65C1EAB89A40865D

Function 0043F770 Relevance: 24.9, APIs: 2, Strings: 12, Instructions: 400
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(00000030,00000000,0043FD8B,?,?,00486664,00000000,00000000,?,004436A7,00000000,004436EF,?,?,00000021,00000000), ref: 0043F7E6

Part of subcall function 0040B918: CompareStringW.KERNEL32(00000400,00000001,00000000,000000FF,00000000,000000FF,00486680,?,00437D4A,?,00000000,00437DA0,?,?,?,00486680), ref: 0040B939

Part of subcall function 00428590: LoadLibraryW.KERNEL32(00000000,00000000,004286D4,?,?,00486680,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0043F2F2), ref: 004285C3
Part of subcall function 00428590: LoadLibraryW.KERNEL32(00000000,00000000,00000000,004286D4,?,?,00486680,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042866C

Part of subcall function 0043DD30: ShowWindow.USER32(0002047E,00000001,00486734,00486680,0043F9AE), ref: 0043DD3F

Part of subcall function 0043DD80: UnregisterClassW.USER32(Regedit_fast_jump,00400000), ref: 0043DD8B

Strings

4gH, xrefs: 0043F787
$5_, xrefs: 0043F819
Not Config, xrefs: 0043F7F2
j3U}lz}U}lz}, xrefs: 0043F947
GGT, xrefs: 0043F7ED
_:E`}l'lql, xrefs: 0043FB9C
SOFTWARE\XXX_, xrefs: 0043F873
$0_, xrefs: 0043F83D
$1_, xrefs: 0043F84F
$2_, xrefs: 0043F82B
WINDIR, xrefs: 0043F883
XXX_, xrefs: 0043F861

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: LibraryLoadWindow$ClassCompareForegroundShowStringUnregister
String ID: $0_$$1_$$2_$$5_$4gH$GGT$Not Config$SOFTWARE\XXX_$WINDIR$XXX_$_:E`}l'lql$j3U}lz}U}lz}
API String ID: 954628970-2741076856
Opcode ID: ba1b297a2c8828a05f1b56c25951aa478554327dd0a177c7e5a506aad0e9947b
Instruction ID: 5e7b73b35abb561ea2aea0d9688f48cf422379d0deacb349a846aead5bae2168
Opcode Fuzzy Hash: ba1b297a2c8828a05f1b56c25951aa478554327dd0a177c7e5a506aad0e9947b
Instruction Fuzzy Hash: 37E1A870A002154BDF10FB72D88279A33A5AF49308F10A4BBFC45AB697CB3D9D598B5D

Function 0042FE9C Relevance: 24.6, APIs: 2, Strings: 12, Instructions: 139
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(00000000,00000000,0043007B,?,00486680,00000005,00000000,00000000,?,00437EAB,?,00000000,00437F69,?,00000000,00000000), ref: 0042FED1
LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0043007B,?,00486680,00000005,00000000,00000000,?,00437EAB,?), ref: 0042FF30

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,00000000), ref: 0040A4F2

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

Strings

@JJfdy{lzzf{O{ll, xrefs: 0042FFDF
jhyJ{lh}lJhy}|{l^`gmf~^, xrefs: 0042FEDB
@JZlxJfdy{lzzO{hdlZ}h{}, xrefs: 0042FF7C
@JJefzl, xrefs: 00430021
@JZlxJfdy{lzzO{hdlLgm, xrefs: 0042FF9D
@JNl}@gof, xrefs: 0042FF5B
@JFylg, xrefs: 00430000
@JZlgmDlzzhnl, xrefs: 00430042
@J@gof, xrefs: 0042FF3A
@JZlxJfdy{lzzO{hdl, xrefs: 0042FFBE
DZ_O^:;'MEE, xrefs: 0042FF1D
H_@JHY:;'MEE, xrefs: 0042FEBE

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: AddressLibraryLoadProc$lstrlen
String ID: @J@gof$@JFylg$@JJefzl$@JJfdy{lzzf{O{ll$@JNl}@gof$@JZlgmDlzzhnl$@JZlxJfdy{lzzO{hdl$@JZlxJfdy{lzzO{hdlLgm$@JZlxJfdy{lzzO{hdlZ}h{}$DZ_O^:;'MEE$H_@JHY:;'MEE$jhyJ{lh}lJhy}|{l^`gmf~^
API String ID: 268393782-1352645916
Opcode ID: 089b21e976e5bb31fd2e61345d4ec2166a8204ce257b80a6789a54d5fa0b185f
Instruction ID: b421654733045ff7ed06dadf9d5dc222b4f2467a359c68ce7b13b02f7cc919b0
Opcode Fuzzy Hash: 089b21e976e5bb31fd2e61345d4ec2166a8204ce257b80a6789a54d5fa0b185f
Instruction Fuzzy Hash: AA416D75910304ABCB40FBA5DC8299E77BDEF48318F41853BB401B6296EA7C9D144BAE

Function 0043C2D4 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 143
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyW.ADVAPI32(80000002,HARDWARE\DESCRIPTION\System\CentralProcessor,?,00000000,0043C469,?,00000002,00486680), ref: 0043C318
RegEnumKeyW.ADVAPI32(?,?,?,00000040,00000000,0043C447,?,?,00000002,00486680), ref: 0043C351
RegOpenKeyW.ADVAPI32(80000002,00000000,0000003A,?,?,00000002,00486680), ref: 0043C390
RegQueryValueExW.KERNEL32(0000003A,~MHz,00000000,00000000,?,00000040,00000000,0043C425,?,?,?,00000002,00486680), ref: 0043C3C4

Strings

~MHz, xrefs: 0043C3B4
HARDWARE\DESCRIPTION\System\CentralProcessor, xrefs: 0043C307
@, xrefs: 0043C330
HARDWARE\DESCRIPTION\System\CentralProcessor\, xrefs: 0043C371
MHz, xrefs: 0043C3F9
x , xrefs: 0043C3DE

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Open$EnumQueryValue
String ID: x $@$HARDWARE\DESCRIPTION\System\CentralProcessor$HARDWARE\DESCRIPTION\System\CentralProcessor\$MHz$~MHz
API String ID: 2932278830-2698563692
Opcode ID: 032ba24bc71f7c23bc6ff2f5b2645199532157326f691768a03b02e7855eee6c
Instruction ID: 465dbdd7c3b0a8fd04efb47e2e56d6c7e569cc34325a4f915b8280196c181288
Opcode Fuzzy Hash: 032ba24bc71f7c23bc6ff2f5b2645199532157326f691768a03b02e7855eee6c
Instruction Fuzzy Hash: AC415275A00208AFD701DBE9CC91EAEB7F8EB8D704F118076F501E7294DA78AD15CB58

Function 00428590 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 102
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(00000000,00000000,004286D4,?,?,00486680,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0043F2F2), ref: 004285C3
LoadLibraryW.KERNEL32(00000000,00000000,00000000,004286D4,?,?,00486680,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042866C

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,00000000), ref: 0040A4F2

Strings

^]ZLg|dl{h}lY{fjlzzlz^, xrefs: 0042867A
Nl}Dfm|elO`elGhdlLq^, xrefs: 00428617
^}zhy`:;'mee, xrefs: 00428659
YzHy`'MEE, xrefs: 004285B0
Lg|dY{fjlzzDfm|elz, xrefs: 004285F6
Lg|dY{fjlzzlz, xrefs: 004285D5
^]ZO{llDldf{p, xrefs: 0042869B
Nl}Y{fjlzz@dhnlO`elGhdl^, xrefs: 00428638

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: AddressLibraryLoadProc$lstrlen
String ID: Lg|dY{fjlzzDfm|elz$Lg|dY{fjlzzlz$Nl}Dfm|elO`elGhdlLq^$Nl}Y{fjlzz@dhnlO`elGhdl^$YzHy`'MEE$^]ZLg|dl{h}lY{fjlzzlz^$^]ZO{llDldf{p$^}zhy`:;'mee
API String ID: 268393782-2693748152
Opcode ID: ffa61641ab19f340686b4a17e72a16458ca9a0a1770ddef71ab0c5d47f97fb7c
Instruction ID: b2abc951f42fac8fa2330dbee562f4288950d046d5c14a321555204371fbe9ee
Opcode Fuzzy Hash: ffa61641ab19f340686b4a17e72a16458ca9a0a1770ddef71ab0c5d47f97fb7c
Instruction Fuzzy Hash: F7318075A123159BCB41FBA5DC428DE77A9EF85318B81813BB400B7682DB3C9D144BAE

Function 00407F84 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(0044CB84,00000000,00408088,?,?,?,00000000,?,00408950,00000000,004089AF,?,?,00000000,00000000,00000000), ref: 00407FA2
LeaveCriticalSection.KERNEL32(0044CB84,0044CB84,00000000,00408088,?,?,?,00000000,?,00408950,00000000,004089AF,?,?,00000000,00000000), ref: 00407FC6
LeaveCriticalSection.KERNEL32(0044CB84,0044CB84,00000000,00408088,?,?,?,00000000,?,00408950,00000000,004089AF,?,?,00000000,00000000), ref: 00407FD5
IsValidLocale.KERNEL32(00000000,00000002,0044CB84,0044CB84,00000000,00408088,?,?,?,00000000,?,00408950,00000000,004089AF), ref: 00407FE7
EnterCriticalSection.KERNEL32(0044CB84,00000000,00000002,0044CB84,0044CB84,00000000,00408088,?,?,?,00000000,?,00408950,00000000,004089AF), ref: 00408044
LeaveCriticalSection.KERNEL32(0044CB84,0044CB84,00000000,00000002,0044CB84,0044CB84,00000000,00408088,?,?,?,00000000,?,00408950,00000000,004089AF), ref: 0040806D

Strings

en-GB,en,en-US,, xrefs: 00407FB2, 00408059

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-GB,en,en-US,
API String ID: 975949045-3021119265
Opcode ID: f6d86eee62b6bf2d3840db3cc2fcc52f00c729b128c34464cea3ae48f6cc2a76
Instruction ID: 89e35a22fce1ca92aca6ca6f157c9b85d33dba724616c188b81eab689516efc9
Opcode Fuzzy Hash: f6d86eee62b6bf2d3840db3cc2fcc52f00c729b128c34464cea3ae48f6cc2a76
Instruction Fuzzy Hash: A421EE3470564157E710B7BA9D9371A3188CB45748F66407FB081B62D7CEBCAC04877E

Function 0043D9B0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowTextW.USER32(000402A6,00000000), ref: 0043DA7F
DefWindowProcW.USER32(?,?,?,?,00000000,0043DB6A), ref: 0043DB4D

Strings

MZP, xrefs: 0043DA0A, 0043DA3B
Fast jump, xrefs: 0043DA3E
HKEY_CURRENT_USER\Control Panel\Desktop, xrefs: 0043DA5D
EDIT, xrefs: 0043DA0D
BUTTON, xrefs: 0043DA43

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Window$ProcText
String ID: BUTTON$EDIT$Fast jump$HKEY_CURRENT_USER\Control Panel\Desktop$MZP
API String ID: 2218353596-2216858624
Opcode ID: e69d02082d12059add0810c350757150de9edb807d28e4ce6e4d838992b731ef
Instruction ID: 29dd7edaff14d80a172b70b85ca7432f0e91f08ba1914f13b3f7aed7ea465baa
Opcode Fuzzy Hash: e69d02082d12059add0810c350757150de9edb807d28e4ce6e4d838992b731ef
Instruction Fuzzy Hash: A8316F75A04208ABEB10EF69EC52F6E73E8EB0C700F525436F900EB2D1D678ED109769

Function 0042A7F0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 290
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFileMappingW.KERNEL32(000F001F,00000000,00000000,00000000,0042AC2E,?,?,?,00000001,0000000D,00000000,00000000,?,0042A482), ref: 0042A825
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,000F001F,00000000,00000000,00000000,0042AC2E,?,?,?,00000001,0000000D,00000000), ref: 0042A847

Part of subcall function 0040ACA4: lstrlenW.KERNEL32(00000000,?,?,00486730,?), ref: 0040ACDD

CloseHandle.KERNEL32(00000000,?,?,?,00000001,0000000D,00000000,00000000,?,0042A482), ref: 0042AC04

Strings

/f&TleQ , xrefs: 0042AB4E
GG-Team, xrefs: 0042A8E7
Hr,g:, xrefs: 0042A8F1

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: File$CloseHandleMappingOpenViewlstrlen
String ID: /f&TleQ $GG-Team$Hr,g:
API String ID: 1577053069-1553010781
Opcode ID: 4e8d2ed8e5dc330a495821ac6da8edd1e0c939cf8e47830b426858d943a3eded
Instruction ID: 88ff79b281bd7af9570e5b325977c4e31f3e4296546c137c43f7e8822453c311
Opcode Fuzzy Hash: 4e8d2ed8e5dc330a495821ac6da8edd1e0c939cf8e47830b426858d943a3eded
Instruction Fuzzy Hash: 51B1D630740629AFDB04DBA2DD41FEEB3B6FF88705F904126B500B61C1D7BC69249B9A

Function 004289D0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 180
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00486750,00000000,00428BB1,?,?,00486734,00486680,00000000,00000000,00000000,00000000,00000000,00000000,?,00437E88,?), ref: 00428A06
PathFileExistsW.SHLWAPI(00000000,00486750,00000000,00428BB1,?,?,00486734,00486680,00000000,00000000,00000000,00000000,00000000,00000000,?,00437E88), ref: 00428A25
PathFileExistsW.SHLWAPI(00000000,?,?,00486734,00486680,00000000,00000000,00000000,00000000,00000000,00000000,?,00437E88,?,00000000,00437F69), ref: 00428A47

Part of subcall function 0040B634: VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004,00428AA0,?,?,00486734,00486680,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B63E

CreateFileW.KERNEL32(00000000,C0000000,00000003,00000000,00000004,00000080,00000000,?,?,00486734,00486680,00000000,00000000,00000000,00000000,00000000), ref: 00428AF5
WriteFile.KERNEL32(0000022C,00448D58,00000002,?,00000000,?,?,00486734,00486680,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00428B24

Strings

4gH, xrefs: 004289DE

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: File$ExistsPath$AllocCreateCriticalInitializeSectionVirtualWrite
String ID: 4gH
API String ID: 106481530-2392367260
Opcode ID: 641a12213c002d202eb040d692c47d83a4d590f8a8e8c087d38c8d42ee72e603
Instruction ID: 29819a5de8cda6a99f4655cf52bdc728baad44d093ff2e3fce99fad4ffdf4ba8
Opcode Fuzzy Hash: 641a12213c002d202eb040d692c47d83a4d590f8a8e8c087d38c8d42ee72e603
Instruction Fuzzy Hash: 00513870701205AFE760DBA9DC82F5E77F8AB49704F50457AB600E72A1DF74ED088B29

Function 0040B654 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 80
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,0040B734,?,?,00486734,00486680), ref: 0040B67A
LoadLibraryW.KERNEL32(kernel32.dll,kernel32.dll,00000000,0040B734,?,?,00486734,00486680), ref: 0040B68A
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,00000000,kernel32.dll,00000000,0040B734,?,?,00486734,00486680), ref: 0040B6DD
GetNativeSystemInfo.KERNEL32(?,?,?,00486734,00486680), ref: 0040B6FE

Strings

@z^f~?=Y{fjlzz, xrefs: 0040B69C
kernel32.dll, xrefs: 0040B675, 0040B685

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: CurrentHandleInfoLibraryLoadModuleNativeProcessSystem
String ID: @z^f~?=Y{fjlzz$kernel32.dll
API String ID: 407697875-2470416289
Opcode ID: cf400a607496727c57d8b79e2d90979a375013f491e65cfe34c017647f0dda60
Instruction ID: cc312165b627e4cdb14975307c8c75a868c5ce4217f7475409fe1e9344262d1c
Opcode Fuzzy Hash: cf400a607496727c57d8b79e2d90979a375013f491e65cfe34c017647f0dda60
Instruction Fuzzy Hash: 2121BE31901315AEC712ABB98C51AEF72A8EB85718F954437F800B73C1EB3C8C1596EE

Function 0043DC14 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 61registryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00486734,00486680,0043F7AF,00000000,0043FD8B,?,?,00486664,00000000,00000000,?,004436A7,00000000,004436EF), ref: 0043DC42
RegisterClassW.USER32(00486C08), ref: 0043DC52
KiUserCallbackDispatcher.NTDLL(00000000,00000000,00486734,00486680,0043F7AF,00000000,0043FD8B,?,?,00486664,00000000,00000000,?,004436A7,00000000,004436EF), ref: 0043DC65

Strings

Regedit_fast_jump, xrefs: 0043DC2B, 0043DCB9
Regedit fast jump V1.2, xrefs: 0043DCB4

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: CallbackClassDispatcherHandleModuleRegisterUser
String ID: Regedit fast jump V1.2$Regedit_fast_jump
API String ID: 2026650474-4282503210
Opcode ID: cc5dc9e7916a9fd9ffcc6e7132985b69ea0554bfb4b0e75fc1fa52871a3855d4
Instruction ID: ff227f2102c6a89d754623d3dc831d9a7ff48536fe2538a773c3bd321e84cfba
Opcode Fuzzy Hash: cc5dc9e7916a9fd9ffcc6e7132985b69ea0554bfb4b0e75fc1fa52871a3855d4
Instruction Fuzzy Hash: 16113AB5B517105FE3A0DF68ED85B6A32E4EB08708F01593EF645DB2D0DBB9A8048B49

Function 004265F0 Relevance: 7.6, APIs: 5, Instructions: 97networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004265CC: socket.WS2_32(00000002,00000001,00000000), ref: 004265DB

htons.WS2_32(?), ref: 00426637
gethostbyname.WS2_32(00000000), ref: 00426665
connect.WS2_32(?,00000008,00000010), ref: 00426690
WSAGetLastError.WS2_32(?,?,00000000,00000000), ref: 004266B9
Sleep.KERNEL32(00000002,?,?,00000000,00000000), ref: 004266CA

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: ErrorLastSleepconnectgethostbynamehtonssocket
String ID:
API String ID: 2864911191-0
Opcode ID: 0d525b8fed161735b1c2b0090c4469bf3a874fd080ef476f2429f5e45fdea166
Instruction ID: 0dd1b41a93d19dc09989b8233b659783f6ed969359d15ac89dd0c57dc2224665
Opcode Fuzzy Hash: 0d525b8fed161735b1c2b0090c4469bf3a874fd080ef476f2429f5e45fdea166
Instruction Fuzzy Hash: 50319F74A002149FCB10DFA5D985A9E77B8FF48314F5284BAE904EB291D738CD44CB69

Function 0042A30C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0040ACA4: lstrlenW.KERNEL32(00000000,?,?,00486730,?), ref: 0040ACDD

OpenFileMappingW.KERNEL32(000F001F,00000000,00000000,00000000,00000000,00000000,0042A3BA,?,00486734,00486680,00000000,?,00437ED9,?,00000000,00437F69), ref: 0042A356
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,000069D8,00000000,000F001F,00000000,00000000,00000000,00000000,00000000,0042A3BA,?,00486734,00486680), ref: 0042A390
InitializeCriticalSection.KERNEL32(00465C80,?,00486734,00486680,00000000,?,00437ED9,?,00000000,00437F69,?,00000000,00000000,00000000,?,0043FD1C), ref: 0042A39F

Strings

_Share_GGT_, xrefs: 0042A33D

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: FileMapping$CreateCriticalInitializeOpenSectionlstrlen
String ID: _Share_GGT_
API String ID: 3818311671-3867152089
Opcode ID: fc406bb750eb4cddcf97fb9f4df053afcbc479497fae568b1b2a28301e04e8dc
Instruction ID: ce4900a62e11ce9a572bac5c0a59808664cb2c3850396779e9c8bc1c065c1da5
Opcode Fuzzy Hash: fc406bb750eb4cddcf97fb9f4df053afcbc479497fae568b1b2a28301e04e8dc
Instruction Fuzzy Hash: F3118674740310AFE710EB69DC42F2A73D9EB49B18FA1443BFD01E76D1D9B85C24865A

Function 00407E68 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 00407E79
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 00407ED7
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 00407F34
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 00407F67

Part of subcall function 00407E24: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,00407EE5), ref: 00407E3B
Part of subcall function 00407E24: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,00407EE5), ref: 00407E58

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 64e88a95cc42ba7287f90517dc0aa7ad91b6f4ea3144bac7362c88a4aa254beb
Instruction ID: c64547fa24ced421637df5c0631d32c6e461f39fc0f139bc27309100008ee978
Opcode Fuzzy Hash: 64e88a95cc42ba7287f90517dc0aa7ad91b6f4ea3144bac7362c88a4aa254beb
Instruction Fuzzy Hash: 63317230E0511A9BDB10DFA5D885AAEB7B8FF04304F0045BAE515F72D1D778AE05CB99

Function 0040A748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,Regedit_fast_jump,0043D9B0,?,?,?,00000005,?,?,?,?,?), ref: 0040A787

Strings

Regedit_fast_jump, xrefs: 0040A785
Regedit fast jump V1.2, xrefs: 0040A74B

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: CreateWindow
String ID: Regedit fast jump V1.2$Regedit_fast_jump
API String ID: 716092398-4282503210
Opcode ID: 52ed684031a3f60b859464a8a3777d52d3d04c0f90a715adbf70d004a935ed74
Instruction ID: a517241aa0c29f4206de9bdbe5aa9f665dbdabb8af3f7c10e9afbeb71ed45618
Opcode Fuzzy Hash: 52ed684031a3f60b859464a8a3777d52d3d04c0f90a715adbf70d004a935ed74
Instruction Fuzzy Hash: 1FF074B6700118AF8B44DE9DDC81DDF77ECEB8D264B054129BA08E3201D634ED1187A4

Function 0042A3EC Relevance: 4.6, APIs: 3, Instructions: 51fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00465C80,00486734,00486680,?,00437EDE,?,00000000,00437F69,?,00000000,00000000,00000000,?,0043FD1C), ref: 0042A405
MapViewOfFile.KERNEL32(00000298,00000002,00000000,00000000,00000000,00000000,0042A474,?,00465C80,00486734,00486680,?,00437EDE,?,00000000,00437F69), ref: 0042A42D
LeaveCriticalSection.KERNEL32(00465C80,0042A47B,00486680,?,00437EDE,?,00000000,00437F69,?,00000000,00000000,00000000,?,0043FD1C), ref: 0042A46E

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: CriticalSection$EnterFileLeaveView
String ID:
API String ID: 4211325400-0
Opcode ID: 0d9f7f40c9d7ea83eeb8b38dac8d25be34085f6cc11532efc3bdb7fca5f7cb44
Instruction ID: 8bcca562de0659576e544f917722c751e79bc37380bef6d5bc26bb2733c4fdf1
Opcode Fuzzy Hash: 0d9f7f40c9d7ea83eeb8b38dac8d25be34085f6cc11532efc3bdb7fca5f7cb44
Instruction Fuzzy Hash: C101F7753417106FE310BBA9AC42B1573D9E785714F90807BF900E76D1CAF89C24865F

Function 00406188 Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 00406056
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00406193
SysFreeString.OLEAUT32(?), ref: 004061A5

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: d42786cc01202ac8c23bd76360906db4bd554bbf72aedcf7f9264658cf042870
Instruction ID: 807d5b284fdb83f8e106d4bf72ef5d77e4b48e4457f3ca37c9d18d6d77b33670
Opcode Fuzzy Hash: d42786cc01202ac8c23bd76360906db4bd554bbf72aedcf7f9264658cf042870
Instruction Fuzzy Hash: FCE0ECB81052016DEA196E319915B372329AF91700B64847EAE01BA2D6D6BE9801552C

Function 00438190 Relevance: 3.9, APIs: 3, Instructions: 196sleepstringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,00438F20,?,?,?,?,00000032,00000000,00000000), ref: 004381F0

Part of subcall function 0042674C: recv.WS2_32(?,?,00000023,00000000), ref: 00426758
Part of subcall function 0042674C: WSAGetLastError.WS2_32(?,0043830E,?,000003E8,00000002,00000000,00000000,00438F20,?,?,?,?,00000032,00000000,00000000), ref: 00426765

Sleep.KERNEL32(00000000,00000000,00000000,00438F20,?,?,?,?,00000032,00000000,00000000), ref: 004383D6
Sleep.KERNEL32(00000000,00000000,00438F20,?,?,?,?,00000032,00000000,00000000), ref: 00438418

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Sleep$ErrorLastlstrlenrecv
String ID:
API String ID: 3996653200-0
Opcode ID: 927a0611222a8a65cb3c775a621b0e1e155c29f4f3cb73098f6324d9d0580529
Instruction ID: 0d1a5bda4d6c6b9de2d10e32bc7ad702a1b5d6b6f24c3881c00fe5a691bfc029
Opcode Fuzzy Hash: 927a0611222a8a65cb3c775a621b0e1e155c29f4f3cb73098f6324d9d0580529
Instruction Fuzzy Hash: 3D713E74A002148FCB04EF69D881A9EB7F5EF59304F55906BF804AB396DB78ED11CB58

Function 00428094 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

IsWow64Process.KERNEL32(00000000,?,?,00000000,00428168), ref: 00428115

Strings

4gH, xrefs: 004280BB

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: ProcessWow64
String ID: 4gH
API String ID: 2092917072-2392367260
Opcode ID: 61c5414cba485c1269f8953de91e68ac7cc580cd0d63077f82f4cefd3cb140cc
Instruction ID: 56777332dcb3f63b959ff86f62cf389278823c75343c10e79bd2b799f39e66af
Opcode Fuzzy Hash: 61c5414cba485c1269f8953de91e68ac7cc580cd0d63077f82f4cefd3cb140cc
Instruction Fuzzy Hash: 26213934700245AFE721DFA9DC81F5A77E8EB8A704F914479F544D7290EEB89D04CB58

Function 00427BF0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,?,?,00486680,?), ref: 00427C1A

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00427C11

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Open
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
API String ID: 71445658-2256017818
Opcode ID: e08dad67d0b0650943f26f123db1f80dc3a104914a0c84b7fd48843967ddd4c9
Instruction ID: dbd1817951312129e823704a002e168db0ba3b3f48672b961da6198f4a169ccc
Opcode Fuzzy Hash: e08dad67d0b0650943f26f123db1f80dc3a104914a0c84b7fd48843967ddd4c9
Instruction Fuzzy Hash: 43111975604218AFD710CF99EC95E9EB7FCEB99310F5140B6F904D3390EA74AE048B68

Function 0043C658 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41networkCOMMON

Download Yara Rule

APIs

InternetGetConnectedState.WININET(?,00000000,?,00486680,0043B873,0043BA34,00A4294C,0043BA34,00A4292C,0043BA34,?,0043BA34,?,0043BA34, MB,?), ref: 0043C66A

Strings

*gw, xrefs: 0043C6BA

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: ConnectedInternetState
String ID: *gw
API String ID: 97057780-3824414855
Opcode ID: 097074b7753a585bd9b46b815b44bc7c2079c04e9b8b79d91b1b0e65f3e43132
Instruction ID: 7475345d8b99e8fa3accaeba3c40ea5ea109b7619a8deb36e54877f1e8ca3b7c
Opcode Fuzzy Hash: 097074b7753a585bd9b46b815b44bc7c2079c04e9b8b79d91b1b0e65f3e43132
Instruction Fuzzy Hash: BEF017723050004B9A10EB5E89C352AA3C5EBAC718FA0B83BF446EB380C73CDC15676B

Function 0043D048 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32(C:\,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0043D077

Strings

C:\, xrefs: 0043D06F

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: InformationVolume
String ID: C:\
API String ID: 2039140958-3404278061
Opcode ID: aa89cf07ec3d2225497f1e78925457fa8028b756b0f7926a72dbf8a9feaf2cb0
Instruction ID: e2840545e67906565d6833ba5e7da4f5bd5e4bc28f5d0448f3776f2bce82787f
Opcode Fuzzy Hash: aa89cf07ec3d2225497f1e78925457fa8028b756b0f7926a72dbf8a9feaf2cb0
Instruction Fuzzy Hash: 6EE048773542107FE310DA789C81F9B73DCDB49620F108936F668D71D0F67199048755

Function 00408898 Relevance: 3.1, APIs: 2, Instructions: 93COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,004089AF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00408A36,00000000,?,00000105), ref: 00408943
GetSystemDefaultUILanguage.KERNEL32(00000000,004089AF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00408A36,00000000,?,00000105), ref: 0040896B

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: 3e333a8880a3a5e567c2e7b863fcc0508ba600fd06b8817ba67f4161b2b043f0
Instruction ID: d299ade2d0cde5e0e6b4ac4308b209071da85b2919ee7819c01997859eb2786b
Opcode Fuzzy Hash: 3e333a8880a3a5e567c2e7b863fcc0508ba600fd06b8817ba67f4161b2b043f0
Instruction Fuzzy Hash: F8314C70A002099BDB10FBA9C981BAEB7B4AB44304F60447FE481B33D1DB7CAD45CB5A

Function 004089BC Relevance: 3.1, APIs: 2, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,00408A76,?,00400000,00444C08), ref: 004089F8
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,00408A76,?,00400000,00444C08), ref: 00408A49

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: 4b5f65d131dd44abe89ba08c5592b5a98fb8228b2147084425797af8f58d8da9
Instruction ID: ff3da6a666be0d6ffa05517e973b0afc017d91cd30ce0c1a03a3bebe0d5e188f
Opcode Fuzzy Hash: 4b5f65d131dd44abe89ba08c5592b5a98fb8228b2147084425797af8f58d8da9
Instruction Fuzzy Hash: 03116031A4021C9BDB14EB60CD86BDD73B8DB04304F5140BBB509B22D1DA785E848AA8

Function 00426840 Relevance: 3.0, APIs: 2, Instructions: 47networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,00000000,00000001,00000000), ref: 0042685E
WSAGetLastError.WS2_32(?,00000000,00000000,00000000,0042B60B,00000000,0042B63B,?,00000000,00000000,0042B658,?,?,?,00000001), ref: 0042686B

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: ErrorLastsend
String ID:
API String ID: 1802528911-0
Opcode ID: 79d38629eee673ff6eb1dc3b9f55717c317b0fde577c5294c1d74e9963d8f61c
Instruction ID: eea7f73edd5889aa44c63be0e89ffae9a27acdcffa5b63b0f6d0306b76622c2c
Opcode Fuzzy Hash: 79d38629eee673ff6eb1dc3b9f55717c317b0fde577c5294c1d74e9963d8f61c
Instruction Fuzzy Hash: 72F081727062305BC6207EAABC8462B7798DB90775F66023BFD14C3380D76DAC4596AA

Function 004264F4 Relevance: 3.0, APIs: 2, Instructions: 41networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000008,?,00000004), ref: 00426517
WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 00426550

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Ioctlsetsockopt
String ID:
API String ID: 1903391676-0
Opcode ID: 03644be328834875c1244788aae63f487b93a48ab88a38caa1f142fd73c9b7a2
Instruction ID: b380039b2bc01e844831d0eb9d4097936793d745d484792cb81435d4e0b4e8fb
Opcode Fuzzy Hash: 03644be328834875c1244788aae63f487b93a48ab88a38caa1f142fd73c9b7a2
Instruction Fuzzy Hash: FFF06DB1248301BFE310DB288C85F5B7BECEB84721F158A39B6A9D62D0DBB49444CB56

Function 0042674C Relevance: 3.0, APIs: 2, Instructions: 27networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000023,00000000), ref: 00426758
WSAGetLastError.WS2_32(?,0043830E,?,000003E8,00000002,00000000,00000000,00438F20,?,?,?,?,00000032,00000000,00000000), ref: 00426765

Part of subcall function 0042671C: shutdown.WS2_32(?,00000002), ref: 00426730
Part of subcall function 0042671C: closesocket.WS2_32(?), ref: 0042673A

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: ErrorLastclosesocketrecvshutdown
String ID:
API String ID: 1486353823-0
Opcode ID: e60be1d18a4f465e31499d2ad4d553654dd02f45920f6680eb65059168611b32
Instruction ID: 2ccd750e74ecc19f750fd273caaa8381b6e9293f8943de3bd2fab76ebbad5cdb
Opcode Fuzzy Hash: e60be1d18a4f465e31499d2ad4d553654dd02f45920f6680eb65059168611b32
Instruction Fuzzy Hash: A8E0207570123047C61037B87C4551A518C8B8436DF860577BD05D73C2D56CCC0013AD

Function 0040B948 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(00000000,?,00000208,004866F8,0043D0E3,00000000,0043D13A,?,00486680,00000001,00000000,00000000,?,00437AE2,?,00000000), ref: 0040B95D
GetLongPathNameW.KERNEL32(?,?,00000208), ref: 0040B972

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: EnvironmentLongNamePathVariable
String ID:
API String ID: 2057972008-0
Opcode ID: 15b9029d297ef0175ab10ccc5325bcd8575cfd201a7f1f65d94be1b2a52fba4c
Instruction ID: dc435742a546365fcd1a1d8ae548f6de60c2f229cc9ad4274613245ab6a971ca
Opcode Fuzzy Hash: 15b9029d297ef0175ab10ccc5325bcd8575cfd201a7f1f65d94be1b2a52fba4c
Instruction Fuzzy Hash: DAE086FAA0030067D3409794DC89C8B77AD9BC8710F04C53A7699C2291EA3899045762

Function 0043B35C Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,000003FF,00486680,0043B8B9,0043BA34,?,00000000,00000000), ref: 0043B36F
GetWindowTextW.USER32(00000000,?,000003FF), ref: 0043B375

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Window$ForegroundText
String ID:
API String ID: 29597999-0
Opcode ID: 3b3505a3a0ac42150d07072c85154a669ecb038c3fb3a63437e86ba52f1bcabf
Instruction ID: b04caff63234f7f49ee665022c03383a1182fae9889a01cd521a3bb298639227
Opcode Fuzzy Hash: 3b3505a3a0ac42150d07072c85154a669ecb038c3fb3a63437e86ba52f1bcabf
Instruction Fuzzy Hash: 7CD0A791B4030013E20036A99C8261B729C8F94314F554939BE84D73D2EA3E893502AF

Function 00437F88 Relevance: 2.5, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,00438016), ref: 00437FB4

Part of subcall function 0042B474: lstrlenW.KERNEL32(00000000,00000000,0042B658,?,?,?,00000001), ref: 0042B4AE

LeaveCriticalSection.KERNEL32(?,00438000,?,?,00000000,00438016), ref: 00437FF3

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: CriticalSection$EnterLeavelstrlen
String ID:
API String ID: 3224049430-0
Opcode ID: 0d7464473ba05cbbb2e82fef99e55768ca255a18160affc4f90ee55d651ccd01
Instruction ID: f55897ce139089ab867502ac5b4fb763503053097d543c628563b233534a37de
Opcode Fuzzy Hash: 0d7464473ba05cbbb2e82fef99e55768ca255a18160affc4f90ee55d651ccd01
Instruction Fuzzy Hash: 2A01A274608344AFCB11DF69CC9295EBBF8EB0D70475244B6F800E3782DA38DA10DA65

Function 0043A7B4 Relevance: 1.6, APIs: 1, Instructions: 79fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0043A7D9

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e6026e072492908bd2ac8bec586b219015e7024cba609ac1c8d8e6f45bb31c07
Instruction ID: effb560f06ffb086691e009eb791961bbbf3811e5e89f95771296192e7b8b082
Opcode Fuzzy Hash: e6026e072492908bd2ac8bec586b219015e7024cba609ac1c8d8e6f45bb31c07
Instruction Fuzzy Hash: AD213A753402007FE220EB5DDC85F6B33D8EB89B20F504135FA58EB2E0DA70AD099769

Function 00405EDC Relevance: 1.5, APIs: 1, Instructions: 48threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(?,?,00405EA4,00000000,?,?), ref: 00405F36

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: d4c16be4ab22564aca3f1db8b54fc976ceab500ef82638a0386371b67865511e
Instruction ID: b65f584a43c0bf9e7da64db86cd81b6158c014f4424037469d94041db21b4cff
Opcode Fuzzy Hash: d4c16be4ab22564aca3f1db8b54fc976ceab500ef82638a0386371b67865511e
Instruction Fuzzy Hash: 4F017C76A04615AFC710DF9D9880A8BBBECEB49365F10417AF508E73C1D678ED008BA8

Function 00428018 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

K32GetProcessImageFileNameW.KERNEL32(?,?,00000208,00000000,00428078), ref: 00428044

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: FileImageNameProcess
String ID:
API String ID: 3017713154-0
Opcode ID: 44753aad1a822e409e58ed8457575a18b76babf8020968265b994119b94af591
Instruction ID: 00bc4d1833600cf21b4bd5bd878e36f0b8a84f162ff77f5791b9df623770c608
Opcode Fuzzy Hash: 44753aad1a822e409e58ed8457575a18b76babf8020968265b994119b94af591
Instruction Fuzzy Hash: D8F02271309218AFD710CB66FC5286EB7ECE745724B7285BBE808D2640EA354D1489A8

Function 0042817C Relevance: 1.5, APIs: 1, Instructions: 42timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(00000000,?,?,?,?), ref: 004281C4

Part of subcall function 0040BAE8: FileTimeToLocalFileTime.KERNEL32(?,?,00000000,0040BC14,?,?,?,00486680), ref: 0040BB24
Part of subcall function 0040BAE8: FileTimeToSystemTime.KERNEL32(?,?,?,?,?,00486680), ref: 0040BB3A

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Time$File$LocalProcessSystemTimes
String ID:
API String ID: 2224436155-0
Opcode ID: e01253d6c9a6667fa1fcfca1fb66cbb1702a9f989d8597fc01d8182e358f5cc2
Instruction ID: c0f96d77b7cdf6fef9d78a379c25be5386df188f29ecbee95136ee4c353147ac
Opcode Fuzzy Hash: e01253d6c9a6667fa1fcfca1fb66cbb1702a9f989d8597fc01d8182e358f5cc2
Instruction Fuzzy Hash: 16F037753002116FD300DB9CDC80EAB73DCAB89214F40453ABA28D73A0EE74ED148B99

Function 00407744 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00400000,?,0000020A), ref: 00407762

Part of subcall function 004089BC: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,00408A76,?,00400000,00444C08), ref: 004089F8
Part of subcall function 004089BC: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,00408A76,?,00400000,00444C08), ref: 00408A49

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: 358e5c818d4021d8e6dfb070530815b4a7e06f116bb450956073f4b4dbaad43c
Instruction ID: 0c0d8af671378e37ef2f8f11867f171fa8a64e733914af962fdd6609c9811da0
Opcode Fuzzy Hash: 358e5c818d4021d8e6dfb070530815b4a7e06f116bb450956073f4b4dbaad43c
Instruction Fuzzy Hash: 84E0C9B1A003109BCB14EFA8CAC5A563794AB18754F0445AAED68DF386D375E910C7D6

Function 004264A8 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 004264C7

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 6f620cc0493e7550235cd532137eb6fc8c417d51ecbc718e29ec7d6162a63254
Instruction ID: dac38774c12ad157a662963cdbbf63fcac60a701ab0a03f3ad73e4cf0346f0d6
Opcode Fuzzy Hash: 6f620cc0493e7550235cd532137eb6fc8c417d51ecbc718e29ec7d6162a63254
Instruction Fuzzy Hash: 49D0A7F4644700A9E610BF00DC81B67769AABC0701F41C418B2C14A284C7BE0045864A

Function 004265CC Relevance: 1.5, APIs: 1, Instructions: 13networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 004265DB

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: 1c0be28f3114f568c886b964665f0d94fee9638e7b33bccbcf00a0272f5473c6
Instruction ID: 6bb6142a94c5a099761c66cc421a218867242c07cdce3739f4e60fa7620a48eb
Opcode Fuzzy Hash: 1c0be28f3114f568c886b964665f0d94fee9638e7b33bccbcf00a0272f5473c6
Instruction Fuzzy Hash: F8D0C974241321DBDB205F746D8E744BA546708732F14C7A5A6395F1D6D2B1C4819525

Function 0043C2AC Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0043C2B7

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: ad0ee5a14db9f8d35ea5e052034d939f1592ab2900357ceb092edfa78fdaa2ba
Instruction ID: 745979406293098b998b21dc8bc2544273246259db0e0677c0bcf9ce87b2224a
Opcode Fuzzy Hash: ad0ee5a14db9f8d35ea5e052034d939f1592ab2900357ceb092edfa78fdaa2ba
Instruction Fuzzy Hash: 66C012B054430057D200EB11DC03B0A73906B90744F800E19B9D4763C4D77DA914469B

Function 00426448 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00001002,?,00000004), ref: 0042645E

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 90b101a2a0573660a928b05228da2c3784fef589de541a589e3b69617d637554
Instruction ID: bb8a9b4648efff138e9f474982d846f9cc4f0d96350c3f9ea27ce7a000e96af9
Opcode Fuzzy Hash: 90b101a2a0573660a928b05228da2c3784fef589de541a589e3b69617d637554
Instruction Fuzzy Hash: 86C08CF0288301BAE2006B009C0AE7A72A8DBC8B02F40C938B3848A0C887B048489616

Function 00426408 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00001006,?,00000004), ref: 0042641E

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 4eb0adef7ceac2b22505375c602b20f11d6d6d2e8f1cb8d7bcabd21d17a25561
Instruction ID: 701e4707a96d052bc1b10243d43104cad9535a7c74554599590351426dfedfe6
Opcode Fuzzy Hash: 4eb0adef7ceac2b22505375c602b20f11d6d6d2e8f1cb8d7bcabd21d17a25561
Instruction Fuzzy Hash: 72C08CF0288301BAE2106B009C05E7A72A8DBC8B02F00C938B3848A0C887B044489616

Function 0040B288 Relevance: 1.5, APIs: 1, Instructions: 9synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(00000000,00000001,00000000,0043A380,?,?,00486680,0043F162,00000000,0043F406,?,00486734,00486680,00000000,00000000,00000000), ref: 0040B294

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: b859bd4616cb6dd907c98fc490d86ff8af2ee78a39d944d8233d32dc93cfa400
Instruction ID: eda8243675ec38aac7cca1f5942d914f989ef7de6786f736835ed049ce2af6ae
Opcode Fuzzy Hash: b859bd4616cb6dd907c98fc490d86ff8af2ee78a39d944d8233d32dc93cfa400
Instruction Fuzzy Hash: 2DB012F1D714405DDE0807308D49C6E342FD1C1A0B718C265F0018001CD83944044020

Function 00426564 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,0045F0B0), ref: 0042656E

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: 3edcd535bb5d69f2c68979e5168ea0cfe4d657896c45878ceb297bf3764585b6
Instruction ID: 44ae0b0028eb01218a78a6d63e91cbd5235d5447584bcb4ff0911ab5febe76ad
Opcode Fuzzy Hash: 3edcd535bb5d69f2c68979e5168ea0cfe4d657896c45878ceb297bf3764585b6
Instruction Fuzzy Hash: C3B01232362340CED6002B711D0EB4B2E544701ED3F0C40BA7840C50F3C594C00C8B2F

Function 0042B474 Relevance: 1.4, APIs: 1, Instructions: 155stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,0042B658,?,?,?,00000001), ref: 0042B4AE

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: 4b2752ea6813bc4d6d3ea2b833f7aa0f835c0d73c1b6eed2a5df22c0c15b692c
Instruction ID: 13ca886a8ed0d5ec0d195ec816cb4a6fadfe92b0cde49bbda9ade18e8d2c3fc5
Opcode Fuzzy Hash: 4b2752ea6813bc4d6d3ea2b833f7aa0f835c0d73c1b6eed2a5df22c0c15b692c
Instruction Fuzzy Hash: 8151C371B002599FDB00EBA4D881AEEB7B5EF85304F15807AE501F7381D7389E11CBAA

Function 0043BC54 Relevance: 1.3, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 0043BC08: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,?,00486734,00486680), ref: 0043BC22
Part of subcall function 0043BC08: AdjustTokenPrivileges.KERNELBASE(?,00000000,00000001,00000000,00000000,?), ref: 0043BC44

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,?,00437EA1,?,00000000,00437F69,?,00000000,00000000,00000000,?,0043FD1C), ref: 0043BCDB

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: AdjustCloseHandleLookupPrivilegePrivilegesTokenValuelstrlen
String ID:
API String ID: 2571840792-0
Opcode ID: 991721a17c7baba6eec0b44cd81d84c56b0229ae4b6ac257835551f99c18bcdf
Instruction ID: 56cfc1f9d9a126ba73abe90030d394327abc895aaaabf02c77f1afeaf98aefc6
Opcode Fuzzy Hash: 991721a17c7baba6eec0b44cd81d84c56b0229ae4b6ac257835551f99c18bcdf
Instruction Fuzzy Hash: 6E113034700204AFD710EB99DC52B5D73E9EB49700F5094BAF900E7391DF78AE049759

Function 004027A8 Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,00402DBB,FFFFFFDC,00402A8C), ref: 004027BE

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6e83b55374e38ba348886defc969fcf363bb13e5c12b6dfeb1a80ee92d75bf7a
Instruction ID: d7f275c02b8ff420755371fd827dccc32f36ce75ba3383e112499b9bd2685023
Opcode Fuzzy Hash: 6e83b55374e38ba348886defc969fcf363bb13e5c12b6dfeb1a80ee92d75bf7a
Instruction Fuzzy Hash: 4AF049B1B803404BEB09DF798E853027AD6A78A304F24803EE508FB7E9E6B48415CB09

Function 0040B216 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00008000,0040B218,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B20B

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 4e520fd87c1f03c42c6ee2a2e84f959edf21d4391d1962ea3ddc91060453bdf3
Instruction ID: e8c454c9f37c4267a3a7746dfe8ce229ffa12ee5dc60596a9f49732140231103
Opcode Fuzzy Hash: 4e520fd87c1f03c42c6ee2a2e84f959edf21d4391d1962ea3ddc91060453bdf3
Instruction Fuzzy Hash: 4AB01224640708B1EE10E1904C16F0E21147704700FA00495B2007A0C1C57D5500174D

Non-executed Functions

Function 0042D1D4 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 240serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000004,00000000,0042D53E,?,?,00000BCA,00000000,00000000), ref: 0042D204
EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000003,?,00005800,?,?,?,00000000,00000000,0042D519,?,?,?,00000BCA), ref: 0042D258
OpenServiceW.ADVAPI32(00000000,?,80000000,0042D558,?,0042D558,?,0042D558,?,?,00000000,0042D558,?,0042D558,?,?), ref: 0042D338
QueryServiceConfigW.ADVAPI32(?,?,00000608,?,00000000,0042D4EC,?,?,?,?,00000BCA,00000000,00000000), ref: 0042D362
QueryServiceConfig2W.ADVAPI32(?,00000001,?,00000608,?), ref: 0042D42E
CloseServiceHandle.ADVAPI32(?,0042D4F3,?,\Parameters,?,SYSTEM\CurrentControlSet\Services\,?,?), ref: 0042D4E5

Strings

ServiceDll, xrefs: 0042D47D
\Parameters, xrefs: 0042D45B
SYSTEM\CurrentControlSet\Services\, xrefs: 0042D440

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Service$OpenQuery$CloseConfigConfig2EnumHandleManagerServicesStatus
String ID: SYSTEM\CurrentControlSet\Services\$ServiceDll$\Parameters
API String ID: 876170868-2801189604
Opcode ID: e3187046fb30eae6e42c4959e321805dde99f8cc8d963a26136a116fbf37876b
Instruction ID: 9384077c3cc053152125fa4c488302ce4d68f398f94affc140d1868f48c8ae01
Opcode Fuzzy Hash: e3187046fb30eae6e42c4959e321805dde99f8cc8d963a26136a116fbf37876b
Instruction Fuzzy Hash: B7917F31A00668AFDB11EB94DC45F9FBBB9EB48705F6040A6F504B7281D6B8AF90CF54

Function 004080C8 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00416CA8,?,?), ref: 004080E5
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 004080F6
FindFirstFileW.KERNEL32(?,?,kernel32.dll,00416CA8,?,?), ref: 004081F6
FindClose.KERNEL32(?,?,?,kernel32.dll,00416CA8,?,?), ref: 00408208
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,00416CA8,?,?), ref: 00408214
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,00416CA8,?,?), ref: 00408259

Strings

GetLongPathNameW, xrefs: 004080F0
\, xrefs: 00408226
kernel32.dll, xrefs: 004080E0

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: c0075b3f116daeefb17eaddd3ceca8e9c16820536a0e8076f9c9bbe445cf2216
Instruction ID: 9b698579dee47a5ce6c7e6d575a683c27756de6a4c8f4362d234e3b766aaeab0
Opcode Fuzzy Hash: c0075b3f116daeefb17eaddd3ceca8e9c16820536a0e8076f9c9bbe445cf2216
Instruction Fuzzy Hash: 6F41B431E006189BCB10EBA9CD85ADE73B5AF44310F1445FE9944F72D4EBBCAE41CA59

Function 0042D600 Relevance: 12.1, APIs: 8, Instructions: 107serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F), ref: 0042D622
OpenServiceW.ADVAPI32(00000000,?,000F01FF,00000000,0042D714), ref: 0042D64D
StartServiceW.ADVAPI32(00000000,00000000,?,00000000,0042D6F5,?,?,000F01FF,00000000,0042D714), ref: 0042D687
ControlService.ADVAPI32(00000000,?,?,00000000,0042D6F5,?,?,000F01FF,00000000,0042D714), ref: 0042D69F
DeleteService.ADVAPI32(00000000,00000000,0042D6F5,?,?,000F01FF,00000000,0042D714), ref: 0042D6AE
ChangeServiceConfigW.ADVAPI32(00000000,000000FF,?,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0042D6F5,?,?,000F01FF), ref: 0042D6D4
CloseServiceHandle.ADVAPI32(00000000,0042D6FC,00000000,0042D714), ref: 0042D6EE
CloseServiceHandle.ADVAPI32(00000000,0042D71B,0042D714), ref: 0042D70D

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Service$CloseHandleOpen$ChangeConfigControlDeleteManagerStart
String ID:
API String ID: 4289576418-0
Opcode ID: 2160bc710cf6ce5fa40d14bcf6b49b17236948c5e440c8f43311568ad2f9ccbd
Instruction ID: 00d6b0ea2340d184e4ac602b8d2d9b3dcc352b1e864844e6011df15c9d578a2f
Opcode Fuzzy Hash: 2160bc710cf6ce5fa40d14bcf6b49b17236948c5e440c8f43311568ad2f9ccbd
Instruction Fuzzy Hash: 48316275F04328AFDB50CFA4EC48BBEBBB8EB09310F514966F515E3291D6794900CB28

Function 0040BA58 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000,00000000,?,0043F7E0), ref: 0040BA70
FindResourceW.KERNEL32(00000000,00000000,0000000A,00000000,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000), ref: 0040BA82
LoadResource.KERNEL32(00000000,00000000,00000000,0040BAD8,?,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680), ref: 0040BAA4
LockResource.KERNEL32(00000000,?,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000,00000000), ref: 0040BAB1
FreeResource.KERNEL32(00000000,0040BADF,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000,00000000,?,0043F7E0,00000000), ref: 0040BAD1

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Resource$FindFreeHandleLoadLockModule
String ID:
API String ID: 2355082082-0
Opcode ID: 42ae530f8878b1a679c5bb975ed892b2aba36b703ce15ae7888e2b82efbc6652
Instruction ID: 7bba7a99e39e5116ed02c681e27dab3f3a696a6cdaaff79990abd0375f4619b6
Opcode Fuzzy Hash: 42ae530f8878b1a679c5bb975ed892b2aba36b703ce15ae7888e2b82efbc6652
Instruction Fuzzy Hash: 2201A2B5B41300BFE711ABB59C99B2B7AECDB49704F154436F502E3291D6B89D008A6C

Function 004208F4 Relevance: 6.9, Strings: 5, Instructions: 623COMMON

Download Yara Rule

Strings

unknown compression method, xrefs: 00420AF9, 00420BBB
incorrect header check, xrefs: 00420AD8
unknown header flags set, xrefs: 00420BD6
header crc mismatch, xrefs: 00420FE9
invalid window size, xrefs: 00420B2D

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID:
String ID: header crc mismatch$incorrect header check$invalid window size$unknown compression method$unknown header flags set
API String ID: 0-3633268661
Opcode ID: e421627b6d3ef4813b9cd1cb7e4e93ecca93056e609e004e2c6e571c8664583d
Instruction ID: 5aa6cc173b3391f6acc93418eb06beab7e704764d6cad50eead2ed0394f17092
Opcode Fuzzy Hash: e421627b6d3ef4813b9cd1cb7e4e93ecca93056e609e004e2c6e571c8664583d
Instruction Fuzzy Hash: 53429C70608351CFDB19CF18D48471ABBE2BF94304F558A9EE8958B39AC378D985CF86

Function 00407C6C Relevance: 4.6, APIs: 3, Instructions: 99COMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000002,00000000,00407DD1,?,00416CA8,?,00000000), ref: 00407D16
GetLocaleInfoW.KERNEL32(00000000,00000059,?,00000055,?,00000002,00000000,00407DD1,?,00416CA8,?,00000000), ref: 00407D32
GetLocaleInfoW.KERNEL32(00000000,0000005A,?,00000055,00000000,00000059,?,00000055,?,00000002,00000000,00407DD1,?,00416CA8,?,00000000), ref: 00407D43

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Locale$Info$Valid
String ID:
API String ID: 1826331170-0
Opcode ID: 9cff0d3348290ca2a90f4383b7475f1b890a15e121f1c26136eb9ab308403985
Instruction ID: cb6f84242b6bd7eb567289af83c8d0b6ce4ec7fb6fccd1f7e095b64bd6960065
Opcode Fuzzy Hash: 9cff0d3348290ca2a90f4383b7475f1b890a15e121f1c26136eb9ab308403985
Instruction Fuzzy Hash: BB319370908618ABDB21DF65DC41BEF77B9EF45700F5100BAA509B32D0D6386E40DA2A

Function 0042CD20 Relevance: 2.7, APIs: 2, Instructions: 164memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,?,00000000,0042CF0D), ref: 0042CE4D

Part of subcall function 0042CF20: LoadLibraryW.KERNEL32(00000000,00000000,0042D072,?,00000000,00000000,00000000,00000000,00000000,00000000,?,0042C75E,00000000,0042CB8F), ref: 0042CF4F

GetProcessHeap.KERNEL32(00000002,00000002,00000000,0042CF0D), ref: 0042CDB9

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: HeapLibraryLoadProcesslstrlen
String ID:
API String ID: 2291779644-0
Opcode ID: a4ad016c7aadfe64fa50f34d65b76e8dfdd09318eb685b5a3bc3574a8b7af209
Instruction ID: af40e136eb8a80b2c807ab81720f25aca7d12571b2d8b63e57f36ef82cf8eefa
Opcode Fuzzy Hash: a4ad016c7aadfe64fa50f34d65b76e8dfdd09318eb685b5a3bc3574a8b7af209
Instruction Fuzzy Hash: 0151AE30B002599FDB10DFA8D889BAEBBB6EF04318F55456AE550E72D2D7389D40CB98

Function 0042215C Relevance: 1.6, Strings: 1, Instructions: 368COMMON

Download Yara Rule

Strings

@, xrefs: 00422537

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: b96ea4d795e52e0cbc28a4f6c6dc946e769f731dce4a6bc4f008eae8c63e5877
Instruction ID: b9ef98d5a4b80ae8891dd039f04c528f5d66e671782ec5683b84e093ee49c4ec
Opcode Fuzzy Hash: b96ea4d795e52e0cbc28a4f6c6dc946e769f731dce4a6bc4f008eae8c63e5877
Instruction Fuzzy Hash: 22F18A30E00229EFCF14CF98D6906EEB7B2FF88314F64816AD815A7350D7B95A81CB59

Function 0043D53C Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceW.KERNEL32(0043D5C8,?,?,?,?), ref: 0043D55B

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: e87e138e4647938174f2fb1c71107ea3d34bf100f4757f2c66dfeab1f907a810
Instruction ID: 722191c768b93adc3ee7384d8ae8d85cce96b81de28fd7b043a1ed70963e2dba
Opcode Fuzzy Hash: e87e138e4647938174f2fb1c71107ea3d34bf100f4757f2c66dfeab1f907a810
Instruction Fuzzy Hash: 0101DBB6908305AF8300CF25D94454BB7E8FB88718F018E2EF499D2250E734D6649F97

Function 0041A7F8 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 0041A816

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 717e442d9ba59f080960d8c1af65eb908c4d522835428e411fe5605ce704592d
Instruction ID: d2677e7c0692ec905221d20ee55997995fee871a34f49f2f45da0795f110d223
Opcode Fuzzy Hash: 717e442d9ba59f080960d8c1af65eb908c4d522835428e411fe5605ce704592d
Instruction Fuzzy Hash: F9E09231B0031417D714A5594C86AEAB25C9B48304F40417FBD05D7383EDB89DA546EA

Function 0041C9BC Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?,00443372,00000000,004433AE), ref: 0041C9CA

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 410daf95ed0a469dd512ef5a5967b7ccbf0efea800e537d36b1624eb76be447d
Instruction ID: fd2dafa55c2e6acee7043c9d3444ebc36f4af6900e2dab5189e4adadca447262
Opcode Fuzzy Hash: 410daf95ed0a469dd512ef5a5967b7ccbf0efea800e537d36b1624eb76be447d
Instruction Fuzzy Hash: D5F03A78604302AFD300DF29E881B5677E4FB85354F25883EE4A5C7790D3B89844CB6A

Function 0041D4C8 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(0041D2C4,00000002,?,?,0041D825,0041ACC9,?,00000000,0041AD0A,?,?,?,00000000,00000000), ref: 0041D4F5

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 32ce9e885527816f9e09a1f86bc2d3d4f3c5158a372c670a0bd60f4d724a60a4
Instruction ID: 8e98f53c9f9b7e88f3d7b8dd49ee88ba54752af6f9b13f34fc451e0c690c828a
Opcode Fuzzy Hash: 32ce9e885527816f9e09a1f86bc2d3d4f3c5158a372c670a0bd60f4d724a60a4
Instruction Fuzzy Hash: 80E026E3B41A5047C110B3AA0C43B9766015F80FA8F088137B6549B3C7DA3E4C4442EF

Function 0041A844 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,0000000F,0041A950,00000002,0000002C,?,?,?,0041A950), ref: 0041A857

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 58987645bfbbee6fc28fe0b4ed17b5a5fde59b998e684a8b31a1635996b276c1
Instruction ID: b9449ca555f2f2ccec25807d7e44655e4db0c9481b156a35af3152a2306382e1
Opcode Fuzzy Hash: 58987645bfbbee6fc28fe0b4ed17b5a5fde59b998e684a8b31a1635996b276c1
Instruction Fuzzy Hash: 7FD0A7B630A36037F214615B6D85DBB56DCCBC9B71F14483BBA4CC6242E264CC56D3B6

Function 0041A7A8 Relevance: 1.5, APIs: 1, Instructions: 22timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0041A7B0

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: cc63837cd0e0228cc7dad83b21aadb2e0b0c518d6fe40878e2d736c4f10d41c3
Instruction ID: 06318e0a978b251f7552ce83099d137f2a78b4a7f7d4c002c409463ba53a5027
Opcode Fuzzy Hash: cc63837cd0e0228cc7dad83b21aadb2e0b0c518d6fe40878e2d736c4f10d41c3
Instruction Fuzzy Hash: B5E0AEA0409622A1C244AF56C94147EBBE5AEC4B42F408C5EF8D8801E2EA38C5E8D367

Function 0041D2E0 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000003,?,00000400,?,0041D384,?,00000000,0041D491,?,?,?,00000000,00000000,?,0041D2DA), ref: 0041D2FB

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 546146c88b4468738698108138840791addf51eebf06498012cf86390d029840
Instruction ID: 0bc421e85727c7e5c995c04e8cc11c701060a9d54ec275e9e26de52d8a6d5cbb
Opcode Fuzzy Hash: 546146c88b4468738698108138840791addf51eebf06498012cf86390d029840
Instruction Fuzzy Hash: 57D0A7D1B1420013E20466549C42B2632989B84718F10403C7784973C1EE7C581592BF

Function 0041E9D4 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bb131cff54dac0a17fa0430d97710fb3fbaca081f14c2dfb00f25ea5c265502
Instruction ID: 48ccd76fde1caefed0a1bafca9e47237c15715bce1ea54867a43199c5f3efdce
Opcode Fuzzy Hash: 7bb131cff54dac0a17fa0430d97710fb3fbaca081f14c2dfb00f25ea5c265502
Instruction Fuzzy Hash: 34522C78204200CFCB69CF19D5C4AA77BA1FB55314F1485AADC564F34BC738E896CBAA

Function 004256E7 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8108c0919ebe0a62dc1a3c0d770a967296a6d4281c4cff3fe8e85353f61d94c
Instruction ID: ccbc9e3b3b988b1a2639bc40e96ceb9ede32833eaa6386f207492ac60acdb363
Opcode Fuzzy Hash: c8108c0919ebe0a62dc1a3c0d770a967296a6d4281c4cff3fe8e85353f61d94c
Instruction Fuzzy Hash: ACC12531705AA18FDB19CE7CA5E417EBBA1EF5B3107A843AEC9939B341C6355C41C358

Function 004250A3 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 992f9ef4ac75f0517e4f103bd5ebd9b15839cc245a363fac5098010588fc42f0
Instruction ID: 83d69f7e7a0d40b843f9f77534f9b243b6506894ec7929cfbb6302e3d9f63b00
Opcode Fuzzy Hash: 992f9ef4ac75f0517e4f103bd5ebd9b15839cc245a363fac5098010588fc42f0
Instruction Fuzzy Hash: DAB1C631B056A68FEB058EB8D4A43BEBFB1EF56300F9841B9C6969B382D6750C41C758

Function 00425496 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53218ac9c3402bc8f8af1589c54b9bace25acbaa702a47eb739fe7649f1e299b
Instruction ID: 0b6a3a904b3c2a65084a4f42e216b6bebd6507ce2b08fb90d32a0940a8a6e108
Opcode Fuzzy Hash: 53218ac9c3402bc8f8af1589c54b9bace25acbaa702a47eb739fe7649f1e299b
Instruction Fuzzy Hash: CB717F2174A9D14EE3158A3CA5942767F53DEEB2083FD81FEC5D78B72AD43A484AC314

Function 0041E0A4 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a46a25728c0e4dbe5aa0a1433bd48846487817f0c63754d6310f19dcd07371b1
Instruction ID: 39f3ea260ff6f3da6e90f99155dd58d696b832892f746bc686792a1460b815df
Opcode Fuzzy Hash: a46a25728c0e4dbe5aa0a1433bd48846487817f0c63754d6310f19dcd07371b1
Instruction Fuzzy Hash: 4A61403238969103E33D8E7E5CE02F7DAD35FC621872ED57D94DAC3F42E86AA4564108

Function 004248B4 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55a0c9c45a1588e48286f93ff0363a089bf508e03ed3182d1f2667a37a43aa9a
Instruction ID: fc66ac791adbdaa746e195e9219ab8b7eff2d2fcd351ac04a69530b87842b3f9
Opcode Fuzzy Hash: 55a0c9c45a1588e48286f93ff0363a089bf508e03ed3182d1f2667a37a43aa9a
Instruction Fuzzy Hash: 50815E73E104374BEB628EA89C443A16392EFCC39EF9B45B0ED05BB646D538BD5186C0

Function 00424600 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cede2845c3c078565989d8b19d2722a88f11da72bd50b5e794d6115143c99bdb
Instruction ID: c076ae4ec7e98f079aa73721ed259bcdda166da481f5d85c57de931fd6df4a6b
Opcode Fuzzy Hash: cede2845c3c078565989d8b19d2722a88f11da72bd50b5e794d6115143c99bdb
Instruction Fuzzy Hash: 77712973E214775BEB609EA898443617392EFC925CF9F46B0CE05BB646C638BC5296C0

Function 00424DF9 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff4b5aa407d26def04aa93fcbed6af8a13554df28c9671371980bedb7aa4fc29
Instruction ID: 6fbe61cb5ea202d4d7eb47eef63c2e9d999fae2c3a580790453706e6268bd6a9
Opcode Fuzzy Hash: ff4b5aa407d26def04aa93fcbed6af8a13554df28c9671371980bedb7aa4fc29
Instruction Fuzzy Hash: A531533278969103E72DCE6DACE12A7EBD3AFC531432FD57DA4DAC3F42D869A4114148

Function 004046A0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae0e43f82692c6785844f3e70bb209c8b319b1924ab6e756aa91dc1deac9637f
Instruction ID: a4e46bec99a474ce8606889887d9032a08aa3b3c2d828dc17b03fe1f6695e101
Opcode Fuzzy Hash: ae0e43f82692c6785844f3e70bb209c8b319b1924ab6e756aa91dc1deac9637f
Instruction Fuzzy Hash: D7D012EA63110217F766C02D58A0BA31547E7C2315F25CD3AA905E5FD1E1BECCB08018

Function 00425F00 Relevance: 31.7, APIs: 1, Strings: 17, Instructions: 184libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B,?,?,00486664,00000000,00000000), ref: 00425F34

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,00000000), ref: 0040A4F2

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

Strings

a}fgz, xrefs: 00426046
zl}zfjbfy}, xrefs: 004260A9
^ZHZ}h{}|y, xrefs: 00425F80
`gl}Vg}fh, xrefs: 004260EB
za|}mf~g, xrefs: 00425FE3
zlgm, xrefs: 00426004
jfgglj}, xrefs: 00426067
nl}afz}kpghdl, xrefs: 00425FA1
jefzlzfjbl}, xrefs: 00426088
`gl}Vhmm{, xrefs: 0042610C
nl}zfjbfy}, xrefs: 004260CA
^ZH@fj}e, xrefs: 00425F3E
zlelj}, xrefs: 0042614E
g}faz, xrefs: 0042612D
^ZHNl}Ehz}L{{f{, xrefs: 00425F5F
~z;V:;'MEE, xrefs: 00425F21
zfjbl}, xrefs: 00425FC2

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: AddressProc$LibraryLoadlstrlen
String ID: ^ZH@fj}e$^ZHNl}Ehz}L{{f{$^ZHZ}h{}|y$`gl}Vg}fh$`gl}Vhmm{$a}fgz$g}faz$jefzlzfjbl}$jfgglj}$nl}afz}kpghdl$nl}zfjbfy}$za|}mf~g$zfjbl}$zlelj}$zlgm$zl}zfjbfy}$~z;V:;'MEE
API String ID: 1729337914-1815106237
Opcode ID: 8f734a74b5820445d690829d2c52daff7a50941e13d6a135ceb200ec9b92a943
Instruction ID: 5c4a131c88f9612ba7b75e74eb8d09919213aae810613ce822a12766d2a0e463
Opcode Fuzzy Hash: 8f734a74b5820445d690829d2c52daff7a50941e13d6a135ceb200ec9b92a943
Instruction Fuzzy Hash: A66153B56113049ACB00FBB5DC828DE77ADEF44319B81857BB401B7297DA7C98148BAE

Function 00432368 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 00432373
LoadCursorW.USER32(00000000,00007F01), ref: 00432385
LoadCursorW.USER32(00000000,00007F02), ref: 00432397
LoadCursorW.USER32(00000000,00007F03), ref: 004323A9
LoadCursorW.USER32(00000000,00007F04), ref: 004323BB
LoadCursorW.USER32(00000000,00007F80), ref: 004323CD
LoadCursorW.USER32(00000000,00007F81), ref: 004323DF
LoadCursorW.USER32(00000000,00007F82), ref: 004323F1
LoadCursorW.USER32(00000000,00007F83), ref: 00432403
LoadCursorW.USER32(00000000,00007F84), ref: 00432415
LoadCursorW.USER32(00000000,00007F85), ref: 00432427
LoadCursorW.USER32(00000000,00007F86), ref: 00432439
LoadCursorW.USER32(00000000,00007F88), ref: 0043244B
LoadCursorW.USER32(00000000,00007F89), ref: 0043245D
LoadCursorW.USER32(00000000,00007F8A), ref: 0043246F
LoadCursorW.USER32(00000000,00007F8B), ref: 00432481
DestroyIcon.USER32(?,00000000,00007F8B,00000000,00007F8A,00000000,00007F89,00000000,00007F88,00000000,00007F86,00000000,00007F85,00000000,00007F84,00000000), ref: 00432496

Strings

d, xrefs: 004324AB

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: CursorLoad$DestroyIcon
String ID: d
API String ID: 4160882069-2564639436
Opcode ID: bf7c25c0758c83dd8361d29cf79b8cbd3adabcf9f3f7ee9b71b899f0064be9ea
Instruction ID: eca3b65f90c1fbf3b1966a39f07301b07b48cd0bd549073b7d2622b705562fcd
Opcode Fuzzy Hash: bf7c25c0758c83dd8361d29cf79b8cbd3adabcf9f3f7ee9b71b899f0064be9ea
Instruction Fuzzy Hash: 54315974A9C3016AF7507F614883BB639619B00B05F09457AFF4C6E2C7EBB914544BAB

Function 00436E6C Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 290sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0040B4DC: GetModuleHandleW.KERNEL32(kernel32.dll,?,00486680,0043F20A,00000001,00000000,?,00486734,00486680,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B4E5

OutputDebugStringW.KERNEL32(00000000), ref: 004370E3
Sleep.KERNEL32(000003E8,00000000), ref: 004370ED
OutputDebugStringW.KERNEL32(00000000), ref: 00437113
DuplicateHandle.KERNEL32(00000000), ref: 00437150
Sleep.KERNEL32(0000000A,00000000), ref: 004371B6

Part of subcall function 00436E28: Sleep.KERNEL32(0000000A), ref: 00436E53

DuplicateHandle.KERNEL32(00000000), ref: 004371AD
OutputDebugStringW.KERNEL32(00000000), ref: 00437072

Part of subcall function 0040B918: CompareStringW.KERNEL32(00000400,00000001,00000000,000000FF,00000000,000000FF,00486680,?,00437D4A,?,00000000,00437DA0,?,?,?,00486680), ref: 0040B939

Strings

D, xrefs: 00436FFC
4gH, xrefs: 00436E86
wbem\WmiPrvSE.exe, xrefs: 00436FD1
system32\cmd.exe, xrefs: 00436FAB
SysWOW64\wbem\WmiPrvSE.exe, xrefs: 00436F5F
SysWOW64\conime.exe, xrefs: 00436F85
OK , xrefs: 0043705F
SysWOW64\cmd.exe, xrefs: 00436F39
BH---------------------, xrefs: 00437100
NO , xrefs: 004370D0

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: String$DebugHandleOutputSleep$Duplicate$CompareModule
String ID: 4gH$BH---------------------$D$NO $OK $SysWOW64\cmd.exe$SysWOW64\conime.exe$SysWOW64\wbem\WmiPrvSE.exe$system32\cmd.exe$wbem\WmiPrvSE.exe
API String ID: 1574471335-2317324235
Opcode ID: f6a6e7bae677c8132e6ba9494dda6be8392fda42d5b7d85d582f24808f4848ca
Instruction ID: f05568c7d4dfcf692034845640a9875653ac5b9122fc9bc2ab6e3659e48a1b66
Opcode Fuzzy Hash: f6a6e7bae677c8132e6ba9494dda6be8392fda42d5b7d85d582f24808f4848ca
Instruction Fuzzy Hash: BCB15F74604205AFDB10EFA9C885B9E77E8EF49304F10407AF949EB395DB38AD04DB69

Function 0043DDC4 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 136windowsleepCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000001), ref: 0043DE20
SetForegroundWindow.USER32(?), ref: 0043DE58
SetForegroundWindow.USER32(00000000), ref: 0043DE5E
SetFocus.USER32(00000000,00000000,?), ref: 0043DE64
SendMessageW.USER32(00000000,00000100,00000027,00000000), ref: 0043DE78
SendMessageW.USER32(00000000,00000102,?,00000000), ref: 0043DEAD
SendMessageW.USER32(00000000,00000100,00000027,00000000), ref: 0043DEBE
Sleep.KERNEL32(000000C8,00000000,00000100,00000027,00000000,00000000,00000000,?), ref: 0043DED2
SetForegroundWindow.USER32(00000000), ref: 0043DEF1
SetFocus.USER32(00000000,00000000), ref: 0043DEF7
SendMessageW.USER32(00000000,00000100,00000024,00000000), ref: 0043DF06
SendMessageW.USER32(00000000,00000102,?,00000000), ref: 0043DF34

Strings

regedit.exe, xrefs: 0043DDF5
SysTreeView32, xrefs: 0043DE3C
RegEdit_RegEdit, xrefs: 0043DDDA, 0043DE05
SysListView32, xrefs: 0043DED9

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: MessageSend$Window$Foreground$Focus$ShowSleep
String ID: RegEdit_RegEdit$SysListView32$SysTreeView32$regedit.exe
API String ID: 2024206484-319980174
Opcode ID: ba715b5f51fbc91f1544afe809a9ddc58d0da2c7aeeb399d06efcbd992129322
Instruction ID: ba1137598a63224ba6c654e925c15ac110f6c28f76abf197ed28cf60a58f3b56
Opcode Fuzzy Hash: ba715b5f51fbc91f1544afe809a9ddc58d0da2c7aeeb399d06efcbd992129322
Instruction Fuzzy Hash: CF41A370A44301BBE221EB58DCC6F3F36E4AB99B04F10442AF584EF2D1D6B8DC40931A

Function 0042BAFC Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 191windowCOMMON

Download Yara Rule

APIs

CreateFontW.GDI32(0000000C,00000006,00000000,00000000,000000C8,00000000,00000000,00000000,00000086,00000000,00000000,00000000,00000000,Arial), ref: 0042BC24
SendMessageW.USER32(?,00000030,?,00000000), ref: 0042BC35
SendMessageW.USER32(00000000,00000030,?,00000000), ref: 0042BC48
SendMessageW.USER32(00000000,00000030,?,00000000), ref: 0042BC5B
DefWindowProcW.USER32(?,?,?,?), ref: 0042BD17

Strings

sQ , xrefs: 0042BBE9
Arial, xrefs: 0042BBFF
EDIT, xrefs: 0042BB5F, 0042BB8D
BUTTON, xrefs: 0042BBC0, 0042BBEE

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: MessageSend$CreateFontProcWindow
String ID: Arial$BUTTON$EDIT$sQ
API String ID: 369421526-1325858889
Opcode ID: 91081239d773ded964b170543547179827420fda9424dc9f98072b94967eb520
Instruction ID: a2bb92f48b7c9c5c0a2ca1f4238ce0aeea9e52c4f4215f0c1d5f0f2e55f97722
Opcode Fuzzy Hash: 91081239d773ded964b170543547179827420fda9424dc9f98072b94967eb520
Instruction Fuzzy Hash: 185112713903147BF720AA59AC56FAB2768E700B44FA44427F700BF2D1DBB9AC01879E

Function 00409148 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 258COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00409200

Strings

@Y, xrefs: 0040932A, 00409334

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: ExceptionRaise
String ID: @Y
API String ID: 3997070919-2635300530
Opcode ID: 2ff4fce7c77f293058c68d3cc450b499553666d9f0ef4978638c54b6cd64c25f
Instruction ID: 102a0f0c3ce5befaca2a965e61597f0f4c621f32d06faf9af7fb97871bd771b6
Opcode Fuzzy Hash: 2ff4fce7c77f293058c68d3cc450b499553666d9f0ef4978638c54b6cd64c25f
Instruction Fuzzy Hash: 0CA16F759012099FDB15DFA8D8C0BAEB7B5AB88300F14453EE905B73C2DB78AD45CB58

Function 0042DC10 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 255stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(?, /c "), ref: 0042DD92
lstrcatW.KERNEL32(?,00000000,?, /c "), ref: 0042DDA7
lstrcatW.KERNEL32(?,0042DF9C,?,00000000,?, /c "), ref: 0042DDB8

Part of subcall function 0042B474: lstrlenW.KERNEL32(00000000,00000000,0042B658,?,?,?,00000001), ref: 0042B4AE

Strings

COMSPEC, xrefs: 0042DD78
8[B, xrefs: 0042DC58
D, xrefs: 0042DD3A
|aH, xrefs: 0042DCC8
HfH, xrefs: 0042DC6B
/c ", xrefs: 0042DD86

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: lstrcat$lstrlen
String ID: /c "$8[B$COMSPEC$D$HfH$|aH
API String ID: 751011610-206186839
Opcode ID: 3fd42765af6cd0e49e37bf4326e02f1654d9d2902df654bd2d7dff41fd898852
Instruction ID: 81ed9846a7d3f65a68619d801d78e7a443c993b2260b494b6be705ed66106b92
Opcode Fuzzy Hash: 3fd42765af6cd0e49e37bf4326e02f1654d9d2902df654bd2d7dff41fd898852
Instruction Fuzzy Hash: 9AA14B70A002199FDB11DBA9DC81F9EB3F8FB48304F91417AF544EB291DB79A944CB68

Function 0041A870 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 219threadCOMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000001,00000000,0041AB5F,?,?,?,?,00000000,00000000), ref: 0041A897
GetThreadLocale.KERNEL32(?,00000001,00000000,0041AB5F,?,?,?,?,00000000,00000000), ref: 0041A8A0

Part of subcall function 0041A844: GetLocaleInfoW.KERNEL32(?,0000000F,0041A950,00000002,0000002C,?,?,?,0041A950), ref: 0041A857

Part of subcall function 0041A7F8: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 0041A816

Strings

:mm:ss, xrefs: 0041AB12
:mm, xrefs: 0041AAF7
m/d/yy, xrefs: 0041A9AB
mmmm d, yyyy, xrefs: 0041A9D0
AMPM , xrefs: 0041AAE7
2, xrefs: 0041AB3B
AMPM, xrefs: 0041AAD8

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Locale$Info$ThreadValid
String ID: AMPM$2$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 233154393-3379564615
Opcode ID: 94823e5df3ed155d42373aeca29090d4622e880d401ed27dd137ea8507bc74b4
Instruction ID: 5b46dc006f98231a26cae34b1307f24b2f5ea33c94de3b4259bcb689306f24a8
Opcode Fuzzy Hash: 94823e5df3ed155d42373aeca29090d4622e880d401ed27dd137ea8507bc74b4
Instruction Fuzzy Hash: C77154347011585BDB01EBA5C841BDE76BAEF48304F50807BF515AB286DB3CDEA2879E

Function 0041B074 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 175threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040514C: GetTickCount.KERNEL32 ref: 00405183
Part of subcall function 0040514C: GetTickCount.KERNEL32 ref: 0040519B

Part of subcall function 0041A7F8: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 0041A816

GetThreadLocale.KERNEL32(00000000,00000004), ref: 0041B10F
EnumCalendarInfoW.KERNEL32(0041AF60,00000000,00000000,00000004), ref: 0041B11A
GetThreadLocale.KERNEL32(00000000,00000003,0041AF60,00000000,00000000,00000004), ref: 0041B14A
EnumCalendarInfoW.KERNEL32(0041AFEC,00000000,00000000,00000003,0041AF60,00000000,00000000,00000004), ref: 0041B155
GetThreadLocale.KERNEL32(00000000,00000004), ref: 0041B1E6
EnumCalendarInfoW.KERNEL32(0041AF60,00000000,00000000,00000004), ref: 0041B1F1
GetThreadLocale.KERNEL32(00000000,00000003,0041AF60,00000000,00000000,00000004), ref: 0041B223
EnumCalendarInfoW.KERNEL32(0041AFEC,00000000,00000000,00000003,0041AF60,00000000,00000000,00000004), ref: 0041B22E

Strings

B.C., xrefs: 0041B194

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: InfoLocale$CalendarEnumThread$CountTick
String ID: B.C.
API String ID: 1601775584-621294921
Opcode ID: bc8247d33fe5370433e2fd6ccc15e77975c242f0979f0cb17630a33c32e31ca2
Instruction ID: d5467c5867d662d48c46f78aef8c8699bdd0855b3e6aaee3d787cd1117f7295e
Opcode Fuzzy Hash: bc8247d33fe5370433e2fd6ccc15e77975c242f0979f0cb17630a33c32e31ca2
Instruction Fuzzy Hash: 2B51F474A016005FD310EB29DC85BAE7766EB49318F14817AF800AB3E2C77E9D55878E

Function 0041B8F4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041B6FC: VirtualQuery.KERNEL32(?,?,0000001C,00000000,0041B8A8), ref: 0041B72F
Part of subcall function 0041B6FC: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0041B753
Part of subcall function 0041B6FC: GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0041B76E
Part of subcall function 0041B6FC: LoadStringW.USER32(00000000,0000FFEA,?,00000100), ref: 0041B809

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,0041BA19), ref: 0041B955
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041B988
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041B99A
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041B9A0
GetStdHandle.KERNEL32(000000F4,0041BA34,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 0041B9B4
WriteFile.KERNEL32(00000000,000000F4,0041BA34,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 0041B9BA
LoadStringW.USER32(00000000,0000FFEB,?,00000040), ref: 0041B9DE
MessageBoxW.USER32(00000000,?,?,00002010), ref: 0041B9F8

Strings

@, xrefs: 0041B9CA

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID: @
API String ID: 135118572-216407459
Opcode ID: 5e5b58603649367f128015842687fb9cd620b316ebe1d037fa3627f5dde79ee1
Instruction ID: f4c401843c9c291ca3b94f10bb34d76506db394776c8f349b425d2b96d247647
Opcode Fuzzy Hash: 5e5b58603649367f128015842687fb9cd620b316ebe1d037fa3627f5dde79ee1
Instruction Fuzzy Hash: A43170B5640204BFE710EB95CC82FDA73ACEB04704F6041BAB644F71D1DAB46E80876D

Function 00431F40 Relevance: 13.7, APIs: 9, Instructions: 169windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00431DDC: EnumDisplayDevicesW.USER32(00000000,00000000,?,00000000), ref: 00431E54

GetDC.USER32(00000000), ref: 00432084
CreateCompatibleDC.GDI32(?), ref: 004320B2
CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 004320C9
SelectObject.GDI32(?,00000000), ref: 004320DE

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: CompatibleCreate$BitmapDevicesDisplayEnumObjectSelect
String ID:
API String ID: 3994296461-0
Opcode ID: cd8d25ca6401adaf94d6438fc56196398246b38be6df3099ab2b650cbc4650d4
Instruction ID: 8dcfbefafd19e944f8a09ce47fb504a4e5e56d55f8274aa27d748321d57cd7eb
Opcode Fuzzy Hash: cd8d25ca6401adaf94d6438fc56196398246b38be6df3099ab2b650cbc4650d4
Instruction Fuzzy Hash: E5612775701A02AFD308DFA9C984BD6F7E8BF4D305F40862AE628C7755D774A821CB85

Function 0042CF20 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 92libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,00000000,0042D072,?,00000000,00000000,00000000,00000000,00000000,00000000,?,0042C75E,00000000,0042CB8F), ref: 0042CF4F

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,00000000), ref: 0040A4F2

Strings

Heefjh}lHgmNl}\myLq]hkelO{fdZ}hjb, xrefs: 0042CF8F
@yAeyHy`'MEE, xrefs: 0042CF3C
Heefjh}lHgmNl}]jyLq]hkelO{fdZ}hjb, xrefs: 0042CF69
Nl}Lq}lgmlm]jy]hkel, xrefs: 0042CFB5
Nl}Lq}lgmlm\my]hkel, xrefs: 0042CFDB
Zl}]jyLg}{p, xrefs: 0042D001

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: AddressProc$LibraryLoadlstrlen
String ID: @yAeyHy`'MEE$Heefjh}lHgmNl}\myLq]hkelO{fdZ}hjb$Heefjh}lHgmNl}]jyLq]hkelO{fdZ}hjb$Nl}Lq}lgmlm\my]hkel$Nl}Lq}lgmlm]jy]hkel$Zl}]jyLg}{p
API String ID: 1729337914-77311109
Opcode ID: 24fcab706ba486010333c345a5a4c1ee916a8591a563e09837591bfc18d52602
Instruction ID: e9226c6078ce630d9dc907993224ef77e34ecd6abfb291ef623e07e235766894
Opcode Fuzzy Hash: 24fcab706ba486010333c345a5a4c1ee916a8591a563e09837591bfc18d52602
Instruction Fuzzy Hash: 5C318571A102009FC780FBADED89A5E37E9EB45318F81493EB441B72A3D77C59148B6D

Function 00404F84 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 00404F9A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00404FA0
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00404FB3
GetLastError.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00404FBC
GetLogicalProcessorInformation.KERNEL32(?,?,00000000,00405030,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00404FE7

Strings

kernel32.dll, xrefs: 00404F95
GetLogicalProcessorInformation, xrefs: 00404F90

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-812649623
Opcode ID: 35201d4d745a74f346a6d86facebae3d15b37a8ffc1e75ce2ae731f58a1f64b0
Instruction ID: 54b7ebe99e7f302da2557309956b5d9292d5a3a304b6d3c4cb150c26000b97f2
Opcode Fuzzy Hash: 35201d4d745a74f346a6d86facebae3d15b37a8ffc1e75ce2ae731f58a1f64b0
Instruction Fuzzy Hash: 8A118471904604AEDF10EBA5CD46B5FB7ACEB44318F2040BBE504B21C2D67D9A80DE5D

Function 00404F82 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 52libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 00404F9A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00404FA0
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00404FB3
GetLastError.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00404FBC
GetLogicalProcessorInformation.KERNEL32(?,?,00000000,00405030,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00404FE7

Strings

kernel32.dll, xrefs: 00404F95
GetLogicalProcessorInformation, xrefs: 00404F90

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-812649623
Opcode ID: bd05037c37d740ab1b4dc7fa39a3e26f1e2793f84830334b598c92dfe34fff13
Instruction ID: 8199570454523d895cc0032b24ada9d2fbf36891f81a90a2ad8e621ecca28dd4
Opcode Fuzzy Hash: bd05037c37d740ab1b4dc7fa39a3e26f1e2793f84830334b598c92dfe34fff13
Instruction Fuzzy Hash: DC016571904604AADF10EBA18D45A5FB7ACEB04318F20407BF504F61C1D67D9A809E5D

Function 00405CB8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?,?,00405E86,00404023,0040406A,00000000,?), ref: 00405CF1
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?,?,00405E86,00404023,0040406A,00000000), ref: 00405CF7
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?), ref: 00405D12
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000), ref: 00405D18
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00405D36

Strings

Runtime error at 00000000, xrefs: 00405CEA, 00405D2F
Error, xrefs: 00405D2A

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 9da2a348520ae705558052009ceb975953c61fbff1b85c89fbedfe3754430604
Instruction ID: 8e6b3ae1d0950b207053b0f6b2d9b368760f02a7951139c7a1ba30855beff3be
Opcode Fuzzy Hash: 9da2a348520ae705558052009ceb975953c61fbff1b85c89fbedfe3754430604
Instruction Fuzzy Hash: CEF096A168578039F710B7A44D0FF5B2248AB85F19F24857FB610B40D2D6FC48D4DA2E

Function 00402E44 Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?), ref: 00402EDA
Sleep.KERNEL32(0000000A,00000000,?), ref: 00402EF4

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: eb1b30fa2819bb7e9c26078b3c9538032f65093cedfba747be72939952c37498
Instruction ID: 3880d568d444d35d86371686d009cb09ec6d1a72a8af32c9c49ca4f9918148e7
Opcode Fuzzy Hash: eb1b30fa2819bb7e9c26078b3c9538032f65093cedfba747be72939952c37498
Instruction Fuzzy Hash: 1471E2716443008FD715DF29CB88B16BBE4AB86314F18817FE488AB3D2D7F89945C79A

Function 0043E080 Relevance: 12.2, APIs: 1, Strings: 7, Instructions: 169sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

Sleep.KERNEL32(000001F4), ref: 0043E2BF

Strings

_:E`}lLqy'lql, xrefs: 0043E1BB
HPHnlg}'hpl, xrefs: 0043E147
HZM\y'lql, xrefs: 0043E221
D\ymh}l;'lql, xrefs: 0043E243
HEPhj'hpl, xrefs: 0043E169
_:E`}l'lql, xrefs: 0043E1DD
HP]hzb'hpl, xrefs: 0043E103

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Sleeplstrlen
String ID: D\ymh}l;'lql$HEPhj'hpl$HPHnlg}'hpl$HP]hzb'hpl$HZM\y'lql$_:E`}l'lql$_:E`}lLqy'lql
API String ID: 404571708-2566769197
Opcode ID: 3e7e9006f540cc56e08598e30fd9b1653691ed4bc20626883697585d71805dc7
Instruction ID: acd5230c7a7213d7fe97c03c0ffc7f1d30c64ff60ca5bdd317cc2c1716e60a4c
Opcode Fuzzy Hash: 3e7e9006f540cc56e08598e30fd9b1653691ed4bc20626883697585d71805dc7
Instruction Fuzzy Hash: A4716134A00248DFDB00DB99C181BCDB7B5EF49308F645096E841BB382C779EE54DBAA

Function 0040303C Relevance: 10.9, APIs: 7, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebb56015c37a3f9fb8dd09f6843bc0f113a4137dadc24ef096fcc9bb47d10006
Instruction ID: d6e953f600fa62a4cb01c07aad8c81ca5a5721795a0ae764ee1700970c6b3899
Opcode Fuzzy Hash: ebb56015c37a3f9fb8dd09f6843bc0f113a4137dadc24ef096fcc9bb47d10006
Instruction Fuzzy Hash: DDC139727102000BD7149E7D9E8932EB7899BC5315F18827FE254EB3D6DABCCD458399

Function 0042C71C Relevance: 10.9, APIs: 4, Strings: 3, Instructions: 365stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000002,00000002,00000000,0042CB8F,?,?,?,?,00000008,00000000,00000000), ref: 0042C7BC
lstrlenW.KERNEL32(00000000,?,00000000,0042CB8F,?,?,?,?,00000008,00000000,00000000), ref: 0042C864
lstrlenW.KERNEL32(00000000,?,00000000,0042CB8F,?,?,?,?,00000008,00000000,00000000), ref: 0042CA7A

Strings

System, xrefs: 0042C815, 0042C822, 0042CA2B, 0042CA38
TCP, xrefs: 0042C87C
UDP, xrefs: 0042CA92

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: lstrlen$HeapProcess
String ID: System$TCP$UDP
API String ID: 3046081391-2438800281
Opcode ID: 88694d2fbdde943c0435eec5de8f80067a2fcd43472a4ab3c4714087f239bddd
Instruction ID: 35f293c671a670b9e6b81fc65c15e8a90b22f42eb6ca05dc6d7e89f087aa4173
Opcode Fuzzy Hash: 88694d2fbdde943c0435eec5de8f80067a2fcd43472a4ab3c4714087f239bddd
Instruction Fuzzy Hash: 57D18F31B40219AFDB00EBA5EC86FAEBBB5AF48704F504466F510F7292D778A905CB58

Function 004038AC Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 285windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,004024F8,00002010), ref: 00403CA0

Strings

\$@, xrefs: 00403A8A, 00403A98
7, xrefs: 00403A24
, xrefs: 00403BD9
$@, xrefs: 00403B58, 00403B66
0$@, xrefs: 00403A06, 00403A18

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Message
String ID: $0$@$7$\$@$$@
API String ID: 2030045667-1228603798
Opcode ID: ac19fcd5adda951769c91ee1a6c17dc81187d7c120c71253a4f0a3854113e247
Instruction ID: e812cd3dc2fef7569f4f822b6a4b970610b3f81895bdd3cedabc248f3003e63a
Opcode Fuzzy Hash: ac19fcd5adda951769c91ee1a6c17dc81187d7c120c71253a4f0a3854113e247
Instruction Fuzzy Hash: 18B1CA30B042548BDB21DF2DC885B997BF8AB4A709F0441FAE449F7382CB785E85CB59

Function 0042E088 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 241stringsleepCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,0042E424,?,?,00000000,00000000), ref: 0042E0BD
lstrlenW.KERNEL32(?,00000000,00000000,0042E424,?,?,00000000,00000000), ref: 0042E0C8
Sleep.KERNEL32(00000001), ref: 0042E263

Part of subcall function 0042DFF8: lstrlenW.KERNEL32(00000000,?,0042E25D), ref: 0042E004

Strings

*.*, xrefs: 0042E2E8
\, xrefs: 0042E391
., xrefs: 0042E32F

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: lstrlen$Sleep
String ID: *.*$.$\
API String ID: 429307061-3468707253
Opcode ID: 9f9bcafb5e9fb64157171f683f2fc74301651e60c6e824bc7875f9f762880367
Instruction ID: 874b38f9c15a16064f5124428c196f5401a35f00216acdfa7908766dcb98f518
Opcode Fuzzy Hash: 9f9bcafb5e9fb64157171f683f2fc74301651e60c6e824bc7875f9f762880367
Instruction Fuzzy Hash: BDA193306002299FDB60EB65EC85B9D77F8EB48304F9145F6E409E32A1DB789E84CF58

Function 0043AFDC Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 163COMMON

Download Yara Rule

Strings

/Update, xrefs: 0043B06E
" ", xrefs: 0043B069, 0043B073
HfH, xrefs: 0043B03A, 0043B0AE, 0043B0FB, 0043B147, 0043B1A5
.exe, xrefs: 0043B000

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: CriticalSection$EnterExistsFileLeavePath
String ID: " "$.exe$/Update$HfH
API String ID: 3310751803-1929450815
Opcode ID: 8181cd79e1e3e5ac8fd14cff0b35ed8bd52b1d0ecc790f0d4226f329b4ffdd8c
Instruction ID: 609c13bec061a5d4637fb112db9b101bfdfe75ff76c94aae5f827595d8871324
Opcode Fuzzy Hash: 8181cd79e1e3e5ac8fd14cff0b35ed8bd52b1d0ecc790f0d4226f329b4ffdd8c
Instruction Fuzzy Hash: 6951A374604205AFDB10EBA9C8A2B9F73E4EB0D344F105066FA10D7391DB7DAD049B99

Function 0043CCA8 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 162libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0043CDCF
LoadLibraryW.KERNEL32(00000000,00000000), ref: 0043CE1C

Strings

XXX_Starting, xrefs: 0043CE3B
*.*, xrefs: 0043CD46
XXX_Plugs\, xrefs: 0043CD0F
XXX_InfoW, xrefs: 0043CE2B

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: HandleLibraryLoadModule
String ID: *.*$XXX_InfoW$XXX_Plugs\$XXX_Starting
API String ID: 4133054770-2785245216
Opcode ID: f71acd30243d42f49c7826a7ce0a7bd6944551d3629e193985cfb457d1c80ab8
Instruction ID: 5c59f4733bd3e6e152ae9da63c784154abf35261a6166e2ebc2e54f53956f2ea
Opcode Fuzzy Hash: f71acd30243d42f49c7826a7ce0a7bd6944551d3629e193985cfb457d1c80ab8
Instruction Fuzzy Hash: 9F518471A056199FCB10EB65DC89A8EB7F5EF48304F1181FBA409F3291DB389E548F58

Function 0042E47C Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 135sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004265F0: htons.WS2_32(?), ref: 00426637
Part of subcall function 004265F0: gethostbyname.WS2_32(00000000), ref: 00426665
Part of subcall function 004265F0: connect.WS2_32(?,00000008,00000010), ref: 00426690
Part of subcall function 004265F0: WSAGetLastError.WS2_32(?,?,00000000,00000000), ref: 004266B9
Part of subcall function 004265F0: Sleep.KERNEL32(00000002,?,?,00000000,00000000), ref: 004266CA

Part of subcall function 004264A8: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 004264C7

Part of subcall function 00426468: setsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 0042647E

Part of subcall function 0042B474: lstrlenW.KERNEL32(00000000,00000000,0042B658,?,?,?,00000001), ref: 0042B4AE

Part of subcall function 0040B948: GetEnvironmentVariableW.KERNEL32(00000000,?,00000208,004866F8,0043D0E3,00000000,0043D13A,?,00486680,00000001,00000000,00000000,?,00437AE2,?,00000000), ref: 0040B95D
Part of subcall function 0040B948: GetLongPathNameW.KERNEL32(?,?,00000208), ref: 0040B972

Sleep.KERNEL32(000001F4,0042E635,?,00000064,00000000,00000000,0042E65B,?,00000000,0042E67D), ref: 0042E61E

Part of subcall function 0042E088: lstrlenW.KERNEL32(00000000,00000000,0042E424,?,?,00000000,00000000), ref: 0042E0BD
Part of subcall function 0042E088: lstrlenW.KERNEL32(?,00000000,00000000,0042E424,?,?,00000000,00000000), ref: 0042E0C8

Strings

:, xrefs: 0042E571
\Temp, xrefs: 0042E557
8[B, xrefs: 0042E49B
WINDIR, xrefs: 0042E545
HfH, xrefs: 0042E4BC
\, xrefs: 0042E577

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: lstrlen$Sleepsetsockopt$EnvironmentErrorLastLongNamePathVariableconnectgethostbynamehtons
String ID: 8[B$:$HfH$WINDIR$\$\Temp
API String ID: 916843999-738507572
Opcode ID: 0f366920236b2224c0a61124d64c3d71f0ecbd4b1a67fa2613579e386c5848ab
Instruction ID: ba3bdb42cb812209f095133bc7201274ca052839750dfdcc6e646bdf85a6b18d
Opcode Fuzzy Hash: 0f366920236b2224c0a61124d64c3d71f0ecbd4b1a67fa2613579e386c5848ab
Instruction Fuzzy Hash: E2515AB4B10610AFD741EFAAEC51A5A37E5FB19308F82847AE400973E1EB789C41CB5C

Function 0040514C Relevance: 10.6, APIs: 7, Instructions: 131threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004053E8: GetCurrentThreadId.KERNEL32 ref: 004053EB

GetTickCount.KERNEL32 ref: 00405183
GetTickCount.KERNEL32 ref: 0040519B
GetCurrentThreadId.KERNEL32 ref: 004051CB
GetTickCount.KERNEL32 ref: 004051F6
GetTickCount.KERNEL32 ref: 0040522D
GetTickCount.KERNEL32 ref: 00405257
GetCurrentThreadId.KERNEL32 ref: 004052C7

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: f9d61921e35b482ef1f14d4eaeacaa075d63589b9816c89e841c04f0b3fb69e2
Instruction ID: e96b3358484ed09efb32f7bf407c562274a0588feb759182786de9b46f441b21
Opcode Fuzzy Hash: f9d61921e35b482ef1f14d4eaeacaa075d63589b9816c89e841c04f0b3fb69e2
Instruction Fuzzy Hash: EF418D30608B419FD721EE78C58431FBAD1EF94354F15897EE8D89B3C1EA7898818F5A

Function 004321E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

,fH, xrefs: 004321E7

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID:
String ID: ,fH
API String ID: 0-2243322645
Opcode ID: 1d201e2f3158f48b80e96ba174cdfec9ebc3d6a068077817cc3a2737f294f5eb
Instruction ID: 3e325106465cb2dd41976618392b57abfc7347bc5e4f7f75e8d06feff1e239a5
Opcode Fuzzy Hash: 1d201e2f3158f48b80e96ba174cdfec9ebc3d6a068077817cc3a2737f294f5eb
Instruction Fuzzy Hash: A7414D357052409FDB01DF99C9C0FE737A4AB0A750F1801BAFE499F68AC3A898418B76

Function 0040BC54 Relevance: 9.1, APIs: 6, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040BC87
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,40000000,00000000), ref: 0040BCB8
HttpQueryInfoW.WININET(00000000,20000005,?,00000004,?), ref: 0040BCFA
InternetCloseHandle.WININET(00000000), ref: 0040BD8F

Part of subcall function 0040B634: VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004,00428AA0,?,?,00486734,00486680,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B63E

InternetReadFile.WININET(00000000,?,?,?), ref: 0040BD2F

Part of subcall function 0040B644: VirtualFree.KERNEL32(00000000,00000000,00008000,00428B66,?,?,00486734,00486680,00000000,00000000,00000000,00000000,00000000,00000000,?,00437E88), ref: 0040B64C

InternetCloseHandle.WININET(00000000), ref: 0040BDAE

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Internet$CloseHandleOpenVirtual$AllocFileFreeHttpInfoQueryRead
String ID:
API String ID: 436716311-0
Opcode ID: 3e7517a180f2519e9ef8862004f9ea7d21659a34cfeb77de3d18cea408e80831
Instruction ID: 2d81d751fc6afc2710d3bfc5214d13ec27d882b95dc00282e94316269f0eb743
Opcode Fuzzy Hash: 3e7517a180f2519e9ef8862004f9ea7d21659a34cfeb77de3d18cea408e80831
Instruction Fuzzy Hash: 90417975A04208AFDB11DFA4DC95BAEB7B8EB49700F114476F505E3290DB389900CB68

Function 00402AC0 Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,FFFFFFDC,00402A8C), ref: 00402B77
Sleep.KERNEL32(0000000A,00000000,FFFFFFDC,00402A8C), ref: 00402B8D
Sleep.KERNEL32(00000000,?,?,FFFFFFDC,00402A8C), ref: 00402BBB
Sleep.KERNEL32(0000000A,00000000,?,?,FFFFFFDC,00402A8C), ref: 00402BD1

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 00e817329ed30a61a1e3ce9785030074bf56165d3748735972e8587115fb55d2
Instruction ID: e9b8b7081cf30ab9f8610f5ddeb7dffbd4721761cd41d76955e75723a6189a5d
Opcode Fuzzy Hash: 00e817329ed30a61a1e3ce9785030074bf56165d3748735972e8587115fb55d2
Instruction Fuzzy Hash: 89C149766013108FDB19CF29DB88316BBE0AB86314F18827FD444AB3D5C7B8D955CB9A

Function 004038AA Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 207COMMON

Download Yara Rule

Strings

\$@, xrefs: 00403A8A, 00403A98
7, xrefs: 00403A24
, xrefs: 00403BD9
0$@, xrefs: 00403A06, 00403A18

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID:
String ID: $0$@$7$\$@
API String ID: 0-4266993835
Opcode ID: 0898838d16f207543cc06ffe88efb152eba2014c6d30357a487cafd616e18d10
Instruction ID: b3e4678ffb9dae527c939fda3aba35b48a12a95a819a0055bfac3d4281ef8523
Opcode Fuzzy Hash: 0898838d16f207543cc06ffe88efb152eba2014c6d30357a487cafd616e18d10
Instruction Fuzzy Hash: 1881C730B042548FDB21DF2DC885B99BBF8AB4A709F0441F6E049F7382DB785A85CB59

Function 0041B6FC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,0041B8A8), ref: 0041B72F
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0041B753
GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0041B76E
LoadStringW.USER32(00000000,0000FFEA,?,00000100), ref: 0041B809

Strings

MZP, xrefs: 0041B76D

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: MZP
API String ID: 3990497365-2889622443
Opcode ID: 33485dccd570a2a0afe39b740a752237986253bc9c59ef7515bff66579f2bf26
Instruction ID: c27a278696c1af428c112a5138f6c708912e0e629acd6ed950e1bdc93ff39661
Opcode Fuzzy Hash: 33485dccd570a2a0afe39b740a752237986253bc9c59ef7515bff66579f2bf26
Instruction Fuzzy Hash: 19411F70A002589FDB20EF65CC81BCAB7B9EB88314F0040FAE508E7281D7799E95CF59

Function 0042C13C Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 105windowCOMMON

Download Yara Rule

APIs

GetWindowTextW.USER32(?,00485D2C,00000200), ref: 0042C179

Part of subcall function 00428094: IsWow64Process.KERNEL32(00000000,?,?,00000000,00428168), ref: 00428115

IsWindowVisible.USER32(?), ref: 0042C239

Strings

,]H, xrefs: 0042C1B7
,_H, xrefs: 0042C1E9
(]H, xrefs: 0042C254

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Window$ProcessTextVisibleWow64
String ID: (]H$,]H$,_H
API String ID: 855330406-2296990632
Opcode ID: 8494e179cabbb1639a2a86b9c0db99363ec066141d2bbb155df1d5a4e22ab67b
Instruction ID: d95932ed8a37d93c08fe9a1a55fadeb8aae1f262f1f2142a84b6d5f9324e449e
Opcode Fuzzy Hash: 8494e179cabbb1639a2a86b9c0db99363ec066141d2bbb155df1d5a4e22ab67b
Instruction Fuzzy Hash: 7C319D31B00214AFEB01EBA1DC82EAE77B5EF48704F518477B50172191CA7D9D15972C

Function 0042BD88 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72registryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00465CA0,0042C023,?,00000064,00000000,00000000,0042C0D8), ref: 0042BDB6
RegisterClassW.USER32(00465CD8), ref: 0042BDC6
ShowWindow.USER32(00000000,00000001,00000000,00000000,00000000,00000000,0000015E,000001F4,00000000,00000000,100F0080), ref: 0042BE64
SetForegroundWindow.USER32(00000000), ref: 0042BE6F

Strings

RAT_Chat, xrefs: 0042BD9F, 0042BE36

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Window$ClassForegroundHandleModuleRegisterShow
String ID: RAT_Chat
API String ID: 3776541383-1508558188
Opcode ID: 3da53fab4287da6ac28a1f121945f4a6c5748e60b917b128f9c393c7511c022f
Instruction ID: e3e0ff72afeb0ca95b62b861ee8d58a389ac77bdb3e2b56e9a420627b55a5118
Opcode Fuzzy Hash: 3da53fab4287da6ac28a1f121945f4a6c5748e60b917b128f9c393c7511c022f
Instruction Fuzzy Hash: DA211D75740B109BE710DF68EC45BA633E4EB04708F94853AF644DB3D1EBB9A804878E

Function 0040E83C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

GetUserObjectInformationW.USER32(00000000,00000002,?,00000100,?,?,004328AD,?,00000000,0043294A), ref: 0040E886
OpenWindowStationW.USER32(winsta0,00000000,0000037F), ref: 0040E8A8
SetProcessWindowStation.USER32(00000000,?,004328AD,?,00000000,0043294A), ref: 0040E8B4
OpenDesktopW.USER32(?,00000000,00000000,000001FF), ref: 0040E8CB

Strings

winsta0, xrefs: 0040E8A3

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: OpenStationWindow$DesktopInformationObjectProcessUser
String ID: winsta0
API String ID: 3539518509-3440837585
Opcode ID: 159005afdda627ef5a1ff0f0402107ecf24fb7b8575005aeb33b992befac07c1
Instruction ID: 07935d2aa83b5d675ff6c58e78f2920d5cf53bccb1719f4e7f0ccf1e20ed6600
Opcode Fuzzy Hash: 159005afdda627ef5a1ff0f0402107ecf24fb7b8575005aeb33b992befac07c1
Instruction Fuzzy Hash: 5C1124752443016FE310EBA9DC81F6B73EC6B45700F44483AB984EB3D1DAB9ED14972A

Function 0040BA5C Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000,00000000,?,0043F7E0), ref: 0040BA70
FindResourceW.KERNEL32(00000000,00000000,0000000A,00000000,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000), ref: 0040BA82
LoadResource.KERNEL32(00000000,00000000,00000000,0040BAD8,?,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680), ref: 0040BAA4
LockResource.KERNEL32(00000000,?,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000,00000000), ref: 0040BAB1
FreeResource.KERNEL32(00000000,0040BADF,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000,00000000,?,0043F7E0,00000000), ref: 0040BAD1

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Resource$FindFreeHandleLoadLockModule
String ID:
API String ID: 2355082082-0
Opcode ID: 3f0eb233740970fe425e4189b138455d4fb9001c1d9e8dd3634329448ef4e4b8
Instruction ID: 1a3ff52bf1ac6d4834992fad00352ded9c14d174eaf5e093c7de7b05a94e74d9
Opcode Fuzzy Hash: 3f0eb233740970fe425e4189b138455d4fb9001c1d9e8dd3634329448ef4e4b8
Instruction Fuzzy Hash: 3101F776B41304BFE701ABB9AC85B2ABBECDB89715F150436F506E3281DA799D00866C

Function 00426F90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,0042716D), ref: 00426FCA
CharUpperW.USER32(?,00000000,00000000,0042716D), ref: 00426FEE

Strings

|/Is\|, xrefs: 00426FD7, 004270C9, 0042711F
:, xrefs: 00427001

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: CharUpperlstrlen
String ID: :$|/Is\|
API String ID: 108730823-2327451341
Opcode ID: ba4b3e01cebbaa481af6e6a77b06f47b08762847adc1fc8c6b2a5010666fc814
Instruction ID: 93d54500de09d398291ab5124b2714aa455b2298479d6696639ba076840c05b2
Opcode Fuzzy Hash: ba4b3e01cebbaa481af6e6a77b06f47b08762847adc1fc8c6b2a5010666fc814
Instruction Fuzzy Hash: 24514934A041299BDB00EF99D841AEEBBB5FF48304F51807BF405B3351D7799A25CBA9

Function 00405D48 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00405D81
FreeLibrary.KERNEL32(00400000,?,00000000,?,?,00405E86,00404023,0040406A,00000000,?,00404083,?,?,?,?,00486734), ref: 00405E22
ExitProcess.KERNEL32(00000000,?,00000000,?,?,00405E86,00404023,0040406A,00000000,?,00404083,?,?,?,?,00486734), ref: 00405E5E

Part of subcall function 00405CB8: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?,?,00405E86,00404023,0040406A,00000000,?), ref: 00405CF1
Part of subcall function 00405CB8: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?,?,00405E86,00404023,0040406A,00000000), ref: 00405CF7
Part of subcall function 00405CB8: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?), ref: 00405D12
Part of subcall function 00405CB8: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000), ref: 00405D18

Strings

MZP, xrefs: 00405E21

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: MZP
API String ID: 3490077880-2889622443
Opcode ID: d90ee3a893a0dc72c3848248a1873dcb725225a210599cc20fd1a5d12a6e168f
Instruction ID: e92a30f647e059f84c3662a5853805e55c155ad4ddc6fc357ea8e0081ace97c3
Opcode Fuzzy Hash: d90ee3a893a0dc72c3848248a1873dcb725225a210599cc20fd1a5d12a6e168f
Instruction Fuzzy Hash: 62315C34601B418BE761ABB9A48935B76E0EF45318F14483FE581A72D2D77CA884CF5E

Function 00405D50 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00405D81
FreeLibrary.KERNEL32(00400000,?,00000000,?,?,00405E86,00404023,0040406A,00000000,?,00404083,?,?,?,?,00486734), ref: 00405E22
ExitProcess.KERNEL32(00000000,?,00000000,?,?,00405E86,00404023,0040406A,00000000,?,00404083,?,?,?,?,00486734), ref: 00405E5E

Part of subcall function 00405CB8: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?,?,00405E86,00404023,0040406A,00000000,?), ref: 00405CF1
Part of subcall function 00405CB8: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?,?,00405E86,00404023,0040406A,00000000), ref: 00405CF7
Part of subcall function 00405CB8: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?), ref: 00405D12
Part of subcall function 00405CB8: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000), ref: 00405D18

Strings

MZP, xrefs: 00405E21

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: MZP
API String ID: 3490077880-2889622443
Opcode ID: 476567bd706faa08b2860b4bdb782b6af1774b5e27a4e3545c261a0e26a7b744
Instruction ID: b38e6e20968f9dd51013dd86da7a5adcd4d42222583a8947ff30ec8df154a19c
Opcode Fuzzy Hash: 476567bd706faa08b2860b4bdb782b6af1774b5e27a4e3545c261a0e26a7b744
Instruction Fuzzy Hash: 7E316D34600B418BE760AB69E48971B76E4EF45318F14443FE580A73D2D77CA884CF5D

Function 0040B5E8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Not Config,0040B610,?), ref: 0040B5FB
MessageBoxW.USER32(00000000,Not Config,GGT,?), ref: 0040B606

Strings

Not Config, xrefs: 0040B5F9, 0040B604
GGT, xrefs: 0040B603

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Message
String ID: GGT$Not Config
API String ID: 2030045667-3135470170
Opcode ID: 4b8a4c59b1f7a2e123fa8cac472319ef520fd058445deb380fb68a97e84f0c4a
Instruction ID: 09803daf9443879b7dc9e8754dbd7872eb60d7eb9ad1f4574c2174cc229b4f7d
Opcode Fuzzy Hash: 4b8a4c59b1f7a2e123fa8cac472319ef520fd058445deb380fb68a97e84f0c4a
Instruction Fuzzy Hash: 0FD0A9A112432875D4202A130C02DB32A2CCC917A03088C3BB90472182863BAC2040FF

Function 00439284 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0048664C,00000000,00439427,?,?,?,?,00000000,00000000), ref: 004392B4
lstrlenW.KERNEL32(00000000,?,00439448,?,00439448,?,00439448,?,?,0048664C,00000000,00439427), ref: 00439396
LeaveCriticalSection.KERNEL32(0048664C,00439404,00439427,?,?,?,?,00000000,00000000), ref: 004393F7

Strings

4gH, xrefs: 004392E0

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: CriticalSection$EnterLeavelstrlen
String ID: 4gH
API String ID: 3224049430-2392367260
Opcode ID: 47defe703287ea594ae1c07abb13b2d47f8dddb316f1a99fff683f0de99b3499
Instruction ID: 4ccfdad5408f303f1bc6ef96d1109fe59f5890f2a7af6574d1485d49e1ed1b7c
Opcode Fuzzy Hash: 47defe703287ea594ae1c07abb13b2d47f8dddb316f1a99fff683f0de99b3499
Instruction Fuzzy Hash: 9541A031604208AFDB01EBA5CC42F9E77F8EB4D714F614076F500F72D1DAB9AE119A69

Function 0042BA24 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0042BA43
SendMessageW.USER32(00000000,0000000D,?,00465D1C), ref: 0042BA86
SetWindowTextW.USER32(00000000,00000000), ref: 0042BACA
SetFocus.USER32(00000000,00000000,00000000,?,00000000,0000000E,00000000,00000000,00000000,0042BAF0,?,00000000), ref: 0042BAD5

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: MessageSend$FocusTextWindow
String ID:
API String ID: 2333564098-0
Opcode ID: 14eaf776a827c111dba999793b4b2e13d356559fd8bd16515faad1c53ea696ad
Instruction ID: c5c6d1f71d7d5abd3f140a9d873e570a62db933a69622a8a51123b3dec96c00d
Opcode Fuzzy Hash: 14eaf776a827c111dba999793b4b2e13d356559fd8bd16515faad1c53ea696ad
Instruction Fuzzy Hash: 97112E74640704ABD710EB55FC5AB5A73F8E748704FA0883AF5009B2E1D7F9A950875D

Function 00409428 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 004094F7
LocalFree.KERNEL32(0059E840,00000000), ref: 00409511

Strings

@Y, xrefs: 0040944B

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Free$LibraryLocal
String ID: @Y
API String ID: 3007483513-2635300530
Opcode ID: f1440c9207516d799bff01a95fb1b780083962cb9caf534dbe967da67f6cd1a4
Instruction ID: 794add6f56abb578411f7ef61ae6dacc1c24b6d74e6f65c8e1d29d9f289a045b
Opcode Fuzzy Hash: f1440c9207516d799bff01a95fb1b780083962cb9caf534dbe967da67f6cd1a4
Instruction Fuzzy Hash: 4731A472900105ABCB14DFA6D8C19BFB3B8AF84314B14453EE904B7382DB39DD41CBA8

Function 0040B29C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 0040B948: GetEnvironmentVariableW.KERNEL32(00000000,?,00000208,004866F8,0043D0E3,00000000,0043D13A,?,00486680,00000001,00000000,00000000,?,00437AE2,?,00000000), ref: 0040B95D
Part of subcall function 0040B948: GetLongPathNameW.KERNEL32(?,?,00000208), ref: 0040B972

Part of subcall function 0040ACA4: lstrlenW.KERNEL32(00000000,?,?,00486730,?), ref: 0040ACDD

PathFileExistsW.SHLWAPI(00000000,?,?,00000000,00000000,Temp,?,00000000,0040B377,?,?,00486680,00000000,00000000,00000000,00000000), ref: 0040B31D

Strings

Temp, xrefs: 0040B2C0
Temp, xrefs: 0040B2E0, 0040B329

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Path$EnvironmentExistsFileLongNameVariablelstrlen
String ID: Temp$Temp
API String ID: 2856746939-245102275
Opcode ID: fc830c92589ad5342fd4e66cf01ed2c17b86b29a44920e7f029c1e3a9a43f651
Instruction ID: 46c15489f3eb44522c785d134b2f827a4a98169e1fe77a71831a75c28b8f49eb
Opcode Fuzzy Hash: fc830c92589ad5342fd4e66cf01ed2c17b86b29a44920e7f029c1e3a9a43f651
Instruction Fuzzy Hash: 46215A70A00119AFDB01EBA1CC52DBFB7B9EF84304B61C47BB941B3690D77C9D1196A8

Function 0040B3B8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 0040B948: GetEnvironmentVariableW.KERNEL32(00000000,?,00000208,004866F8,0043D0E3,00000000,0043D13A,?,00486680,00000001,00000000,00000000,?,00437AE2,?,00000000), ref: 0040B95D
Part of subcall function 0040B948: GetLongPathNameW.KERNEL32(?,?,00000208), ref: 0040B972

Part of subcall function 0040ACA4: lstrlenW.KERNEL32(00000000,?,?,00486730,?), ref: 0040ACDD

PathFileExistsW.SHLWAPI(00000000,?,?,00000000,00000000,Temp,?,00000000,0040B498,?,?,00486680,00000000,00000000,00000000,00000000), ref: 0040B43E

Strings

Temp, xrefs: 0040B3E1
Temp, xrefs: 0040B401, 0040B44A

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: Path$EnvironmentExistsFileLongNameVariablelstrlen
String ID: Temp$Temp
API String ID: 2856746939-245102275
Opcode ID: 7237d7c97321785c44f2b4371a02576726028b20681e666b8d51949dfb1120e9
Instruction ID: 320bcaab7f7199f54f19ef5aa5192f16669c5e948fce9d3d7dddb2f051f29b96
Opcode Fuzzy Hash: 7237d7c97321785c44f2b4371a02576726028b20681e666b8d51949dfb1120e9
Instruction Fuzzy Hash: 46215D70A001196FDB01EBA1CC51D6FB7B9EF84704F21C477B501B3295D77C9A1596A8

Function 0042743C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,00000000,004274B0,?,?,00486680,00000000,00000000,?,0043F226,?,00486734,00486680,00000000,00000000,00000000), ref: 00427469

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Strings

zalee:;'MEE, xrefs: 00427456
ZAO`elFyl{h}`fg^, xrefs: 00427477

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: AddressLibraryLoadProclstrlen
String ID: ZAO`elFyl{h}`fg^$zalee:;'MEE
API String ID: 2991167014-1447228337
Opcode ID: c820523d15c9dbf95b80c6cde00e35f83b407bfca9d4687b59677f06df80f873
Instruction ID: 077bc46651e9a40de25fcd03cddb1c768f49804e1acef1ba0aff0074e990fe41
Opcode Fuzzy Hash: c820523d15c9dbf95b80c6cde00e35f83b407bfca9d4687b59677f06df80f873
Instruction Fuzzy Hash: FAF0C231605718ABD711FBA1DC02B5DBBACEF45718FD2407AF800B7681D67CAE1046AD

Function 004303EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0043042A

Strings

#32770, xrefs: 004303F4
Button, xrefs: 0043040B

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: MessagePost
String ID: #32770$Button
API String ID: 410705778-3763930512
Opcode ID: 80110679f937891faa6f7cba931e5fed77503df53b31854cfd618e18af252cd2
Instruction ID: 28ed841a6425ce2d44e84357510c75fb6cb91fbfeaac2ff36796f76db45616d3
Opcode Fuzzy Hash: 80110679f937891faa6f7cba931e5fed77503df53b31854cfd618e18af252cd2
Instruction Fuzzy Hash: F3E086743C13026FE62097588CE6F1A63A85739B04F246176B700FB2E0CEE8EE14D61C

Function 0040B4DC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00486680,0043F20A,00000001,00000000,?,00486734,00486680,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B4E5

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Strings

kernel32.dll, xrefs: 0040B4E0
Wow64DisableWow64FsRedirection, xrefs: 0040B4EC

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 1646373207-3689287502
Opcode ID: 2dac5d5c5663db8a0450eab5fd166fe870256cbb9f231f614ab9bd4640426b9f
Instruction ID: 2aacd0a7d080d4f8486dfed4c2e02e9ea53df2493b021d7d88a6b83d7c6298d6
Opcode Fuzzy Hash: 2dac5d5c5663db8a0450eab5fd166fe870256cbb9f231f614ab9bd4640426b9f
Instruction Fuzzy Hash: 26C0129231272439E50071F91CC6EF7028CC9453AE31004B3F900F11C2E7AC4D2011EE

Function 0040B564 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00486680,0043F3D6,00000000,?,00486734,00486680,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B56D

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Strings

Wow64RevertWow64FsRedirection, xrefs: 0040B574
kernel32.dll, xrefs: 0040B568

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 1646373207-1355242751
Opcode ID: 95d41de4b2aaa3d5bceb4c6ece1da09edf5c32e92841572d0be30113edd33b41
Instruction ID: 8249db6378fdea734a8c5b5c79ccac93c87cf519fdf57918cf521f3dbb983d50
Opcode Fuzzy Hash: 95d41de4b2aaa3d5bceb4c6ece1da09edf5c32e92841572d0be30113edd33b41
Instruction Fuzzy Hash: 5CC002963563243DE65172F51CC69EB528CC9557AE36408B7FD00F11C3E7AD4D2111ED

Function 0043E4A4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,00000000,00000000,00000000,0043E626), ref: 0043E4B0

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Strings

NtUnmapViewOfSection, xrefs: 0043E4B7
ntdll.dll, xrefs: 0043E4AB

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 2574300362-1050664331
Opcode ID: 31b82d30f3ad7dba5dbea5cdbf4706ed8ff0013fde9a1af21a2c0f08b4647315
Instruction ID: 4e69b6650e6ade436c82b191c502fd32af055e20bfb3fd8e8d0f99f71a318bac
Opcode Fuzzy Hash: 31b82d30f3ad7dba5dbea5cdbf4706ed8ff0013fde9a1af21a2c0f08b4647315
Instruction Fuzzy Hash: 05C012523036103A911031E71C86D6B454CCCEAAB53105037B514E2182D4AC4C114179

Function 0041D238 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00443377,00000000,004433AE), ref: 0041D23E

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Strings

kernel32.dll, xrefs: 0041D239
GetDiskFreeSpaceExW, xrefs: 0041D249

Memory Dump Source

Source File: 00000009.00000002.2959104302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2959104302.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000464000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2959104302.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TASLogin.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: a79e509d4b5e1b93e5af0388efdb664cba8b92b54a70f921204110405e308a7a
Instruction ID: 1ed0fb5f9b62a531acb68cd7a06d8274aa2f261e9248045f22735aa701152202
Opcode Fuzzy Hash: a79e509d4b5e1b93e5af0388efdb664cba8b92b54a70f921204110405e308a7a
Instruction Fuzzy Hash: 80D0A9F8E423604ED700EBE09DC6B823798879A308F0000BBB02057283CBBCC89C820C

Analysis Process: TASLogin.exePID: 3384, Parent PID: 1620COMMON

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	30

Executed Functions

Function 004087CC Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,0040888C,?,?), ref: 004087FE
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,0040888C,?,?), ref: 00408807

Part of subcall function 00408694: FindFirstFileW.KERNEL32(00000000,?,00000000,004086F2,?,00000001), ref: 004086C7
Part of subcall function 00408694: FindClose.KERNEL32(00000000,00000000,?,00000000,004086F2,?,00000001), ref: 004086D7

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: 71a8562c1639e1ddf01ead51905ade836cb6af30f3703f921b60b101e48ef570
Instruction ID: 27674f643491317e8211ebe2d51140b4d1dfb9d7c3ccf30eb47042a46c7f6e4d
Opcode Fuzzy Hash: 71a8562c1639e1ddf01ead51905ade836cb6af30f3703f921b60b101e48ef570
Instruction Fuzzy Hash: 67116070A001099FDB04FBA6D982AAEB3B8EF44304F51847FF945B32C1DB785E148A69

Function 00408694 Relevance: 3.0, APIs: 2, Instructions: 33
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,004086F2,?,00000001), ref: 004086C7
FindClose.KERNEL32(00000000,00000000,?,00000000,004086F2,?,00000001), ref: 004086D7

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: d5e053f3a7f238d708fda4e07e630be6dcb5cbe159ac088ae637e70b0fe2281d
Instruction ID: 4a504121526f8a262ed7674ff1de7294a9ef20f3b8a82b9cde2a0df277819a23
Opcode Fuzzy Hash: d5e053f3a7f238d708fda4e07e630be6dcb5cbe159ac088ae637e70b0fe2281d
Instruction Fuzzy Hash: 39F0E271500308AFC710FBB5CE1298EB7ECEB48314BA248BBB404F26C2EA3D9E10951C

Function 0040BDE8 Relevance: 220.0, APIs: 8, Strings: 117, Instructions: 1214
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(00000000,00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000,?,0043F7AA,00000000,0043FD8B,?,?,00486664), ref: 0040C220
LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000,?,0043F7AA,00000000,0043FD8B), ref: 0040C26E
LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000,?,0043F7AA,00000000,0043FD8B), ref: 0040CC32
LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000,?,0043F7AA,00000000,0043FD8B), ref: 0040CE58
LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000,?,0043F7AA,00000000), ref: 0040CEA6
LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000,?,0043F7AA), ref: 0040D030
LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000), ref: 0040D0CC
LoadLibraryW.KERNEL32(00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000,?,0043F7AA,00000000,0043FD8B,?,?,00486664,00000000), ref: 0040BE1D

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,00000000), ref: 0040A4F2

Strings

O`gm^`gmf~^, xrefs: 0040BEB3
Zl}Zpz}ldJ|{zf{, xrefs: 0040BF16
FylgD|}lq^, xrefs: 0040C985
@g}l{gl}Zl}Fy}`fg^, xrefs: 0040CFF3
Fylg@gy|}Mlzb}fy, xrefs: 0040C081
bl{gle:;'MEE, xrefs: 0040C258
J{lh}lO`el^, xrefs: 0040C3E2
[lnJ{lh}lBlp^, xrefs: 0040CDCD
Nl}O`elZ`sl, xrefs: 0040C430
Nl}J|{{lg}Y{fjlzz, xrefs: 0040C7D8
Nl}Dlzzhnl^, xrefs: 0040BF58
@g}l{gl}Nl}Jfgglj}lmZ}h}l, xrefs: 0040CEBB
^h`}Of{Z`gnelFkclj}, xrefs: 0040C8E9
O`gmO`{z}O`el^, xrefs: 0040CB59
@g}l{gl}Nl}Jffb`l^, xrefs: 0040CFCC
JefzlMlzb}fy, xrefs: 0040C0C3
_`{}|heHeefjLq, xrefs: 0040C2D1
Zpz}ldYh{hdl}l{z@gof^, xrefs: 0040BF37
^{`}lO`el, xrefs: 0040C457
J{lh}lM`{lj}f{p^, xrefs: 0040C62B
~`g`gl}'MEE, xrefs: 0040CE90
[lelhzlMJ, xrefs: 0040C189
zae~hy`'MEE, xrefs: 0040D01A
[lnMlel}l_he|l^, xrefs: 0040CE1B
Nl}Je`ykfh{mMh}h, xrefs: 0040C147
Zl}O`elH}}{`k|}lz^, xrefs: 0040C910
\gdhy_`l~FoO`el, xrefs: 0040C51A
]l{d`gh}lY{fjlzz, xrefs: 0040C652
Nl}Y{fjlzz]`dlz, xrefs: 0040C826
Zl}]a{lhmJfg}lq}, xrefs: 0040C36D
Zl}J|{zf{Yfz, xrefs: 0040BFBB
Z}{JdyG@^, xrefs: 0040D068
FylgY{fjlzz]fblg, xrefs: 0040CC6E
YllbGhdlmY`yl, xrefs: 0040C763
\[EDFG'MEE, xrefs: 0040C20D
Nl}BlpZ}h}l, xrefs: 0040C1EC
FylgJe`ykfh{m, xrefs: 0040C126
@g}l{gl}Fylg\{e^, xrefs: 0040CF09
[lnFylgBlp^, xrefs: 0040CCE3
^{`}lY{fjlzzDldf{p, xrefs: 0040C346
A}}yX|l{p@gof^, xrefs: 0040CF30
Jefzl^`gmf~, xrefs: 0040BE50
Nl}^`gmf~]a{lhmY{fjlzz@m, xrefs: 0040C0E4
]{hgzeh}lDlzzhnl, xrefs: 0040BF79
Efhm[lzf|{jl, xrefs: 0040CA6F
NefkheDldf{pZ}h}|z, xrefs: 0040C6A0
Nl}_l{z`fgLq^, xrefs: 0040C6C7
ez}{jyp^, xrefs: 0040CBF5
\[EMf~gefhm]fO`el^, xrefs: 0040C231
|zl{:;'MEE, xrefs: 0040BE0A
Nl}Mlzb}fy^`gmf~, xrefs: 0040C105
@g}l{gl}JefzlAhgmel, xrefs: 0040CF7E
ZANl}Zylj`heOfeml{Efjh}`fg, xrefs: 0040D104
[lz|dl]a{lhm, xrefs: 0040C394
JefzlAhgmel, xrefs: 0040C4A5
M`zyh}jaDlzzhnl^, xrefs: 0040BF9A
Nl}Zpz}ldDl}{`jz, xrefs: 0040C1AA
FylgY{fjlzz, xrefs: 0040C283
Nl}]a{lhmJfg}lq}, xrefs: 0040C2F8
Oehza^`gmf~, xrefs: 0040BE92
Efjb[lzf|{jl, xrefs: 0040CA96
Nl}]`jbJf|g}, xrefs: 0040C3BB
Mlel}lO`el^, xrefs: 0040C604
]l{d`gh}l]a{lhm, xrefs: 0040C679
[lhmY{fjlzzDldf{p, xrefs: 0040C31F
J{lh}lO`elDhyy`gn^, xrefs: 0040C4CC
Nl}Zpz}ld]`dlHzO`el]`dl, xrefs: 0040C7FF
Dhy_`l~FoO`el, xrefs: 0040C4F3
J{lh}l]a{lhm, xrefs: 0040C9FA
[lnZl}_he|lLq^, xrefs: 0040CDA6
Zl}L{{f{Dfml, xrefs: 0040CB0B
Lg|d^`gmf~z, xrefs: 0040C060
Nl}Dfm|elO`elGhdl^, xrefs: 0040C78A
[lnX|l{p_he|lLq^, xrefs: 0040CD7F
Nl}\zl{Ghdl^, xrefs: 0040CC47
[lnMlel}lBlp^, xrefs: 0040CDF4
[lhmO`el, xrefs: 0040C47E
JfypO`el^, xrefs: 0040C58F
Zl}]a{lhmMlzb}fy, xrefs: 0040C0A2
Nl}M`zbO{llZyhjlLq^, xrefs: 0040CB32
@g}l{gl}[lhmO`el, xrefs: 0040CF57
ZaleeLqlj|}l^, xrefs: 0040D0DD
O`el]`dl]fZpz}ld]`dl, xrefs: 0040C84D
@yAeyHy`'MEE, xrefs: 0040CE42
O`gm^`gmf~Lq^, xrefs: 0040BED4
Lq`}Y{fjlzz, xrefs: 0040C9D3
Nl}Hmhy}l{z@gof, xrefs: 0040CE69
O`gmJefzl, xrefs: 0040CBA7
@g}l{gl}Fylg^, xrefs: 0040CEE2
[lnJefzlBlp, xrefs: 0040CD0A
[lnLg|d_he|l^, xrefs: 0040CD58
J{lh}lY`yl, xrefs: 0040C73C
Kefjb@gy|}, xrefs: 0040BEF5
[lnLg|dBlp^, xrefs: 0040CD31
O`el]`dl]fEfjheO`el]`dl, xrefs: 0040C874
Nl}Jfdy|}l{Ghdl^, xrefs: 0040CBCE
O`gm[lzf|{jl^, xrefs: 0040CA48
J{lh}lD|}lq^, xrefs: 0040C95E
J{lh}lY{fjlzz^, xrefs: 0040C2AA
Zl}O`elYf`g}l{, xrefs: 0040C409
[lelhzlD|}lq, xrefs: 0040C9AC
Yh}aO`elLq`z}z^, xrefs: 0040D041
@g}l{gl}Zl}Jffb`l^, xrefs: 0040CFA5
Nl}J|{{lg}Y{fjlzz@m, xrefs: 0040C7B1
zalee:;'MEE, xrefs: 0040D0B6
Nl}HzpgjBlpZ}h}l, xrefs: 0040C1CB
Nl}EfgnYh}aGhdl^, xrefs: 0040C715
Nl}_fe|dl@gof{dh}`fg^, xrefs: 0040C937
O{ll[lzf|{jl, xrefs: 0040CABD
Yh}a@zM`{lj}f{p^, xrefs: 0040D08F
Dhy_`{}|heBlp^, xrefs: 0040C01E
^`gLqlj, xrefs: 0040CA21
JefzlJe`ykfh{m, xrefs: 0040C168
O`gmGlq}O`el^, xrefs: 0040CB80
ZANl}Yh}aO{fd@ME`z}^, xrefs: 0040D12B
Nl}JehzzGhdl^, xrefs: 0040BE2F
Lq`}^`gmf~zLq, xrefs: 0040C03F

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: LibraryLoad$AddressProc$lstrlen
String ID: @g}l{gl}Fylg\{e^$@g}l{gl}Fylg^$@g}l{gl}JefzlAhgmel$@g}l{gl}Nl}Jffb`l^$@g}l{gl}Nl}Jfgglj}lmZ}h}l$@g}l{gl}Zl}Fy}`fg^$@g}l{gl}Zl}Jffb`l^$@g}l{gl}[lhmO`el$@yAeyHy`'MEE$A}}yX|l{p@gof^$Dhy_`l~FoO`el$Dhy_`{}|heBlp^$Efhm[lzf|{jl$Efjb[lzf|{jl$Fylg@gy|}Mlzb}fy$FylgD|}lq^$FylgJe`ykfh{m$FylgY{fjlzz$FylgY{fjlzz]fblg$JefzlAhgmel$JefzlJe`ykfh{m$JefzlMlzb}fy$Jefzl^`gmf~$JfypO`el^$J{lh}lD|}lq^$J{lh}lM`{lj}f{p^$J{lh}lO`elDhyy`gn^$J{lh}lO`el^$J{lh}lY`yl$J{lh}lY{fjlzz^$J{lh}l]a{lhm$Kefjb@gy|}$Lg|d^`gmf~z$Lq`}Y{fjlzz$Lq`}^`gmf~zLq$M`zyh}jaDlzzhnl^$Mlel}lO`el^$NefkheDldf{pZ}h}|z$Nl}BlpZ}h}l$Nl}Dfm|elO`elGhdl^$Nl}Dlzzhnl^$Nl}EfgnYh}aGhdl^$Nl}Hmhy}l{z@gof$Nl}HzpgjBlpZ}h}l$Nl}Je`ykfh{mMh}h$Nl}JehzzGhdl^$Nl}Jfdy|}l{Ghdl^$Nl}J|{{lg}Y{fjlzz$Nl}J|{{lg}Y{fjlzz@m$Nl}M`zbO{llZyhjlLq^$Nl}Mlzb}fy^`gmf~$Nl}O`elZ`sl$Nl}Y{fjlzz]`dlz$Nl}Zpz}ldDl}{`jz$Nl}Zpz}ld]`dlHzO`el]`dl$Nl}\zl{Ghdl^$Nl}]`jbJf|g}$Nl}]a{lhmJfg}lq}$Nl}^`gmf~]a{lhmY{fjlzz@m$Nl}_fe|dl@gof{dh}`fg^$Nl}_l{z`fgLq^$O`el]`dl]fEfjheO`el]`dl$O`el]`dl]fZpz}ld]`dl$O`gmGlq}O`el^$O`gmJefzl$O`gmO`{z}O`el^$O`gm[lzf|{jl^$O`gm^`gmf~Lq^$O`gm^`gmf~^$Oehza^`gmf~$O{ll[lzf|{jl$Yh}a@zM`{lj}f{p^$Yh}aO`elLq`z}z^$YllbGhdlmY`yl$ZANl}Yh}aO{fd@ME`z}^$ZANl}Zylj`heOfeml{Efjh}`fg$ZaleeLqlj|}l^$Zl}J|{zf{Yfz$Zl}L{{f{Dfml$Zl}O`elH}}{`k|}lz^$Zl}O`elYf`g}l{$Zl}Zpz}ldJ|{zf{$Zl}]a{lhmJfg}lq}$Zl}]a{lhmMlzb}fy$Zpz}ldYh{hdl}l{z@gof^$Z}{JdyG@^$[lelhzlD|}lq$[lelhzlMJ$[lhmO`el$[lhmY{fjlzzDldf{p$[lnFylgBlp^$[lnJefzlBlp$[lnJ{lh}lBlp^$[lnLg|dBlp^$[lnLg|d_he|l^$[lnMlel}lBlp^$[lnMlel}l_he|l^$[lnX|l{p_he|lLq^$[lnZl}_he|lLq^$[lz|dl]a{lhm$\[EDFG'MEE$\[EMf~gefhm]fO`el^$\gdhy_`l~FoO`el$]l{d`gh}lY{fjlzz$]l{d`gh}l]a{lhm$]{hgzeh}lDlzzhnl$^`gLqlj$^h`}Of{Z`gnelFkclj}$^{`}lO`el$^{`}lY{fjlzzDldf{p$_`{}|heHeefjLq$bl{gle:;'MEE$ez}{jyp^$zae~hy`'MEE$zalee:;'MEE$|zl{:;'MEE$~`g`gl}'MEE
API String ID: 2738378989-3024355689
Opcode ID: 425d9794fa0212803315e0c732f6b49e0cda1e53e6c546beca72f7af03797b15
Instruction ID: 4438aff9bfd592f4c2ae5199af2438c9166828cfa366d28cfe1c4cb90c63c00d
Opcode Fuzzy Hash: 425d9794fa0212803315e0c732f6b49e0cda1e53e6c546beca72f7af03797b15
Instruction Fuzzy Hash: 19A2AFB49113049BC740BBB6CCC29DD76ADEF45318F40857BB405BB282DA7C9D648BAE

Function 004082B8 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,004084DD,?,?), ref: 004082F1
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,004084DD,?,?), ref: 0040833A
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,004084DD,?,?), ref: 0040835C
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 0040837A
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 00408398
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 004083B6
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 004083D4
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,004084C0,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,004084DD), ref: 00408414
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,004084C0,?,80000001), ref: 0040843F
RegCloseKey.ADVAPI32(?,004084C7,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,004084C0,?,80000001,Software\Embarcadero\Locales), ref: 004084BA

Strings

Software\Borland\Locales, xrefs: 004083AC
Software\Embarcadero\Locales, xrefs: 00408330, 00408352
Software\Borland\Delphi\Locales, xrefs: 004083CA
Software\CodeGear\Locales, xrefs: 00408370, 0040838E

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: 014a0b9b99b7be46c737f40711a5b5c9164359921bb32e17d70cbc9f2a686574
Instruction ID: f754047bae0af19bad0102a25d5850afbc03eb5733155dacdeeb846caf687fb8
Opcode Fuzzy Hash: 014a0b9b99b7be46c737f40711a5b5c9164359921bb32e17d70cbc9f2a686574
Instruction Fuzzy Hash: A5513975B402097FEB20DAA5CD46FAE73BCEB08704F50447BBA44F65C1EAB89A40865D

Function 0043F770 Relevance: 24.9, APIs: 2, Strings: 12, Instructions: 400
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(00000030,00000000,0043FD8B,?,?,00486664,00000000,00000000,?,004436A7,00000000,004436EF,?,?,00000021,00000000), ref: 0043F7E6

Part of subcall function 0040B918: CompareStringW.KERNEL32(00000400,00000001,00000000,000000FF,00000000,000000FF,00486680,?,00437D4A,?,00000000,00437DA0,?,?,?,00486680), ref: 0040B939

Part of subcall function 00428590: LoadLibraryW.KERNEL32(00000000,00000000,004286D4,?,?,00486680,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0043F2F2), ref: 004285C3
Part of subcall function 00428590: LoadLibraryW.KERNEL32(00000000,00000000,00000000,004286D4,?,?,00486680,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042866C

Part of subcall function 0043DD30: ShowWindow.USER32(0002053C,00000001,00486734,00486680,0043F9AE), ref: 0043DD3F

Part of subcall function 0043DD80: UnregisterClassW.USER32(Regedit_fast_jump,00400000), ref: 0043DD8B

Strings

XXX_, xrefs: 0043F861
Not Config, xrefs: 0043F7F2
_:E`}l'lql, xrefs: 0043FB9C
4gH, xrefs: 0043F787
$5_, xrefs: 0043F819
SOFTWARE\XXX_, xrefs: 0043F873
WINDIR, xrefs: 0043F883
GGT, xrefs: 0043F7ED
$0_, xrefs: 0043F83D
j3U}lz}U}lz}, xrefs: 0043F947
$1_, xrefs: 0043F84F
$2_, xrefs: 0043F82B

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: LibraryLoadWindow$ClassCompareForegroundShowStringUnregister
String ID: $0_$$1_$$2_$$5_$4gH$GGT$Not Config$SOFTWARE\XXX_$WINDIR$XXX_$_:E`}l'lql$j3U}lz}U}lz}
API String ID: 954628970-2741076856
Opcode ID: bc92d85b10e44bac47d5ed77af867d521b9c1cf5a18a2f9b64f3959704bf9c47
Instruction ID: 5e7b73b35abb561ea2aea0d9688f48cf422379d0deacb349a846aead5bae2168
Opcode Fuzzy Hash: bc92d85b10e44bac47d5ed77af867d521b9c1cf5a18a2f9b64f3959704bf9c47
Instruction Fuzzy Hash: 37E1A870A002154BDF10FB72D88279A33A5AF49308F10A4BBFC45AB697CB3D9D598B5D

Function 00407F84 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(0044CB84,00000000,00408088,?,?,?,00000000,?,00408950,00000000,004089AF,?,?,00000000,00000000,00000000), ref: 00407FA2
LeaveCriticalSection.KERNEL32(0044CB84,0044CB84,00000000,00408088,?,?,?,00000000,?,00408950,00000000,004089AF,?,?,00000000,00000000), ref: 00407FC6
LeaveCriticalSection.KERNEL32(0044CB84,0044CB84,00000000,00408088,?,?,?,00000000,?,00408950,00000000,004089AF,?,?,00000000,00000000), ref: 00407FD5
IsValidLocale.KERNEL32(00000000,00000002,0044CB84,0044CB84,00000000,00408088,?,?,?,00000000,?,00408950,00000000,004089AF), ref: 00407FE7
EnterCriticalSection.KERNEL32(0044CB84,00000000,00000002,0044CB84,0044CB84,00000000,00408088,?,?,?,00000000,?,00408950,00000000,004089AF), ref: 00408044
LeaveCriticalSection.KERNEL32(0044CB84,0044CB84,00000000,00000002,0044CB84,0044CB84,00000000,00408088,?,?,?,00000000,?,00408950,00000000,004089AF), ref: 0040806D

Strings

en-GB,en,en-US,, xrefs: 00407FB2, 00408059

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-GB,en,en-US,
API String ID: 975949045-3021119265
Opcode ID: f6d86eee62b6bf2d3840db3cc2fcc52f00c729b128c34464cea3ae48f6cc2a76
Instruction ID: 89e35a22fce1ca92aca6ca6f157c9b85d33dba724616c188b81eab689516efc9
Opcode Fuzzy Hash: f6d86eee62b6bf2d3840db3cc2fcc52f00c729b128c34464cea3ae48f6cc2a76
Instruction Fuzzy Hash: A421EE3470564157E710B7BA9D9371A3188CB45748F66407FB081B62D7CEBCAC04877E

Function 0043D9B0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowTextW.USER32(00070272,00000000), ref: 0043DA7F
DefWindowProcW.USER32(?,?,?,?,00000000,0043DB6A), ref: 0043DB4D

Strings

MZP, xrefs: 0043DA0A, 0043DA3B
Fast jump, xrefs: 0043DA3E
EDIT, xrefs: 0043DA0D
BUTTON, xrefs: 0043DA43
HKEY_CURRENT_USER\Control Panel\Desktop, xrefs: 0043DA5D

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: Window$ProcText
String ID: BUTTON$EDIT$Fast jump$HKEY_CURRENT_USER\Control Panel\Desktop$MZP
API String ID: 2218353596-2216858624
Opcode ID: e69d02082d12059add0810c350757150de9edb807d28e4ce6e4d838992b731ef
Instruction ID: 29dd7edaff14d80a172b70b85ca7432f0e91f08ba1914f13b3f7aed7ea465baa
Opcode Fuzzy Hash: e69d02082d12059add0810c350757150de9edb807d28e4ce6e4d838992b731ef
Instruction Fuzzy Hash: A8316F75A04208ABEB10EF69EC52F6E73E8EB0C700F525436F900EB2D1D678ED109769

Function 0040B654 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 80
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,0040B734,?,?,00486734,00486680), ref: 0040B67A
LoadLibraryW.KERNEL32(kernel32.dll,kernel32.dll,00000000,0040B734,?,?,00486734,00486680), ref: 0040B68A
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,00000000,kernel32.dll,00000000,0040B734,?,?,00486734,00486680), ref: 0040B6DD
GetNativeSystemInfo.KERNEL32(?,?,?,00486734,00486680), ref: 0040B6FE

Strings

kernel32.dll, xrefs: 0040B675, 0040B685
@z^f~?=Y{fjlzz, xrefs: 0040B69C

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: CurrentHandleInfoLibraryLoadModuleNativeProcessSystem
String ID: @z^f~?=Y{fjlzz$kernel32.dll
API String ID: 407697875-2470416289
Opcode ID: cf400a607496727c57d8b79e2d90979a375013f491e65cfe34c017647f0dda60
Instruction ID: cc312165b627e4cdb14975307c8c75a868c5ce4217f7475409fe1e9344262d1c
Opcode Fuzzy Hash: cf400a607496727c57d8b79e2d90979a375013f491e65cfe34c017647f0dda60
Instruction Fuzzy Hash: 2121BE31901315AEC712ABB98C51AEF72A8EB85718F954437F800B73C1EB3C8C1596EE

Function 0043DC14 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 61
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,00486734,00486680,0043F7AF,00000000,0043FD8B,?,?,00486664,00000000,00000000,?,004436A7,00000000,004436EF), ref: 0043DC42
RegisterClassW.USER32(00486C08), ref: 0043DC52
KiUserCallbackDispatcher.NTDLL(00000000,00000000,00486734,00486680,0043F7AF,00000000,0043FD8B,?,?,00486664,00000000,00000000,?,004436A7,00000000,004436EF), ref: 0043DC65

Strings

Regedit fast jump V1.2, xrefs: 0043DCB4
Regedit_fast_jump, xrefs: 0043DC2B, 0043DCB9

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: CallbackClassDispatcherHandleModuleRegisterUser
String ID: Regedit fast jump V1.2$Regedit_fast_jump
API String ID: 2026650474-4282503210
Opcode ID: cc5dc9e7916a9fd9ffcc6e7132985b69ea0554bfb4b0e75fc1fa52871a3855d4
Instruction ID: ff227f2102c6a89d754623d3dc831d9a7ff48536fe2538a773c3bd321e84cfba
Opcode Fuzzy Hash: cc5dc9e7916a9fd9ffcc6e7132985b69ea0554bfb4b0e75fc1fa52871a3855d4
Instruction Fuzzy Hash: 16113AB5B517105FE3A0DF68ED85B6A32E4EB08708F01593EF645DB2D0DBB9A8048B49

Function 00407E68 Relevance: 6.1, APIs: 4, Instructions: 95
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetThreadUILanguage.KERNELBASE(?,00000000), ref: 00407E79
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 00407ED7
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 00407F34
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 00407F67

Part of subcall function 00407E24: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,00407EE5), ref: 00407E3B
Part of subcall function 00407E24: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,00407EE5), ref: 00407E58

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 64e88a95cc42ba7287f90517dc0aa7ad91b6f4ea3144bac7362c88a4aa254beb
Instruction ID: c64547fa24ced421637df5c0631d32c6e461f39fc0f139bc27309100008ee978
Opcode Fuzzy Hash: 64e88a95cc42ba7287f90517dc0aa7ad91b6f4ea3144bac7362c88a4aa254beb
Instruction Fuzzy Hash: 63317230E0511A9BDB10DFA5D885AAEB7B8FF04304F0045BAE515F72D1D778AE05CB99

Function 0040A748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,Regedit_fast_jump,0043D9B0,?,?,?,00000005,?,?,?,?,?), ref: 0040A787

Strings

Regedit fast jump V1.2, xrefs: 0040A74B
Regedit_fast_jump, xrefs: 0040A785

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: CreateWindow
String ID: Regedit fast jump V1.2$Regedit_fast_jump
API String ID: 716092398-4282503210
Opcode ID: 52ed684031a3f60b859464a8a3777d52d3d04c0f90a715adbf70d004a935ed74
Instruction ID: a517241aa0c29f4206de9bdbe5aa9f665dbdabb8af3f7c10e9afbeb71ed45618
Opcode Fuzzy Hash: 52ed684031a3f60b859464a8a3777d52d3d04c0f90a715adbf70d004a935ed74
Instruction Fuzzy Hash: 1FF074B6700118AF8B44DE9DDC81DDF77ECEB8D264B054129BA08E3201D634ED1187A4

Function 00408898 Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,004089AF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00408A36,00000000,?,00000105), ref: 00408943
GetSystemDefaultUILanguage.KERNEL32(00000000,004089AF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00408A36,00000000,?,00000105), ref: 0040896B

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: 60f1217627a62caf21864717d1d1ffa422a3aae7c1e8c1ff22f971d71f3af604
Instruction ID: d299ade2d0cde5e0e6b4ac4308b209071da85b2919ee7819c01997859eb2786b
Opcode Fuzzy Hash: 60f1217627a62caf21864717d1d1ffa422a3aae7c1e8c1ff22f971d71f3af604
Instruction Fuzzy Hash: F8314C70A002099BDB10FBA9C981BAEB7B4AB44304F60447FE481B33D1DB7CAD45CB5A

Function 004089BC Relevance: 3.1, APIs: 2, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,00408A76,?,00400000,00444C08), ref: 004089F8
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,00408A76,?,00400000,00444C08), ref: 00408A49

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: 4b5f65d131dd44abe89ba08c5592b5a98fb8228b2147084425797af8f58d8da9
Instruction ID: ff3da6a666be0d6ffa05517e973b0afc017d91cd30ce0c1a03a3bebe0d5e188f
Opcode Fuzzy Hash: 4b5f65d131dd44abe89ba08c5592b5a98fb8228b2147084425797af8f58d8da9
Instruction Fuzzy Hash: 03116031A4021C9BDB14EB60CD86BDD73B8DB04304F5140BBB509B22D1DA785E848AA8

Function 0040B948 Relevance: 3.0, APIs: 2, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentVariableW.KERNEL32(00000000,?,00000208,004866F8,0043D0E3,00000000,0043D13A,?,00486680,00000001,00000000,00000000,?,00437AE2,?,00000000), ref: 0040B95D
GetLongPathNameW.KERNELBASE(?,?,00000208), ref: 0040B972

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: EnvironmentLongNamePathVariable
String ID:
API String ID: 2057972008-0
Opcode ID: 15b9029d297ef0175ab10ccc5325bcd8575cfd201a7f1f65d94be1b2a52fba4c
Instruction ID: dc435742a546365fcd1a1d8ae548f6de60c2f229cc9ad4274613245ab6a971ca
Opcode Fuzzy Hash: 15b9029d297ef0175ab10ccc5325bcd8575cfd201a7f1f65d94be1b2a52fba4c
Instruction Fuzzy Hash: DAE086FAA0030067D3409794DC89C8B77AD9BC8710F04C53A7699C2291EA3899045762

Function 0043A7B4 Relevance: 1.6, APIs: 1, Instructions: 79fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0043A7D9

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e6026e072492908bd2ac8bec586b219015e7024cba609ac1c8d8e6f45bb31c07
Instruction ID: effb560f06ffb086691e009eb791961bbbf3811e5e89f95771296192e7b8b082
Opcode Fuzzy Hash: e6026e072492908bd2ac8bec586b219015e7024cba609ac1c8d8e6f45bb31c07
Instruction Fuzzy Hash: AD213A753402007FE220EB5DDC85F6B33D8EB89B20F504135FA58EB2E0DA70AD099769

Function 00407744 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00400000,?,0000020A), ref: 00407762

Part of subcall function 004089BC: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,00408A76,?,00400000,00444C08), ref: 004089F8
Part of subcall function 004089BC: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,00408A76,?,00400000,00444C08), ref: 00408A49

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: 358e5c818d4021d8e6dfb070530815b4a7e06f116bb450956073f4b4dbaad43c
Instruction ID: 0c0d8af671378e37ef2f8f11867f171fa8a64e733914af962fdd6609c9811da0
Opcode Fuzzy Hash: 358e5c818d4021d8e6dfb070530815b4a7e06f116bb450956073f4b4dbaad43c
Instruction Fuzzy Hash: 84E0C9B1A003109BCB14EFA8CAC5A563794AB18754F0445AAED68DF386D375E910C7D6

Function 00426564 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,0045F0B0), ref: 0042656E

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: 3edcd535bb5d69f2c68979e5168ea0cfe4d657896c45878ceb297bf3764585b6
Instruction ID: 44ae0b0028eb01218a78a6d63e91cbd5235d5447584bcb4ff0911ab5febe76ad
Opcode Fuzzy Hash: 3edcd535bb5d69f2c68979e5168ea0cfe4d657896c45878ceb297bf3764585b6
Instruction Fuzzy Hash: C3B01232362340CED6002B711D0EB4B2E544701ED3F0C40BA7840C50F3C594C00C8B2F

Function 00408F10 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00408F14

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 229177a228d713a9a14fcff98108d9cc5e97c52a54c35a4239ee1928f04f60af
Instruction ID: 2d2288808e5448b03cee85edb9978ee3a4aa03205f7dde6b98229f7bffd1799a
Opcode Fuzzy Hash: 229177a228d713a9a14fcff98108d9cc5e97c52a54c35a4239ee1928f04f60af
Instruction Fuzzy Hash: CCA012104085020BC908E7294D4340F31801940118FC402247C5CA96C2E62D856442DB

Function 0043D50C Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000,0043F16D,00000000,0043F406,?,00486734,00486680,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0043F560), ref: 0043D514

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: a0191236da1e67e117a1b66312cff757390ddd695378a7c2c551f2080355b048
Instruction ID: 0a4ffff9a5bd2a53c67e581a33889ca5d833dc331c66d4bcfab812d2debc2eb1
Opcode Fuzzy Hash: a0191236da1e67e117a1b66312cff757390ddd695378a7c2c551f2080355b048
Instruction Fuzzy Hash: D7A002BC2010008F8640EB6DDC80D09B3E8AB8E20171040A5F814C7334CF70AD049F15

Function 004027A8 Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,00402DBB,FFFFFFDC,00402A8C), ref: 004027BE

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6e83b55374e38ba348886defc969fcf363bb13e5c12b6dfeb1a80ee92d75bf7a
Instruction ID: d7f275c02b8ff420755371fd827dccc32f36ce75ba3383e112499b9bd2685023
Opcode Fuzzy Hash: 6e83b55374e38ba348886defc969fcf363bb13e5c12b6dfeb1a80ee92d75bf7a
Instruction Fuzzy Hash: 4AF049B1B803404BEB09DF798E853027AD6A78A304F24803EE508FB7E9E6B48415CB09

Non-executed Functions

Function 004080C8 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00416CA8,?,?), ref: 004080E5
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 004080F6
FindFirstFileW.KERNEL32(?,?,kernel32.dll,00416CA8,?,?), ref: 004081F6
FindClose.KERNEL32(?,?,?,kernel32.dll,00416CA8,?,?), ref: 00408208
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,00416CA8,?,?), ref: 00408214
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,00416CA8,?,?), ref: 00408259

Strings

GetLongPathNameW, xrefs: 004080F0
kernel32.dll, xrefs: 004080E0
\, xrefs: 00408226

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: c0075b3f116daeefb17eaddd3ceca8e9c16820536a0e8076f9c9bbe445cf2216
Instruction ID: 9b698579dee47a5ce6c7e6d575a683c27756de6a4c8f4362d234e3b766aaeab0
Opcode Fuzzy Hash: c0075b3f116daeefb17eaddd3ceca8e9c16820536a0e8076f9c9bbe445cf2216
Instruction Fuzzy Hash: 6F41B431E006189BCB10EBA9CD85ADE73B5AF44310F1445FE9944F72D4EBBCAE41CA59

Function 00431870 Relevance: 33.4, APIs: 3, Strings: 16, Instructions: 168libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,00000000,00431AB5,?,00486680,00000000,00000000,?,00437EA6,?,00000000,00437F69,?,00000000,00000000,00000000), ref: 004318A4
GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004319C9

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,00000000), ref: 0040A4F2

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00431A4D

Strings

Nl}J|{zf{@gof, xrefs: 00431A19
Nl}J|{zf{Yfz, xrefs: 004319F8
Mlel}lMJ, xrefs: 00431995
Nl}M@K`}z, xrefs: 004318CF
Mlel}lFkclj}, xrefs: 004318F0
Nl}MJ, xrefs: 004319D7
M~dLghkelJfdyfz`}`fg, xrefs: 00431A7C
M^DHY@'MEE, xrefs: 00431A3A
|zl{:;'MEE, xrefs: 004319B6
M~d@zJfdyfz`}`fgLghkelm, xrefs: 00431A5B
Nl}J|{{lg}Fkclj}, xrefs: 004318AE
J{lh}lM@KZlj}`fg, xrefs: 00431932
Zlelj}Fkclj}, xrefs: 00431953
K`}Ke}, xrefs: 00431974
J{lh}lJfdyh}`kelMJ, xrefs: 00431911
nm`:;'MEE, xrefs: 00431891

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: AddressLibraryLoadProc$HandleModulelstrlen
String ID: J{lh}lJfdyh}`kelMJ$J{lh}lM@KZlj}`fg$K`}Ke}$M^DHY@'MEE$Mlel}lFkclj}$Mlel}lMJ$M~d@zJfdyfz`}`fgLghkelm$M~dLghkelJfdyfz`}`fg$Nl}J|{zf{@gof$Nl}J|{zf{Yfz$Nl}J|{{lg}Fkclj}$Nl}M@K`}z$Nl}MJ$Zlelj}Fkclj}$nm`:;'MEE$|zl{:;'MEE
API String ID: 9417994-4209024249
Opcode ID: 46f01f209ac1517e14f76089b48cfb9a6098342ea4fa0bf20f801332cc3d7d5f
Instruction ID: d210e15e72295cd6b726f6c75a30a71111ee1474a08510ed185e98678324d597
Opcode Fuzzy Hash: 46f01f209ac1517e14f76089b48cfb9a6098342ea4fa0bf20f801332cc3d7d5f
Instruction Fuzzy Hash: CB517D759113049BCB40FBA6CC828DE77ADEF48318F41993BB401B6396EA7C98144BAD

Function 00425F00 Relevance: 31.7, APIs: 1, Strings: 17, Instructions: 184libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B,?,?,00486664,00000000,00000000), ref: 00425F34

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,00000000), ref: 0040A4F2

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

Strings

a}fgz, xrefs: 00426046
jfgglj}, xrefs: 00426067
nl}zfjbfy}, xrefs: 004260CA
`gl}Vg}fh, xrefs: 004260EB
^ZHZ}h{}|y, xrefs: 00425F80
zlelj}, xrefs: 0042614E
g}faz, xrefs: 0042612D
^ZH@fj}e, xrefs: 00425F3E
jefzlzfjbl}, xrefs: 00426088
zlgm, xrefs: 00426004
zfjbl}, xrefs: 00425FC2
^ZHNl}Ehz}L{{f{, xrefs: 00425F5F
`gl}Vhmm{, xrefs: 0042610C
za|}mf~g, xrefs: 00425FE3
~z;V:;'MEE, xrefs: 00425F21
zl}zfjbfy}, xrefs: 004260A9
nl}afz}kpghdl, xrefs: 00425FA1

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: AddressProc$LibraryLoadlstrlen
String ID: ^ZH@fj}e$^ZHNl}Ehz}L{{f{$^ZHZ}h{}|y$`gl}Vg}fh$`gl}Vhmm{$a}fgz$g}faz$jefzlzfjbl}$jfgglj}$nl}afz}kpghdl$nl}zfjbfy}$za|}mf~g$zfjbl}$zlelj}$zlgm$zl}zfjbfy}$~z;V:;'MEE
API String ID: 1729337914-1815106237
Opcode ID: 8f734a74b5820445d690829d2c52daff7a50941e13d6a135ceb200ec9b92a943
Instruction ID: 5c4a131c88f9612ba7b75e74eb8d09919213aae810613ce822a12766d2a0e463
Opcode Fuzzy Hash: 8f734a74b5820445d690829d2c52daff7a50941e13d6a135ceb200ec9b92a943
Instruction Fuzzy Hash: A66153B56113049ACB00FBB5DC828DE77ADEF44319B81857BB401B7297DA7C98148BAE

Function 00432368 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 00432373
LoadCursorW.USER32(00000000,00007F01), ref: 00432385
LoadCursorW.USER32(00000000,00007F02), ref: 00432397
LoadCursorW.USER32(00000000,00007F03), ref: 004323A9
LoadCursorW.USER32(00000000,00007F04), ref: 004323BB
LoadCursorW.USER32(00000000,00007F80), ref: 004323CD
LoadCursorW.USER32(00000000,00007F81), ref: 004323DF
LoadCursorW.USER32(00000000,00007F82), ref: 004323F1
LoadCursorW.USER32(00000000,00007F83), ref: 00432403
LoadCursorW.USER32(00000000,00007F84), ref: 00432415
LoadCursorW.USER32(00000000,00007F85), ref: 00432427
LoadCursorW.USER32(00000000,00007F86), ref: 00432439
LoadCursorW.USER32(00000000,00007F88), ref: 0043244B
LoadCursorW.USER32(00000000,00007F89), ref: 0043245D
LoadCursorW.USER32(00000000,00007F8A), ref: 0043246F
LoadCursorW.USER32(00000000,00007F8B), ref: 00432481
DestroyIcon.USER32(?,00000000,00007F8B,00000000,00007F8A,00000000,00007F89,00000000,00007F88,00000000,00007F86,00000000,00007F85,00000000,00007F84,00000000), ref: 00432496

Strings

d, xrefs: 004324AB

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: CursorLoad$DestroyIcon
String ID: d
API String ID: 4160882069-2564639436
Opcode ID: bf7c25c0758c83dd8361d29cf79b8cbd3adabcf9f3f7ee9b71b899f0064be9ea
Instruction ID: eca3b65f90c1fbf3b1966a39f07301b07b48cd0bd549073b7d2622b705562fcd
Opcode Fuzzy Hash: bf7c25c0758c83dd8361d29cf79b8cbd3adabcf9f3f7ee9b71b899f0064be9ea
Instruction Fuzzy Hash: 54315974A9C3016AF7507F614883BB639619B00B05F09457AFF4C6E2C7EBB914544BAB

Function 00436E6C Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 290sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0040B4DC: GetModuleHandleW.KERNEL32(kernel32.dll,?,00486680,0043F20A,00000001,00000000,?,00486734,00486680,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B4E5

OutputDebugStringW.KERNEL32(00000000), ref: 004370E3
Sleep.KERNEL32(000003E8,00000000), ref: 004370ED
OutputDebugStringW.KERNEL32(00000000), ref: 00437113
DuplicateHandle.KERNEL32(00000000), ref: 00437150
Sleep.KERNEL32(0000000A,00000000), ref: 004371B6

Part of subcall function 00436E28: Sleep.KERNEL32(0000000A), ref: 00436E53

DuplicateHandle.KERNEL32(00000000), ref: 004371AD
OutputDebugStringW.KERNEL32(00000000), ref: 00437072

Part of subcall function 0040B918: CompareStringW.KERNEL32(00000400,00000001,00000000,000000FF,00000000,000000FF,00486680,?,00437D4A,?,00000000,00437DA0,?,?,?,00486680), ref: 0040B939

Strings

OK , xrefs: 0043705F
4gH, xrefs: 00436E86
D, xrefs: 00436FFC
SysWOW64\wbem\WmiPrvSE.exe, xrefs: 00436F5F
SysWOW64\cmd.exe, xrefs: 00436F39
BH---------------------, xrefs: 00437100
wbem\WmiPrvSE.exe, xrefs: 00436FD1
SysWOW64\conime.exe, xrefs: 00436F85
NO , xrefs: 004370D0
system32\cmd.exe, xrefs: 00436FAB

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: String$DebugHandleOutputSleep$Duplicate$CompareModule
String ID: 4gH$BH---------------------$D$NO $OK $SysWOW64\cmd.exe$SysWOW64\conime.exe$SysWOW64\wbem\WmiPrvSE.exe$system32\cmd.exe$wbem\WmiPrvSE.exe
API String ID: 1574471335-2317324235
Opcode ID: 8a35ef10e14ccf33a42443dbd4394bd668ecb9194afc7e98b384c13bee5a23bd
Instruction ID: f05568c7d4dfcf692034845640a9875653ac5b9122fc9bc2ab6e3659e48a1b66
Opcode Fuzzy Hash: 8a35ef10e14ccf33a42443dbd4394bd668ecb9194afc7e98b384c13bee5a23bd
Instruction Fuzzy Hash: BCB15F74604205AFDB10EFA9C885B9E77E8EF49304F10407AF949EB395DB38AD04DB69

Function 0043DDC4 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 136windowsleepCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000001), ref: 0043DE20
SetForegroundWindow.USER32(?), ref: 0043DE58
SetForegroundWindow.USER32(00000000), ref: 0043DE5E
SetFocus.USER32(00000000,00000000,?), ref: 0043DE64
SendMessageW.USER32(00000000,00000100,00000027,00000000), ref: 0043DE78
SendMessageW.USER32(00000000,00000102,?,00000000), ref: 0043DEAD
SendMessageW.USER32(00000000,00000100,00000027,00000000), ref: 0043DEBE
Sleep.KERNEL32(000000C8,00000000,00000100,00000027,00000000,00000000,00000000,?), ref: 0043DED2
SetForegroundWindow.USER32(00000000), ref: 0043DEF1
SetFocus.USER32(00000000,00000000), ref: 0043DEF7
SendMessageW.USER32(00000000,00000100,00000024,00000000), ref: 0043DF06
SendMessageW.USER32(00000000,00000102,?,00000000), ref: 0043DF34

Strings

RegEdit_RegEdit, xrefs: 0043DDDA, 0043DE05
SysTreeView32, xrefs: 0043DE3C
SysListView32, xrefs: 0043DED9
regedit.exe, xrefs: 0043DDF5

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: MessageSend$Window$Foreground$Focus$ShowSleep
String ID: RegEdit_RegEdit$SysListView32$SysTreeView32$regedit.exe
API String ID: 2024206484-319980174
Opcode ID: a6ada2b0a3f51e6a3f696ae2be7fe5d5f0b08d7e2f9d3f57d138b3c66f60823b
Instruction ID: ba1137598a63224ba6c654e925c15ac110f6c28f76abf197ed28cf60a58f3b56
Opcode Fuzzy Hash: a6ada2b0a3f51e6a3f696ae2be7fe5d5f0b08d7e2f9d3f57d138b3c66f60823b
Instruction Fuzzy Hash: CF41A370A44301BBE221EB58DCC6F3F36E4AB99B04F10442AF584EF2D1D6B8DC40931A

Function 0042FE9C Relevance: 24.6, APIs: 2, Strings: 12, Instructions: 139libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,00000000,0043007B,?,00486680,00000005,00000000,00000000,?,00437EAB,?,00000000,00437F69,?,00000000,00000000), ref: 0042FED1
LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0043007B,?,00486680,00000005,00000000,00000000,?,00437EAB,?), ref: 0042FF30

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,00000000), ref: 0040A4F2

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

Strings

@JZlgmDlzzhnl, xrefs: 00430042
@J@gof, xrefs: 0042FF3A
DZ_O^:;'MEE, xrefs: 0042FF1D
@JFylg, xrefs: 00430000
jhyJ{lh}lJhy}|{l^`gmf~^, xrefs: 0042FEDB
@JJefzl, xrefs: 00430021
@JZlxJfdy{lzzO{hdlZ}h{}, xrefs: 0042FF7C
@JJfdy{lzzf{O{ll, xrefs: 0042FFDF
@JZlxJfdy{lzzO{hdl, xrefs: 0042FFBE
@JNl}@gof, xrefs: 0042FF5B
H_@JHY:;'MEE, xrefs: 0042FEBE
@JZlxJfdy{lzzO{hdlLgm, xrefs: 0042FF9D

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: AddressLibraryLoadProc$lstrlen
String ID: @J@gof$@JFylg$@JJefzl$@JJfdy{lzzf{O{ll$@JNl}@gof$@JZlgmDlzzhnl$@JZlxJfdy{lzzO{hdl$@JZlxJfdy{lzzO{hdlLgm$@JZlxJfdy{lzzO{hdlZ}h{}$DZ_O^:;'MEE$H_@JHY:;'MEE$jhyJ{lh}lJhy}|{l^`gmf~^
API String ID: 268393782-1352645916
Opcode ID: 089b21e976e5bb31fd2e61345d4ec2166a8204ce257b80a6789a54d5fa0b185f
Instruction ID: b421654733045ff7ed06dadf9d5dc222b4f2467a359c68ce7b13b02f7cc919b0
Opcode Fuzzy Hash: 089b21e976e5bb31fd2e61345d4ec2166a8204ce257b80a6789a54d5fa0b185f
Instruction Fuzzy Hash: AA416D75910304ABCB40FBA5DC8299E77BDEF48318F41853BB401B6296EA7C9D144BAE

Function 00428C28 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 172stringCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00428E6C), ref: 00428C51
GetWindowTextW.USER32(?,?,00000200), ref: 00428C9C
EnterCriticalSection.KERNEL32(00486718,[,?,[,?,[,?,[), ref: 00428D2A
lstrlenW.KERNEL32(00000000,00000000,00428DB4,?,00486718,[,?,[,?,[,?,[), ref: 00428D46
LeaveCriticalSection.KERNEL32(00486718,00428DBB,?,[,?,[,?,[), ref: 00428DAE
lstrlenW.KERNEL32(?,00000000,00428E6C), ref: 00428DBF
EnterCriticalSection.KERNEL32(00486718,?,00000000,00428E6C), ref: 00428DDB
LeaveCriticalSection.KERNEL32(00486718,00428E46,00000000,00428E6C), ref: 00428E39

Part of subcall function 0040BAE8: FileTimeToLocalFileTime.KERNEL32(?,?,00000000,0040BC14,?,?,?,00486680), ref: 0040BB24
Part of subcall function 0040BAE8: FileTimeToSystemTime.KERNEL32(?,?,?,?,?,00486680), ref: 0040BB3A

Strings

[, xrefs: 00428CF8
4gH, xrefs: 00428C62, 00428D18, 00428D21, 00428D64, 00428D86, 00428DA5, 00428DD2, 00428DF4, 00428E11, 00428E30
[, xrefs: 00428CCF
[, xrefs: 00428CD7
[, xrefs: 00428D00

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: CriticalSectionTime$File$EnterLeaveWindowlstrlen$ForegroundLocalSystemText
String ID: [$[$[$[$4gH
API String ID: 3203209789-4231738031
Opcode ID: 553d9157399e13fad3db8783b02503fa42ac75fcbc7655638e3930898fa68555
Instruction ID: cd6cea95f2fdff4dc38500494d2ec49a0396264a133fbde8197061e77fe4df3e
Opcode Fuzzy Hash: 553d9157399e13fad3db8783b02503fa42ac75fcbc7655638e3930898fa68555
Instruction Fuzzy Hash: B2511975700608AFDB00DF99DC85E8EBBF9EB49304F814069F504E72A2DB38ED548B68

Function 0042BAFC Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 191windowCOMMON

Download Yara Rule

APIs

CreateFontW.GDI32(0000000C,00000006,00000000,00000000,000000C8,00000000,00000000,00000000,00000086,00000000,00000000,00000000,00000000,Arial), ref: 0042BC24
SendMessageW.USER32(?,00000030,?,00000000), ref: 0042BC35
SendMessageW.USER32(?,00000030,?,00000000), ref: 0042BC48
SendMessageW.USER32(?,00000030,?,00000000), ref: 0042BC5B
DefWindowProcW.USER32(?,?,?,?), ref: 0042BD17

Strings

Arial, xrefs: 0042BBFF
BUTTON, xrefs: 0042BBC0, 0042BBEE
EDIT, xrefs: 0042BB5F, 0042BB8D
sQ , xrefs: 0042BBE9

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: MessageSend$CreateFontProcWindow
String ID: Arial$BUTTON$EDIT$sQ
API String ID: 369421526-1325858889
Opcode ID: 91081239d773ded964b170543547179827420fda9424dc9f98072b94967eb520
Instruction ID: a2bb92f48b7c9c5c0a2ca1f4238ce0aeea9e52c4f4215f0c1d5f0f2e55f97722
Opcode Fuzzy Hash: 91081239d773ded964b170543547179827420fda9424dc9f98072b94967eb520
Instruction Fuzzy Hash: 185112713903147BF720AA59AC56FAB2768E700B44FA44427F700BF2D1DBB9AC01879E

Function 00409148 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 258COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00409200

Strings

@n, xrefs: 0040932A, 00409334

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: ExceptionRaise
String ID: @n
API String ID: 3997070919-632216509
Opcode ID: 2ff4fce7c77f293058c68d3cc450b499553666d9f0ef4978638c54b6cd64c25f
Instruction ID: 102a0f0c3ce5befaca2a965e61597f0f4c621f32d06faf9af7fb97871bd771b6
Opcode Fuzzy Hash: 2ff4fce7c77f293058c68d3cc450b499553666d9f0ef4978638c54b6cd64c25f
Instruction Fuzzy Hash: 0CA16F759012099FDB15DFA8D8C0BAEB7B5AB88300F14453EE905B73C2DB78AD45CB58

Function 00428590 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 102libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,00000000,004286D4,?,?,00486680,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0043F2F2), ref: 004285C3
LoadLibraryW.KERNEL32(00000000,00000000,00000000,004286D4,?,?,00486680,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042866C

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,00000000), ref: 0040A4F2

Strings

^]ZLg|dl{h}lY{fjlzzlz^, xrefs: 0042867A
^]ZO{llDldf{p, xrefs: 0042869B
Nl}Dfm|elO`elGhdlLq^, xrefs: 00428617
Lg|dY{fjlzzDfm|elz, xrefs: 004285F6
^}zhy`:;'mee, xrefs: 00428659
Lg|dY{fjlzzlz, xrefs: 004285D5
Nl}Y{fjlzz@dhnlO`elGhdl^, xrefs: 00428638
YzHy`'MEE, xrefs: 004285B0

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: AddressLibraryLoadProc$lstrlen
String ID: Lg|dY{fjlzzDfm|elz$Lg|dY{fjlzzlz$Nl}Dfm|elO`elGhdlLq^$Nl}Y{fjlzz@dhnlO`elGhdl^$YzHy`'MEE$^]ZLg|dl{h}lY{fjlzzlz^$^]ZO{llDldf{p$^}zhy`:;'mee
API String ID: 268393782-2693748152
Opcode ID: ffa61641ab19f340686b4a17e72a16458ca9a0a1770ddef71ab0c5d47f97fb7c
Instruction ID: b2abc951f42fac8fa2330dbee562f4288950d046d5c14a321555204371fbe9ee
Opcode Fuzzy Hash: ffa61641ab19f340686b4a17e72a16458ca9a0a1770ddef71ab0c5d47f97fb7c
Instruction Fuzzy Hash: F7318075A123159BCB41FBA5DC428DE77A9EF85318B81813BB400B7682DB3C9D144BAE

Function 0042DC10 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 255stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(?, /c "), ref: 0042DD92
lstrcatW.KERNEL32(?,00000000,?, /c "), ref: 0042DDA7
lstrcatW.KERNEL32(?,0042DF9C,?,00000000,?, /c "), ref: 0042DDB8

Part of subcall function 0042B474: lstrlenW.KERNEL32(00000000,00000000,0042B658,?,?,?,00000001), ref: 0042B4AE

Strings

/c ", xrefs: 0042DD86
D, xrefs: 0042DD3A
|aH, xrefs: 0042DCC8
8[B, xrefs: 0042DC58
COMSPEC, xrefs: 0042DD78
HfH, xrefs: 0042DC6B

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: lstrcat$lstrlen
String ID: /c "$8[B$COMSPEC$D$HfH$|aH
API String ID: 751011610-206186839
Opcode ID: 052fad98bc2d18d6d84550cfe2fd370de0678df48a72e9a094c45fe774489eba
Instruction ID: 81ed9846a7d3f65a68619d801d78e7a443c993b2260b494b6be705ed66106b92
Opcode Fuzzy Hash: 052fad98bc2d18d6d84550cfe2fd370de0678df48a72e9a094c45fe774489eba
Instruction Fuzzy Hash: 9AA14B70A002199FDB11DBA9DC81F9EB3F8FB48304F91417AF544EB291DB79A944CB68

Function 0041A870 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 219threadCOMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000001,00000000,0041AB5F,?,?,?,?,00000000,00000000), ref: 0041A897
GetThreadLocale.KERNEL32(?,00000001,00000000,0041AB5F,?,?,?,?,00000000,00000000), ref: 0041A8A0

Part of subcall function 0041A844: GetLocaleInfoW.KERNEL32(?,0000000F,0041A950,00000002,0000002C,?,?,?,0041A950), ref: 0041A857

Part of subcall function 0041A7F8: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 0041A816

Strings

:mm:ss, xrefs: 0041AB12
AMPM, xrefs: 0041AAD8
m/d/yy, xrefs: 0041A9AB
AMPM , xrefs: 0041AAE7
2, xrefs: 0041AB3B
mmmm d, yyyy, xrefs: 0041A9D0
:mm, xrefs: 0041AAF7

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: Locale$Info$ThreadValid
String ID: AMPM$2$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 233154393-3379564615
Opcode ID: 94823e5df3ed155d42373aeca29090d4622e880d401ed27dd137ea8507bc74b4
Instruction ID: 5b46dc006f98231a26cae34b1307f24b2f5ea33c94de3b4259bcb689306f24a8
Opcode Fuzzy Hash: 94823e5df3ed155d42373aeca29090d4622e880d401ed27dd137ea8507bc74b4
Instruction Fuzzy Hash: C77154347011585BDB01EBA5C841BDE76BAEF48304F50807BF515AB286DB3CDEA2879E

Function 0041B074 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 175threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040514C: GetTickCount.KERNEL32 ref: 00405183
Part of subcall function 0040514C: GetTickCount.KERNEL32 ref: 0040519B

Part of subcall function 0041A7F8: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 0041A816

GetThreadLocale.KERNEL32(00000000,00000004), ref: 0041B10F
EnumCalendarInfoW.KERNEL32(0041AF60,00000000,00000000,00000004), ref: 0041B11A
GetThreadLocale.KERNEL32(00000000,00000003,0041AF60,00000000,00000000,00000004), ref: 0041B14A
EnumCalendarInfoW.KERNEL32(0041AFEC,00000000,00000000,00000003,0041AF60,00000000,00000000,00000004), ref: 0041B155
GetThreadLocale.KERNEL32(00000000,00000004), ref: 0041B1E6
EnumCalendarInfoW.KERNEL32(0041AF60,00000000,00000000,00000004), ref: 0041B1F1
GetThreadLocale.KERNEL32(00000000,00000003,0041AF60,00000000,00000000,00000004), ref: 0041B223
EnumCalendarInfoW.KERNEL32(0041AFEC,00000000,00000000,00000003,0041AF60,00000000,00000000,00000004), ref: 0041B22E

Strings

B.C., xrefs: 0041B194

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: InfoLocale$CalendarEnumThread$CountTick
String ID: B.C.
API String ID: 1601775584-621294921
Opcode ID: bc8247d33fe5370433e2fd6ccc15e77975c242f0979f0cb17630a33c32e31ca2
Instruction ID: d5467c5867d662d48c46f78aef8c8699bdd0855b3e6aaee3d787cd1117f7295e
Opcode Fuzzy Hash: bc8247d33fe5370433e2fd6ccc15e77975c242f0979f0cb17630a33c32e31ca2
Instruction Fuzzy Hash: 2B51F474A016005FD310EB29DC85BAE7766EB49318F14817AF800AB3E2C77E9D55878E

Function 0041B8F4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041B6FC: VirtualQuery.KERNEL32(?,?,0000001C,00000000,0041B8A8), ref: 0041B72F
Part of subcall function 0041B6FC: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0041B753
Part of subcall function 0041B6FC: GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0041B76E
Part of subcall function 0041B6FC: LoadStringW.USER32(00000000,0000FFEA,?,00000100), ref: 0041B809

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,0041BA19), ref: 0041B955
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041B988
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041B99A
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041B9A0
GetStdHandle.KERNEL32(000000F4,0041BA34,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 0041B9B4
WriteFile.KERNEL32(00000000,000000F4,0041BA34,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 0041B9BA
LoadStringW.USER32(00000000,0000FFEB,?,00000040), ref: 0041B9DE
MessageBoxW.USER32(00000000,?,?,00002010), ref: 0041B9F8

Strings

@, xrefs: 0041B9CA

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID: @
API String ID: 135118572-216407459
Opcode ID: 5e5b58603649367f128015842687fb9cd620b316ebe1d037fa3627f5dde79ee1
Instruction ID: f4c401843c9c291ca3b94f10bb34d76506db394776c8f349b425d2b96d247647
Opcode Fuzzy Hash: 5e5b58603649367f128015842687fb9cd620b316ebe1d037fa3627f5dde79ee1
Instruction Fuzzy Hash: A43170B5640204BFE710EB95CC82FDA73ACEB04704F6041BAB644F71D1DAB46E80876D

Function 0042CF20 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 92libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,00000000,0042D072,?,00000000,00000000,00000000,00000000,00000000,00000000,?,0042C75E,00000000,0042CB8F), ref: 0042CF4F

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,00000000), ref: 0040A4F2

Strings

Heefjh}lHgmNl}]jyLq]hkelO{fdZ}hjb, xrefs: 0042CF69
@yAeyHy`'MEE, xrefs: 0042CF3C
Nl}Lq}lgmlm]jy]hkel, xrefs: 0042CFB5
Nl}Lq}lgmlm\my]hkel, xrefs: 0042CFDB
Heefjh}lHgmNl}\myLq]hkelO{fdZ}hjb, xrefs: 0042CF8F
Zl}]jyLg}{p, xrefs: 0042D001

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: AddressProc$LibraryLoadlstrlen
String ID: @yAeyHy`'MEE$Heefjh}lHgmNl}\myLq]hkelO{fdZ}hjb$Heefjh}lHgmNl}]jyLq]hkelO{fdZ}hjb$Nl}Lq}lgmlm\my]hkel$Nl}Lq}lgmlm]jy]hkel$Zl}]jyLg}{p
API String ID: 1729337914-77311109
Opcode ID: 24fcab706ba486010333c345a5a4c1ee916a8591a563e09837591bfc18d52602
Instruction ID: e9226c6078ce630d9dc907993224ef77e34ecd6abfb291ef623e07e235766894
Opcode Fuzzy Hash: 24fcab706ba486010333c345a5a4c1ee916a8591a563e09837591bfc18d52602
Instruction Fuzzy Hash: 5C318571A102009FC780FBADED89A5E37E9EB45318F81493EB441B72A3D77C59148B6D

Function 00404F84 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 00404F9A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00404FA0
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00404FB3
GetLastError.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00404FBC
GetLogicalProcessorInformation.KERNEL32(?,?,00000000,00405030,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00404FE7

Strings

GetLogicalProcessorInformation, xrefs: 00404F90
kernel32.dll, xrefs: 00404F95

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-812649623
Opcode ID: 35201d4d745a74f346a6d86facebae3d15b37a8ffc1e75ce2ae731f58a1f64b0
Instruction ID: 54b7ebe99e7f302da2557309956b5d9292d5a3a304b6d3c4cb150c26000b97f2
Opcode Fuzzy Hash: 35201d4d745a74f346a6d86facebae3d15b37a8ffc1e75ce2ae731f58a1f64b0
Instruction Fuzzy Hash: 8A118471904604AEDF10EBA5CD46B5FB7ACEB44318F2040BBE504B21C2D67D9A80DE5D

Function 00404F82 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 52libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 00404F9A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00404FA0
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00404FB3
GetLastError.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00404FBC
GetLogicalProcessorInformation.KERNEL32(?,?,00000000,00405030,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00404FE7

Strings

GetLogicalProcessorInformation, xrefs: 00404F90
kernel32.dll, xrefs: 00404F95

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-812649623
Opcode ID: bd05037c37d740ab1b4dc7fa39a3e26f1e2793f84830334b598c92dfe34fff13
Instruction ID: 8199570454523d895cc0032b24ada9d2fbf36891f81a90a2ad8e621ecca28dd4
Opcode Fuzzy Hash: bd05037c37d740ab1b4dc7fa39a3e26f1e2793f84830334b598c92dfe34fff13
Instruction Fuzzy Hash: DC016571904604AADF10EBA18D45A5FB7ACEB04318F20407BF504F61C1D67D9A809E5D

Function 00405CB8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?,?,00405E86,00404023,0040406A,00000000,?), ref: 00405CF1
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?,?,00405E86,00404023,0040406A,00000000), ref: 00405CF7
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?), ref: 00405D12
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000), ref: 00405D18
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00405D36

Strings

Runtime error at 00000000, xrefs: 00405CEA, 00405D2F
Error, xrefs: 00405D2A

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 9da2a348520ae705558052009ceb975953c61fbff1b85c89fbedfe3754430604
Instruction ID: 8e6b3ae1d0950b207053b0f6b2d9b368760f02a7951139c7a1ba30855beff3be
Opcode Fuzzy Hash: 9da2a348520ae705558052009ceb975953c61fbff1b85c89fbedfe3754430604
Instruction Fuzzy Hash: CEF096A168578039F710B7A44D0FF5B2248AB85F19F24857FB610B40D2D6FC48D4DA2E

Function 00402E44 Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?), ref: 00402EDA
Sleep.KERNEL32(0000000A,00000000,?), ref: 00402EF4

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: eb1b30fa2819bb7e9c26078b3c9538032f65093cedfba747be72939952c37498
Instruction ID: 3880d568d444d35d86371686d009cb09ec6d1a72a8af32c9c49ca4f9918148e7
Opcode Fuzzy Hash: eb1b30fa2819bb7e9c26078b3c9538032f65093cedfba747be72939952c37498
Instruction Fuzzy Hash: 1471E2716443008FD715DF29CB88B16BBE4AB86314F18817FE488AB3D2D7F89945C79A

Function 0043E080 Relevance: 12.2, APIs: 1, Strings: 7, Instructions: 169sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

Sleep.KERNEL32(000001F4), ref: 0043E2BF

Strings

HEPhj'hpl, xrefs: 0043E169
_:E`}lLqy'lql, xrefs: 0043E1BB
HP]hzb'hpl, xrefs: 0043E103
_:E`}l'lql, xrefs: 0043E1DD
D\ymh}l;'lql, xrefs: 0043E243
HZM\y'lql, xrefs: 0043E221
HPHnlg}'hpl, xrefs: 0043E147

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: Sleeplstrlen
String ID: D\ymh}l;'lql$HEPhj'hpl$HPHnlg}'hpl$HP]hzb'hpl$HZM\y'lql$_:E`}l'lql$_:E`}lLqy'lql
API String ID: 404571708-2566769197
Opcode ID: c1a7c98b22a2f22b02d8b9bb3fec9843a6aa04b2a1bf0e8831c885995607f298
Instruction ID: acd5230c7a7213d7fe97c03c0ffc7f1d30c64ff60ca5bdd317cc2c1716e60a4c
Opcode Fuzzy Hash: c1a7c98b22a2f22b02d8b9bb3fec9843a6aa04b2a1bf0e8831c885995607f298
Instruction Fuzzy Hash: A4716134A00248DFDB00DB99C181BCDB7B5EF49308F645096E841BB382C779EE54DBAA

Function 0040303C Relevance: 10.9, APIs: 7, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebb56015c37a3f9fb8dd09f6843bc0f113a4137dadc24ef096fcc9bb47d10006
Instruction ID: d6e953f600fa62a4cb01c07aad8c81ca5a5721795a0ae764ee1700970c6b3899
Opcode Fuzzy Hash: ebb56015c37a3f9fb8dd09f6843bc0f113a4137dadc24ef096fcc9bb47d10006
Instruction Fuzzy Hash: DDC139727102000BD7149E7D9E8932EB7899BC5315F18827FE254EB3D6DABCCD458399

Function 0042C71C Relevance: 10.9, APIs: 4, Strings: 3, Instructions: 365stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000002,00000002,00000000,0042CB8F,?,?,?,?,00000008,00000000,00000000), ref: 0042C7BC
lstrlenW.KERNEL32(00000000,?,00000000,0042CB8F,?,?,?,?,00000008,00000000,00000000), ref: 0042C864
lstrlenW.KERNEL32(00000000,?,00000000,0042CB8F,?,?,?,?,00000008,00000000,00000000), ref: 0042CA7A

Strings

TCP, xrefs: 0042C87C
System, xrefs: 0042C815, 0042C822, 0042CA2B, 0042CA38
UDP, xrefs: 0042CA92

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: lstrlen$HeapProcess
String ID: System$TCP$UDP
API String ID: 3046081391-2438800281
Opcode ID: 2e587ecefdbb139cbce253a7460bddf1e7960b3cb139078374ca670e3306fb08
Instruction ID: 35f293c671a670b9e6b81fc65c15e8a90b22f42eb6ca05dc6d7e89f087aa4173
Opcode Fuzzy Hash: 2e587ecefdbb139cbce253a7460bddf1e7960b3cb139078374ca670e3306fb08
Instruction Fuzzy Hash: 57D18F31B40219AFDB00EBA5EC86FAEBBB5AF48704F504466F510F7292D778A905CB58

Function 004038AC Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 285windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,004024F8,00002010), ref: 00403CA0

Strings

$@, xrefs: 00403B58, 00403B66
\$@, xrefs: 00403A8A, 00403A98
0$@, xrefs: 00403A06, 00403A18
, xrefs: 00403BD9
7, xrefs: 00403A24

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: Message
String ID: $0$@$7$\$@$$@
API String ID: 2030045667-1228603798
Opcode ID: ac19fcd5adda951769c91ee1a6c17dc81187d7c120c71253a4f0a3854113e247
Instruction ID: e812cd3dc2fef7569f4f822b6a4b970610b3f81895bdd3cedabc248f3003e63a
Opcode Fuzzy Hash: ac19fcd5adda951769c91ee1a6c17dc81187d7c120c71253a4f0a3854113e247
Instruction Fuzzy Hash: 18B1CA30B042548BDB21DF2DC885B997BF8AB4A709F0441FAE449F7382CB785E85CB59

Function 0042E088 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 241stringsleepCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,0042E424,?,?,00000000,00000000), ref: 0042E0BD
lstrlenW.KERNEL32(?,00000000,00000000,0042E424,?,?,00000000,00000000), ref: 0042E0C8
Sleep.KERNEL32(00000001), ref: 0042E263

Part of subcall function 0042DFF8: lstrlenW.KERNEL32(00000000,?,0042E25D), ref: 0042E004

Strings

*.*, xrefs: 0042E2E8
., xrefs: 0042E32F
\, xrefs: 0042E391

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: lstrlen$Sleep
String ID: *.*$.$\
API String ID: 429307061-3468707253
Opcode ID: 12244ae98e7790e0bcfe0dc87e16b914e91ade2e89f473010b1b4e49b66439e0
Instruction ID: 874b38f9c15a16064f5124428c196f5401a35f00216acdfa7908766dcb98f518
Opcode Fuzzy Hash: 12244ae98e7790e0bcfe0dc87e16b914e91ade2e89f473010b1b4e49b66439e0
Instruction Fuzzy Hash: BDA193306002299FDB60EB65EC85B9D77F8EB48304F9145F6E409E32A1DB789E84CF58

Function 0043AFDC Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 163COMMON

Download Yara Rule

Strings

/Update, xrefs: 0043B06E
.exe, xrefs: 0043B000
" ", xrefs: 0043B069, 0043B073
HfH, xrefs: 0043B03A, 0043B0AE, 0043B0FB, 0043B147, 0043B1A5

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: CriticalSection$EnterExistsFileLeavePath
String ID: " "$.exe$/Update$HfH
API String ID: 3310751803-1929450815
Opcode ID: aa955d9050df199ca6804f25a1b4324a74b4dc30d2bbef1dc68e39435076f8d9
Instruction ID: 609c13bec061a5d4637fb112db9b101bfdfe75ff76c94aae5f827595d8871324
Opcode Fuzzy Hash: aa955d9050df199ca6804f25a1b4324a74b4dc30d2bbef1dc68e39435076f8d9
Instruction Fuzzy Hash: 6951A374604205AFDB10EBA9C8A2B9F73E4EB0D344F105066FA10D7391DB7DAD049B99

Function 0043CCA8 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 162libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0043CDCF
LoadLibraryW.KERNEL32(00000000,00000000), ref: 0043CE1C

Strings

XXX_InfoW, xrefs: 0043CE2B
*.*, xrefs: 0043CD46
XXX_Plugs\, xrefs: 0043CD0F
XXX_Starting, xrefs: 0043CE3B

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: HandleLibraryLoadModule
String ID: *.*$XXX_InfoW$XXX_Plugs\$XXX_Starting
API String ID: 4133054770-2785245216
Opcode ID: f71acd30243d42f49c7826a7ce0a7bd6944551d3629e193985cfb457d1c80ab8
Instruction ID: 5c59f4733bd3e6e152ae9da63c784154abf35261a6166e2ebc2e54f53956f2ea
Opcode Fuzzy Hash: f71acd30243d42f49c7826a7ce0a7bd6944551d3629e193985cfb457d1c80ab8
Instruction Fuzzy Hash: 9F518471A056199FCB10EB65DC89A8EB7F5EF48304F1181FBA409F3291DB389E548F58

Function 0042E47C Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 135sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004265F0: htons.WS2_32(?), ref: 00426637
Part of subcall function 004265F0: gethostbyname.WS2_32(00000000), ref: 00426665
Part of subcall function 004265F0: connect.WS2_32(?,00000008,00000010), ref: 00426690
Part of subcall function 004265F0: WSAGetLastError.WS2_32(?,?,00000000,00000000), ref: 004266B9
Part of subcall function 004265F0: Sleep.KERNEL32(00000002,?,?,00000000,00000000), ref: 004266CA

Part of subcall function 004264A8: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 004264C7

Part of subcall function 00426468: setsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 0042647E

Part of subcall function 0042B474: lstrlenW.KERNEL32(00000000,00000000,0042B658,?,?,?,00000001), ref: 0042B4AE

Part of subcall function 0040B948: GetEnvironmentVariableW.KERNEL32(00000000,?,00000208,004866F8,0043D0E3,00000000,0043D13A,?,00486680,00000001,00000000,00000000,?,00437AE2,?,00000000), ref: 0040B95D
Part of subcall function 0040B948: GetLongPathNameW.KERNELBASE(?,?,00000208), ref: 0040B972

Sleep.KERNEL32(000001F4,0042E635,?,00000064,00000000,00000000,0042E65B,?,00000000,0042E67D), ref: 0042E61E

Part of subcall function 0042E088: lstrlenW.KERNEL32(00000000,00000000,0042E424,?,?,00000000,00000000), ref: 0042E0BD
Part of subcall function 0042E088: lstrlenW.KERNEL32(?,00000000,00000000,0042E424,?,?,00000000,00000000), ref: 0042E0C8

Strings

\Temp, xrefs: 0042E557
WINDIR, xrefs: 0042E545
8[B, xrefs: 0042E49B
HfH, xrefs: 0042E4BC
:, xrefs: 0042E571
\, xrefs: 0042E577

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: lstrlen$Sleepsetsockopt$EnvironmentErrorLastLongNamePathVariableconnectgethostbynamehtons
String ID: 8[B$:$HfH$WINDIR$\$\Temp
API String ID: 916843999-738507572
Opcode ID: a8029911b969878f78ac764834f3b201bdd0417c20dfb5ba0b09e840580c8ea6
Instruction ID: ba3bdb42cb812209f095133bc7201274ca052839750dfdcc6e646bdf85a6b18d
Opcode Fuzzy Hash: a8029911b969878f78ac764834f3b201bdd0417c20dfb5ba0b09e840580c8ea6
Instruction Fuzzy Hash: E2515AB4B10610AFD741EFAAEC51A5A37E5FB19308F82847AE400973E1EB789C41CB5C

Function 0040514C Relevance: 10.6, APIs: 7, Instructions: 131threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004053E8: GetCurrentThreadId.KERNEL32 ref: 004053EB

GetTickCount.KERNEL32 ref: 00405183
GetTickCount.KERNEL32 ref: 0040519B
GetCurrentThreadId.KERNEL32 ref: 004051CB
GetTickCount.KERNEL32 ref: 004051F6
GetTickCount.KERNEL32 ref: 0040522D
GetTickCount.KERNEL32 ref: 00405257
GetCurrentThreadId.KERNEL32 ref: 004052C7

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: f9d61921e35b482ef1f14d4eaeacaa075d63589b9816c89e841c04f0b3fb69e2
Instruction ID: e96b3358484ed09efb32f7bf407c562274a0588feb759182786de9b46f441b21
Opcode Fuzzy Hash: f9d61921e35b482ef1f14d4eaeacaa075d63589b9816c89e841c04f0b3fb69e2
Instruction Fuzzy Hash: EF418D30608B419FD721EE78C58431FBAD1EF94354F15897EE8D89B3C1EA7898818F5A

Function 0040BC54 Relevance: 9.1, APIs: 6, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040BC87
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,40000000,00000000), ref: 0040BCB8
HttpQueryInfoW.WININET(00000000,20000005,?,00000004,?), ref: 0040BCFA
InternetCloseHandle.WININET(00000000), ref: 0040BD8F

Part of subcall function 0040B634: VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004,00428AA0,?,?,00486734,00486680,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B63E

InternetReadFile.WININET(00000000,?,?,?), ref: 0040BD2F

Part of subcall function 0040B644: VirtualFree.KERNEL32(00000000,00000000,00008000,00428B66,?,?,00486734,00486680,00000000,00000000,00000000,00000000,00000000,00000000,?,00437E88), ref: 0040B64C

InternetCloseHandle.WININET(00000000), ref: 0040BDAE

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: Internet$CloseHandleOpenVirtual$AllocFileFreeHttpInfoQueryRead
String ID:
API String ID: 436716311-0
Opcode ID: 3e7517a180f2519e9ef8862004f9ea7d21659a34cfeb77de3d18cea408e80831
Instruction ID: 2d81d751fc6afc2710d3bfc5214d13ec27d882b95dc00282e94316269f0eb743
Opcode Fuzzy Hash: 3e7517a180f2519e9ef8862004f9ea7d21659a34cfeb77de3d18cea408e80831
Instruction Fuzzy Hash: 90417975A04208AFDB11DFA4DC95BAEB7B8EB49700F114476F505E3290DB389900CB68

Function 00402AC0 Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,FFFFFFDC,00402A8C), ref: 00402B77
Sleep.KERNEL32(0000000A,00000000,FFFFFFDC,00402A8C), ref: 00402B8D
Sleep.KERNEL32(00000000,?,?,FFFFFFDC,00402A8C), ref: 00402BBB
Sleep.KERNEL32(0000000A,00000000,?,?,FFFFFFDC,00402A8C), ref: 00402BD1

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 00e817329ed30a61a1e3ce9785030074bf56165d3748735972e8587115fb55d2
Instruction ID: e9b8b7081cf30ab9f8610f5ddeb7dffbd4721761cd41d76955e75723a6189a5d
Opcode Fuzzy Hash: 00e817329ed30a61a1e3ce9785030074bf56165d3748735972e8587115fb55d2
Instruction Fuzzy Hash: 89C149766013108FDB19CF29DB88316BBE0AB86314F18827FD444AB3D5C7B8D955CB9A

Function 004038AA Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 207COMMON

Download Yara Rule

Strings

\$@, xrefs: 00403A8A, 00403A98
0$@, xrefs: 00403A06, 00403A18
, xrefs: 00403BD9
7, xrefs: 00403A24

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID:
String ID: $0$@$7$\$@
API String ID: 0-4266993835
Opcode ID: 0898838d16f207543cc06ffe88efb152eba2014c6d30357a487cafd616e18d10
Instruction ID: b3e4678ffb9dae527c939fda3aba35b48a12a95a819a0055bfac3d4281ef8523
Opcode Fuzzy Hash: 0898838d16f207543cc06ffe88efb152eba2014c6d30357a487cafd616e18d10
Instruction Fuzzy Hash: 1881C730B042548FDB21DF2DC885B99BBF8AB4A709F0441F6E049F7382DB785A85CB59

Function 0041B6FC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,0041B8A8), ref: 0041B72F
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0041B753
GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0041B76E
LoadStringW.USER32(00000000,0000FFEA,?,00000100), ref: 0041B809

Strings

MZP, xrefs: 0041B76D

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: MZP
API String ID: 3990497365-2889622443
Opcode ID: 33485dccd570a2a0afe39b740a752237986253bc9c59ef7515bff66579f2bf26
Instruction ID: c27a278696c1af428c112a5138f6c708912e0e629acd6ed950e1bdc93ff39661
Opcode Fuzzy Hash: 33485dccd570a2a0afe39b740a752237986253bc9c59ef7515bff66579f2bf26
Instruction Fuzzy Hash: 19411F70A002589FDB20EF65CC81BCAB7B9EB88314F0040FAE508E7281D7799E95CF59

Function 0042C13C Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 105windowCOMMON

Download Yara Rule

APIs

GetWindowTextW.USER32(?,00485D2C,00000200), ref: 0042C179
IsWindowVisible.USER32(?), ref: 0042C239

Strings

(]H, xrefs: 0042C254
,]H, xrefs: 0042C1B7
,_H, xrefs: 0042C1E9

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: Window$TextVisible
String ID: (]H$,]H$,_H
API String ID: 1670992164-2296990632
Opcode ID: e467966b9a8c0fefa1ccc827f78f29989ba23366127c3093c9771cb756a8b563
Instruction ID: d95932ed8a37d93c08fe9a1a55fadeb8aae1f262f1f2142a84b6d5f9324e449e
Opcode Fuzzy Hash: e467966b9a8c0fefa1ccc827f78f29989ba23366127c3093c9771cb756a8b563
Instruction Fuzzy Hash: 7C319D31B00214AFEB01EBA1DC82EAE77B5EF48704F518477B50172191CA7D9D15972C

Function 0042BD88 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72registryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00465CA0,0042C023,?,00000064,00000000,00000000,0042C0D8), ref: 0042BDB6
RegisterClassW.USER32(00465CD8), ref: 0042BDC6
ShowWindow.USER32(?,00000001,00000000,?,00000000,00000000,0000015E,000001F4,?,?,100F0080), ref: 0042BE64
SetForegroundWindow.USER32(?), ref: 0042BE6F

Strings

RAT_Chat, xrefs: 0042BD9F, 0042BE36

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: Window$ClassForegroundHandleModuleRegisterShow
String ID: RAT_Chat
API String ID: 3776541383-1508558188
Opcode ID: 3da53fab4287da6ac28a1f121945f4a6c5748e60b917b128f9c393c7511c022f
Instruction ID: e3e0ff72afeb0ca95b62b861ee8d58a389ac77bdb3e2b56e9a420627b55a5118
Opcode Fuzzy Hash: 3da53fab4287da6ac28a1f121945f4a6c5748e60b917b128f9c393c7511c022f
Instruction Fuzzy Hash: DA211D75740B109BE710DF68EC45BA633E4EB04708F94853AF644DB3D1EBB9A804878E

Function 0040E83C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

GetUserObjectInformationW.USER32(00000000,00000002,?,00000100,?,?,004328AD,?,00000000,0043294A), ref: 0040E886
OpenWindowStationW.USER32(winsta0,00000000,0000037F), ref: 0040E8A8
SetProcessWindowStation.USER32(00000000,?,004328AD,?,00000000,0043294A), ref: 0040E8B4
OpenDesktopW.USER32(?,00000000,00000000,000001FF), ref: 0040E8CB

Strings

winsta0, xrefs: 0040E8A3

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: OpenStationWindow$DesktopInformationObjectProcessUser
String ID: winsta0
API String ID: 3539518509-3440837585
Opcode ID: 159005afdda627ef5a1ff0f0402107ecf24fb7b8575005aeb33b992befac07c1
Instruction ID: 07935d2aa83b5d675ff6c58e78f2920d5cf53bccb1719f4e7f0ccf1e20ed6600
Opcode Fuzzy Hash: 159005afdda627ef5a1ff0f0402107ecf24fb7b8575005aeb33b992befac07c1
Instruction Fuzzy Hash: 5C1124752443016FE310EBA9DC81F6B73EC6B45700F44483AB984EB3D1DAB9ED14972A

Function 004265F0 Relevance: 7.6, APIs: 5, Instructions: 97networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004265CC: socket.WS2_32(00000002,00000001,00000000), ref: 004265DB

htons.WS2_32(?), ref: 00426637
gethostbyname.WS2_32(00000000), ref: 00426665
connect.WS2_32(?,00000008,00000010), ref: 00426690
WSAGetLastError.WS2_32(?,?,00000000,00000000), ref: 004266B9
Sleep.KERNEL32(00000002,?,?,00000000,00000000), ref: 004266CA

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: ErrorLastSleepconnectgethostbynamehtonssocket
String ID:
API String ID: 2864911191-0
Opcode ID: 9f28b064d525dcda550846062e3a93fcd66620e325ef5e3ebc0512ee41a5b598
Instruction ID: 0dd1b41a93d19dc09989b8233b659783f6ed969359d15ac89dd0c57dc2224665
Opcode Fuzzy Hash: 9f28b064d525dcda550846062e3a93fcd66620e325ef5e3ebc0512ee41a5b598
Instruction Fuzzy Hash: 50319F74A002149FCB10DFA5D985A9E77B8FF48314F5284BAE904EB291D738CD44CB69

Function 0040BA5C Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000,00000000,?,0043F7E0), ref: 0040BA70
FindResourceW.KERNEL32(00000000,00000000,0000000A,00000000,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000), ref: 0040BA82
LoadResource.KERNEL32(00000000,00000000,00000000,0040BAD8,?,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680), ref: 0040BAA4
LockResource.KERNEL32(00000000,?,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000,00000000), ref: 0040BAB1
FreeResource.KERNEL32(00000000,0040BADF,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000,00000000,?,0043F7E0,00000000), ref: 0040BAD1

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: Resource$FindFreeHandleLoadLockModule
String ID:
API String ID: 2355082082-0
Opcode ID: 3f0eb233740970fe425e4189b138455d4fb9001c1d9e8dd3634329448ef4e4b8
Instruction ID: 1a3ff52bf1ac6d4834992fad00352ded9c14d174eaf5e093c7de7b05a94e74d9
Opcode Fuzzy Hash: 3f0eb233740970fe425e4189b138455d4fb9001c1d9e8dd3634329448ef4e4b8
Instruction Fuzzy Hash: 3101F776B41304BFE701ABB9AC85B2ABBECDB89715F150436F506E3281DA799D00866C

Function 0040BA58 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000,00000000,?,0043F7E0), ref: 0040BA70
FindResourceW.KERNEL32(00000000,00000000,0000000A,00000000,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000), ref: 0040BA82
LoadResource.KERNEL32(00000000,00000000,00000000,0040BAD8,?,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680), ref: 0040BAA4
LockResource.KERNEL32(00000000,?,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000,00000000), ref: 0040BAB1
FreeResource.KERNEL32(00000000,0040BADF,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000,00000000,?,0043F7E0,00000000), ref: 0040BAD1

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: Resource$FindFreeHandleLoadLockModule
String ID:
API String ID: 2355082082-0
Opcode ID: 42ae530f8878b1a679c5bb975ed892b2aba36b703ce15ae7888e2b82efbc6652
Instruction ID: 7bba7a99e39e5116ed02c681e27dab3f3a696a6cdaaff79990abd0375f4619b6
Opcode Fuzzy Hash: 42ae530f8878b1a679c5bb975ed892b2aba36b703ce15ae7888e2b82efbc6652
Instruction Fuzzy Hash: 2201A2B5B41300BFE711ABB59C99B2B7AECDB49704F154436F502E3291D6B89D008A6C

Function 0042A7F0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 290COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNEL32(000F001F,00000000,00000000,00000000,0042AC2E,?,?,?,00000001,0000000D,00000000,00000000,?,0042A482), ref: 0042A825

Part of subcall function 0040ACA4: lstrlenW.KERNEL32(00000000,?,?,00486730,?), ref: 0040ACDD

Strings

GG-Team, xrefs: 0042A8E7
Hr,g:, xrefs: 0042A8F1
/f&TleQ , xrefs: 0042AB4E

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: FileMappingOpenlstrlen
String ID: /f&TleQ $GG-Team$Hr,g:
API String ID: 290263465-1553010781
Opcode ID: 423f67120d0e721894976c1fa9bc8b348bc44398491a29f8b1c635831bf7f120
Instruction ID: 88ff79b281bd7af9570e5b325977c4e31f3e4296546c137c43f7e8822453c311
Opcode Fuzzy Hash: 423f67120d0e721894976c1fa9bc8b348bc44398491a29f8b1c635831bf7f120
Instruction Fuzzy Hash: 51B1D630740629AFDB04DBA2DD41FEEB3B6FF88705F904126B500B61C1D7BC69249B9A

Function 00426F90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,0042716D), ref: 00426FCA
CharUpperW.USER32(?,00000000,00000000,0042716D), ref: 00426FEE

Strings

:, xrefs: 00427001
|/Is\|, xrefs: 00426FD7, 004270C9, 0042711F

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: CharUpperlstrlen
String ID: :$|/Is\|
API String ID: 108730823-2327451341
Opcode ID: ba4b3e01cebbaa481af6e6a77b06f47b08762847adc1fc8c6b2a5010666fc814
Instruction ID: 93d54500de09d398291ab5124b2714aa455b2298479d6696639ba076840c05b2
Opcode Fuzzy Hash: ba4b3e01cebbaa481af6e6a77b06f47b08762847adc1fc8c6b2a5010666fc814
Instruction Fuzzy Hash: 24514934A041299BDB00EF99D841AEEBBB5FF48304F51807BF405B3351D7799A25CBA9

Function 004321E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

,fH, xrefs: 004321E7

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID:
String ID: ,fH
API String ID: 0-2243322645
Opcode ID: 444ee87d13a1e58113508bf6b43ac74097dd93d3b7794e398f154b7624a7e6a3
Instruction ID: 3e325106465cb2dd41976618392b57abfc7347bc5e4f7f75e8d06feff1e239a5
Opcode Fuzzy Hash: 444ee87d13a1e58113508bf6b43ac74097dd93d3b7794e398f154b7624a7e6a3
Instruction Fuzzy Hash: A7414D357052409FDB01DF99C9C0FE737A4AB0A750F1801BAFE499F68AC3A898418B76

Function 00405D48 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00405D81
FreeLibrary.KERNEL32(00400000,?,00000000,?,?,00405E86,00404023,0040406A,00000000,?,00404083,?,?,?,?,00486734), ref: 00405E22
ExitProcess.KERNEL32(00000000,?,00000000,?,?,00405E86,00404023,0040406A,00000000,?,00404083,?,?,?,?,00486734), ref: 00405E5E

Part of subcall function 00405CB8: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?,?,00405E86,00404023,0040406A,00000000,?), ref: 00405CF1
Part of subcall function 00405CB8: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?,?,00405E86,00404023,0040406A,00000000), ref: 00405CF7
Part of subcall function 00405CB8: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?), ref: 00405D12
Part of subcall function 00405CB8: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000), ref: 00405D18

Strings

MZP, xrefs: 00405E21

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: MZP
API String ID: 3490077880-2889622443
Opcode ID: d90ee3a893a0dc72c3848248a1873dcb725225a210599cc20fd1a5d12a6e168f
Instruction ID: e92a30f647e059f84c3662a5853805e55c155ad4ddc6fc357ea8e0081ace97c3
Opcode Fuzzy Hash: d90ee3a893a0dc72c3848248a1873dcb725225a210599cc20fd1a5d12a6e168f
Instruction Fuzzy Hash: 62315C34601B418BE761ABB9A48935B76E0EF45318F14483FE581A72D2D77CA884CF5E

Function 00405D50 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00405D81
FreeLibrary.KERNEL32(00400000,?,00000000,?,?,00405E86,00404023,0040406A,00000000,?,00404083,?,?,?,?,00486734), ref: 00405E22
ExitProcess.KERNEL32(00000000,?,00000000,?,?,00405E86,00404023,0040406A,00000000,?,00404083,?,?,?,?,00486734), ref: 00405E5E

Part of subcall function 00405CB8: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?,?,00405E86,00404023,0040406A,00000000,?), ref: 00405CF1
Part of subcall function 00405CB8: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?,?,00405E86,00404023,0040406A,00000000), ref: 00405CF7
Part of subcall function 00405CB8: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?), ref: 00405D12
Part of subcall function 00405CB8: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000), ref: 00405D18

Strings

MZP, xrefs: 00405E21

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: MZP
API String ID: 3490077880-2889622443
Opcode ID: 476567bd706faa08b2860b4bdb782b6af1774b5e27a4e3545c261a0e26a7b744
Instruction ID: b38e6e20968f9dd51013dd86da7a5adcd4d42222583a8947ff30ec8df154a19c
Opcode Fuzzy Hash: 476567bd706faa08b2860b4bdb782b6af1774b5e27a4e3545c261a0e26a7b744
Instruction Fuzzy Hash: 7E316D34600B418BE760AB69E48971B76E4EF45318F14443FE580A73D2D77CA884CF5D

Function 0040B5E8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Not Config,0040B610,?), ref: 0040B5FB
MessageBoxW.USER32(00000000,Not Config,GGT,?), ref: 0040B606

Strings

Not Config, xrefs: 0040B5F9, 0040B604
GGT, xrefs: 0040B603

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: Message
String ID: GGT$Not Config
API String ID: 2030045667-3135470170
Opcode ID: 4b8a4c59b1f7a2e123fa8cac472319ef520fd058445deb380fb68a97e84f0c4a
Instruction ID: 09803daf9443879b7dc9e8754dbd7872eb60d7eb9ad1f4574c2174cc229b4f7d
Opcode Fuzzy Hash: 4b8a4c59b1f7a2e123fa8cac472319ef520fd058445deb380fb68a97e84f0c4a
Instruction Fuzzy Hash: 0FD0A9A112432875D4202A130C02DB32A2CCC917A03088C3BB90472182863BAC2040FF

Function 00439284 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0048664C,00000000,00439427,?,?,?,?,00000000,00000000), ref: 004392B4
lstrlenW.KERNEL32(00000000,?,00439448,?,00439448,?,00439448,?,?,0048664C,00000000,00439427), ref: 00439396
LeaveCriticalSection.KERNEL32(0048664C,00439404,00439427,?,?,?,?,00000000,00000000), ref: 004393F7

Strings

4gH, xrefs: 004392E0

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: CriticalSection$EnterLeavelstrlen
String ID: 4gH
API String ID: 3224049430-2392367260
Opcode ID: 47defe703287ea594ae1c07abb13b2d47f8dddb316f1a99fff683f0de99b3499
Instruction ID: 4ccfdad5408f303f1bc6ef96d1109fe59f5890f2a7af6574d1485d49e1ed1b7c
Opcode Fuzzy Hash: 47defe703287ea594ae1c07abb13b2d47f8dddb316f1a99fff683f0de99b3499
Instruction Fuzzy Hash: 9541A031604208AFDB01EBA5CC42F9E77F8EB4D714F614076F500F72D1DAB9AE119A69

Function 0040B0EC Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 114memorystringCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001400,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B123
lstrlenW.KERNEL32(00000000,?,?,00000000,00001400,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0040B1DF
VirtualFree.KERNEL32(00000000,00000000,00008000,0040B218,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B20B

Strings

0.0.0.0, xrefs: 0040B1C5

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: Virtual$AllocFreelstrlen
String ID: 0.0.0.0
API String ID: 1037993708-3771769585
Opcode ID: 6564ce073df12d48193ef6cc336d6408e1dcfe9c11b139c9fa22ed32b664ca5a
Instruction ID: d9e483307b11907a1b336cc8d58400cd9b3fb6a4ef8d040ba9d6bd8e813edc8e
Opcode Fuzzy Hash: 6564ce073df12d48193ef6cc336d6408e1dcfe9c11b139c9fa22ed32b664ca5a
Instruction Fuzzy Hash: DC419270A40209AFEB01EB95CC92B9E77B8EB48304F5044BAF101F72D1D778AE14DB99

Function 00427EE0 Relevance: 6.1, APIs: 4, Instructions: 82stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32(00000202,?,00000000,00428009), ref: 00427F25
QueryDosDeviceW.KERNEL32(00000000,?,?,00000072,00000202,?,00000000,00428009), ref: 00427F7B
lstrlenW.KERNEL32(?,00000000,?,?,00000072,00000202,?,00000000,00428009), ref: 00427F87
StrCmpNIW.SHLWAPI(?,?,00000000,?,00000000,?,?,00000072,00000202,?,00000000,00428009), ref: 00427F97

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: DeviceDriveLogicalQueryStringslstrlen
String ID:
API String ID: 243930641-0
Opcode ID: a7e4fb706dae23cce2e3905365d5b76be73495882ece122b121f7eb275b18a5a
Instruction ID: c93e83704bf87b4d3c7b7635578ed03522896ac4e1c9abb0733d05025df9e800
Opcode Fuzzy Hash: a7e4fb706dae23cce2e3905365d5b76be73495882ece122b121f7eb275b18a5a
Instruction Fuzzy Hash: 51318775A052189FDB60EB25DC49A9E73B8EB48300F5185FBF409E3251EE38DE548F58

Function 0040B0EB Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 77memorystringCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001400,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B123
lstrlenW.KERNEL32(00000000,?,?,00000000,00001400,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0040B1DF
VirtualFree.KERNEL32(00000000,00000000,00008000,0040B218,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B20B

Strings

0.0.0.0, xrefs: 0040B1C5

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: Virtual$AllocFreelstrlen
String ID: 0.0.0.0
API String ID: 1037993708-3771769585
Opcode ID: 95f96f50283596cd0208414d3cbcbce02a8cb6110614ffbb8205cf7f9e9816dc
Instruction ID: 2a2c1df8ae4463708a3bec380d016629bdb2d6206de091ed7e9d638ff9ecaf91
Opcode Fuzzy Hash: 95f96f50283596cd0208414d3cbcbce02a8cb6110614ffbb8205cf7f9e9816dc
Instruction Fuzzy Hash: 4F217C70640204AFEB11EBA9C8A6B9E77A8EB49304F1044BAF501F76D1C7789950C699

Function 0042BA24 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0042BA43
SendMessageW.USER32(?,0000000D,?,00465D1C), ref: 0042BA86
SetWindowTextW.USER32(?,00000000), ref: 0042BACA
SetFocus.USER32(?,?,00000000,?,?,0000000E,00000000,00000000,00000000,0042BAF0,?,00000000), ref: 0042BAD5

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: MessageSend$FocusTextWindow
String ID:
API String ID: 2333564098-0
Opcode ID: a88227335cca2f77a9519455c1fe331fca11a6a158101077e538482d452faf54
Instruction ID: c5c6d1f71d7d5abd3f140a9d873e570a62db933a69622a8a51123b3dec96c00d
Opcode Fuzzy Hash: a88227335cca2f77a9519455c1fe331fca11a6a158101077e538482d452faf54
Instruction Fuzzy Hash: 97112E74640704ABD710EB55FC5AB5A73F8E748704FA0883AF5009B2E1D7F9A950875D

Function 00409428 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 004094F7
LocalFree.KERNEL32(006EE940,00000000), ref: 00409511

Strings

@n, xrefs: 0040944B

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: Free$LibraryLocal
String ID: @n
API String ID: 3007483513-632216509
Opcode ID: f1440c9207516d799bff01a95fb1b780083962cb9caf534dbe967da67f6cd1a4
Instruction ID: 794add6f56abb578411f7ef61ae6dacc1c24b6d74e6f65c8e1d29d9f289a045b
Opcode Fuzzy Hash: f1440c9207516d799bff01a95fb1b780083962cb9caf534dbe967da67f6cd1a4
Instruction Fuzzy Hash: 4731A472900105ABCB14DFA6D8C19BFB3B8AF84314B14453EE904B7382DB39DD41CBA8

Function 0040B29C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 0040B948: GetEnvironmentVariableW.KERNEL32(00000000,?,00000208,004866F8,0043D0E3,00000000,0043D13A,?,00486680,00000001,00000000,00000000,?,00437AE2,?,00000000), ref: 0040B95D
Part of subcall function 0040B948: GetLongPathNameW.KERNELBASE(?,?,00000208), ref: 0040B972

Part of subcall function 0040ACA4: lstrlenW.KERNEL32(00000000,?,?,00486730,?), ref: 0040ACDD

PathFileExistsW.SHLWAPI(00000000,?,?,00000000,00000000,Temp,?,00000000,0040B377,?,?,00486680,00000000,00000000,00000000,00000000), ref: 0040B31D

Strings

Temp, xrefs: 0040B2C0
Temp, xrefs: 0040B2E0, 0040B329

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: Path$EnvironmentExistsFileLongNameVariablelstrlen
String ID: Temp$Temp
API String ID: 2856746939-245102275
Opcode ID: fc830c92589ad5342fd4e66cf01ed2c17b86b29a44920e7f029c1e3a9a43f651
Instruction ID: 46c15489f3eb44522c785d134b2f827a4a98169e1fe77a71831a75c28b8f49eb
Opcode Fuzzy Hash: fc830c92589ad5342fd4e66cf01ed2c17b86b29a44920e7f029c1e3a9a43f651
Instruction Fuzzy Hash: 46215A70A00119AFDB01EBA1CC52DBFB7B9EF84304B61C47BB941B3690D77C9D1196A8

Function 0040B3B8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 0040B948: GetEnvironmentVariableW.KERNEL32(00000000,?,00000208,004866F8,0043D0E3,00000000,0043D13A,?,00486680,00000001,00000000,00000000,?,00437AE2,?,00000000), ref: 0040B95D
Part of subcall function 0040B948: GetLongPathNameW.KERNELBASE(?,?,00000208), ref: 0040B972

Part of subcall function 0040ACA4: lstrlenW.KERNEL32(00000000,?,?,00486730,?), ref: 0040ACDD

PathFileExistsW.SHLWAPI(00000000,?,?,00000000,00000000,Temp,?,00000000,0040B498,?,?,00486680,00000000,00000000,00000000,00000000), ref: 0040B43E

Strings

Temp, xrefs: 0040B401, 0040B44A
Temp, xrefs: 0040B3E1

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: Path$EnvironmentExistsFileLongNameVariablelstrlen
String ID: Temp$Temp
API String ID: 2856746939-245102275
Opcode ID: 7237d7c97321785c44f2b4371a02576726028b20681e666b8d51949dfb1120e9
Instruction ID: 320bcaab7f7199f54f19ef5aa5192f16669c5e948fce9d3d7dddb2f051f29b96
Opcode Fuzzy Hash: 7237d7c97321785c44f2b4371a02576726028b20681e666b8d51949dfb1120e9
Instruction Fuzzy Hash: 46215D70A001196FDB01EBA1CC51D6FB7B9EF84704F21C477B501B3295D77C9A1596A8

Function 0042A30C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0040ACA4: lstrlenW.KERNEL32(00000000,?,?,00486730,?), ref: 0040ACDD

OpenFileMappingW.KERNEL32(000F001F,00000000,00000000,00000000,00000000,00000000,0042A3BA,?,00486734,00486680,00000000,?,00437ED9,?,00000000,00437F69), ref: 0042A356
InitializeCriticalSection.KERNEL32(00465C80,?,00486734,00486680,00000000,?,00437ED9,?,00000000,00437F69,?,00000000,00000000,00000000,?,0043FD1C), ref: 0042A39F

Strings

_Share_GGT_, xrefs: 0042A33D

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: CriticalFileInitializeMappingOpenSectionlstrlen
String ID: _Share_GGT_
API String ID: 3694923735-3867152089
Opcode ID: 41f1d88d2d1c4f0c2cb4bbf11ab129d5343994423090c7a276e01615e93b37f1
Instruction ID: ce4900a62e11ce9a572bac5c0a59808664cb2c3850396779e9c8bc1c065c1da5
Opcode Fuzzy Hash: 41f1d88d2d1c4f0c2cb4bbf11ab129d5343994423090c7a276e01615e93b37f1
Instruction Fuzzy Hash: F3118674740310AFE710EB69DC42F2A73D9EB49B18FA1443BFD01E76D1D9B85C24865A

Function 0042743C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,00000000,004274B0,?,?,00486680,00000000,00000000,?,0043F226,?,00486734,00486680,00000000,00000000,00000000), ref: 00427469

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Strings

zalee:;'MEE, xrefs: 00427456
ZAO`elFyl{h}`fg^, xrefs: 00427477

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: AddressLibraryLoadProclstrlen
String ID: ZAO`elFyl{h}`fg^$zalee:;'MEE
API String ID: 2991167014-1447228337
Opcode ID: c820523d15c9dbf95b80c6cde00e35f83b407bfca9d4687b59677f06df80f873
Instruction ID: 077bc46651e9a40de25fcd03cddb1c768f49804e1acef1ba0aff0074e990fe41
Opcode Fuzzy Hash: c820523d15c9dbf95b80c6cde00e35f83b407bfca9d4687b59677f06df80f873
Instruction Fuzzy Hash: FAF0C231605718ABD711FBA1DC02B5DBBACEF45718FD2407AF800B7681D67CAE1046AD

Function 004303EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0043042A

Strings

Button, xrefs: 0043040B
#32770, xrefs: 004303F4

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: MessagePost
String ID: #32770$Button
API String ID: 410705778-3763930512
Opcode ID: 80110679f937891faa6f7cba931e5fed77503df53b31854cfd618e18af252cd2
Instruction ID: 28ed841a6425ce2d44e84357510c75fb6cb91fbfeaac2ff36796f76db45616d3
Opcode Fuzzy Hash: 80110679f937891faa6f7cba931e5fed77503df53b31854cfd618e18af252cd2
Instruction Fuzzy Hash: F3E086743C13026FE62097588CE6F1A63A85739B04F246176B700FB2E0CEE8EE14D61C

Function 0040B4DC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00486680,0043F20A,00000001,00000000,?,00486734,00486680,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B4E5

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Strings

Wow64DisableWow64FsRedirection, xrefs: 0040B4EC
kernel32.dll, xrefs: 0040B4E0

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 1646373207-3689287502
Opcode ID: 2dac5d5c5663db8a0450eab5fd166fe870256cbb9f231f614ab9bd4640426b9f
Instruction ID: 2aacd0a7d080d4f8486dfed4c2e02e9ea53df2493b021d7d88a6b83d7c6298d6
Opcode Fuzzy Hash: 2dac5d5c5663db8a0450eab5fd166fe870256cbb9f231f614ab9bd4640426b9f
Instruction Fuzzy Hash: 26C0129231272439E50071F91CC6EF7028CC9453AE31004B3F900F11C2E7AC4D2011EE

Function 0040B564 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00486680,0043F3D6,00000000,?,00486734,00486680,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B56D

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Strings

kernel32.dll, xrefs: 0040B568
Wow64RevertWow64FsRedirection, xrefs: 0040B574

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 1646373207-1355242751
Opcode ID: 95d41de4b2aaa3d5bceb4c6ece1da09edf5c32e92841572d0be30113edd33b41
Instruction ID: 8249db6378fdea734a8c5b5c79ccac93c87cf519fdf57918cf521f3dbb983d50
Opcode Fuzzy Hash: 95d41de4b2aaa3d5bceb4c6ece1da09edf5c32e92841572d0be30113edd33b41
Instruction Fuzzy Hash: 5CC002963563243DE65172F51CC69EB528CC9557AE36408B7FD00F11C3E7AD4D2111ED

Function 0043E4A4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,00000000,00000000,00000000,0043E626), ref: 0043E4B0

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Strings

NtUnmapViewOfSection, xrefs: 0043E4B7
ntdll.dll, xrefs: 0043E4AB

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 2574300362-1050664331
Opcode ID: 31b82d30f3ad7dba5dbea5cdbf4706ed8ff0013fde9a1af21a2c0f08b4647315
Instruction ID: 4e69b6650e6ade436c82b191c502fd32af055e20bfb3fd8e8d0f99f71a318bac
Opcode Fuzzy Hash: 31b82d30f3ad7dba5dbea5cdbf4706ed8ff0013fde9a1af21a2c0f08b4647315
Instruction Fuzzy Hash: 05C012523036103A911031E71C86D6B454CCCEAAB53105037B514E2182D4AC4C114179

Function 0041D238 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00443377,00000000,004433AE), ref: 0041D23E

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Strings

GetDiskFreeSpaceExW, xrefs: 0041D249
kernel32.dll, xrefs: 0041D239

Memory Dump Source

Source File: 0000000D.00000002.1956259311.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1956259311.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1956259311.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_TASLogin.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: a79e509d4b5e1b93e5af0388efdb664cba8b92b54a70f921204110405e308a7a
Instruction ID: 1ed0fb5f9b62a531acb68cd7a06d8274aa2f261e9248045f22735aa701152202
Opcode Fuzzy Hash: a79e509d4b5e1b93e5af0388efdb664cba8b92b54a70f921204110405e308a7a
Instruction Fuzzy Hash: 80D0A9F8E423604ED700EBE09DC6B823798879A308F0000BBB02057283CBBCC89C820C

Analysis Process: TASLogin.exePID: 3512, Parent PID: 2084COMMON

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	30

Executed Functions

Function 004087CC Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,0040888C,?,?), ref: 004087FE
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,0040888C,?,?), ref: 00408807

Part of subcall function 00408694: FindFirstFileW.KERNEL32(00000000,?,00000000,004086F2,?,00000001), ref: 004086C7
Part of subcall function 00408694: FindClose.KERNEL32(00000000,00000000,?,00000000,004086F2,?,00000001), ref: 004086D7

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: 71a8562c1639e1ddf01ead51905ade836cb6af30f3703f921b60b101e48ef570
Instruction ID: 27674f643491317e8211ebe2d51140b4d1dfb9d7c3ccf30eb47042a46c7f6e4d
Opcode Fuzzy Hash: 71a8562c1639e1ddf01ead51905ade836cb6af30f3703f921b60b101e48ef570
Instruction Fuzzy Hash: 67116070A001099FDB04FBA6D982AAEB3B8EF44304F51847FF945B32C1DB785E148A69

Function 00408694 Relevance: 3.0, APIs: 2, Instructions: 33
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,004086F2,?,00000001), ref: 004086C7
FindClose.KERNEL32(00000000,00000000,?,00000000,004086F2,?,00000001), ref: 004086D7

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: d5e053f3a7f238d708fda4e07e630be6dcb5cbe159ac088ae637e70b0fe2281d
Instruction ID: 4a504121526f8a262ed7674ff1de7294a9ef20f3b8a82b9cde2a0df277819a23
Opcode Fuzzy Hash: d5e053f3a7f238d708fda4e07e630be6dcb5cbe159ac088ae637e70b0fe2281d
Instruction Fuzzy Hash: 39F0E271500308AFC710FBB5CE1298EB7ECEB48314BA248BBB404F26C2EA3D9E10951C

Function 0040BDE8 Relevance: 220.0, APIs: 8, Strings: 117, Instructions: 1214
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(00000000,00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000,?,0043F7AA,00000000,0043FD8B,?,?,00486664), ref: 0040C220
LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000,?,0043F7AA,00000000,0043FD8B), ref: 0040C26E
LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000,?,0043F7AA,00000000,0043FD8B), ref: 0040CC32
LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000,?,0043F7AA,00000000,0043FD8B), ref: 0040CE58
LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000,?,0043F7AA,00000000), ref: 0040CEA6
LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000,?,0043F7AA), ref: 0040D030
LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000), ref: 0040D0CC
LoadLibraryW.KERNEL32(00000000,00000000,0040D177,?,00486680,00000040,00000000,00000000,?,0043F7AA,00000000,0043FD8B,?,?,00486664,00000000), ref: 0040BE1D

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,00000000), ref: 0040A4F2

Strings

JefzlMlzb}fy, xrefs: 0040C0C3
FylgD|}lq^, xrefs: 0040C985
Nl}]a{lhmJfg}lq}, xrefs: 0040C2F8
Yh}a@zM`{lj}f{p^, xrefs: 0040D08F
Nl}J|{{lg}Y{fjlzz@m, xrefs: 0040C7B1
Nl}Dlzzhnl^, xrefs: 0040BF58
O`gmGlq}O`el^, xrefs: 0040CB80
@g}l{gl}[lhmO`el, xrefs: 0040CF57
Dhy_`{}|heBlp^, xrefs: 0040C01E
Jefzl^`gmf~, xrefs: 0040BE50
^{`}lY{fjlzzDldf{p, xrefs: 0040C346
FylgJe`ykfh{m, xrefs: 0040C126
Nl}Zpz}ldDl}{`jz, xrefs: 0040C1AA
O`gmO`{z}O`el^, xrefs: 0040CB59
FylgY{fjlzz]fblg, xrefs: 0040CC6E
Kefjb@gy|}, xrefs: 0040BEF5
@yAeyHy`'MEE, xrefs: 0040CE42
A}}yX|l{p@gof^, xrefs: 0040CF30
Nl}Dfm|elO`elGhdl^, xrefs: 0040C78A
Zl}]a{lhmMlzb}fy, xrefs: 0040C0A2
bl{gle:;'MEE, xrefs: 0040C258
[lz|dl]a{lhm, xrefs: 0040C394
Zl}L{{f{Dfml, xrefs: 0040CB0B
[lnX|l{p_he|lLq^, xrefs: 0040CD7F
M`zyh}jaDlzzhnl^, xrefs: 0040BF9A
Zl}]a{lhmJfg}lq}, xrefs: 0040C36D
Nl}JehzzGhdl^, xrefs: 0040BE2F
J{lh}lD|}lq^, xrefs: 0040C95E
~`g`gl}'MEE, xrefs: 0040CE90
O{ll[lzf|{jl, xrefs: 0040CABD
O`gm^`gmf~Lq^, xrefs: 0040BED4
J{lh}lO`el^, xrefs: 0040C3E2
Oehza^`gmf~, xrefs: 0040BE92
J{lh}lO`elDhyy`gn^, xrefs: 0040C4CC
O`gm[lzf|{jl^, xrefs: 0040CA48
zae~hy`'MEE, xrefs: 0040D01A
Nl}_l{z`fgLq^, xrefs: 0040C6C7
[lnFylgBlp^, xrefs: 0040CCE3
Lq`}Y{fjlzz, xrefs: 0040C9D3
ZANl}Zylj`heOfeml{Efjh}`fg, xrefs: 0040D104
Nl}J|{{lg}Y{fjlzz, xrefs: 0040C7D8
Nl}^`gmf~]a{lhmY{fjlzz@m, xrefs: 0040C0E4
Nl}Zpz}ld]`dlHzO`el]`dl, xrefs: 0040C7FF
@g}l{gl}Zl}Jffb`l^, xrefs: 0040CFA5
O`el]`dl]fZpz}ld]`dl, xrefs: 0040C84D
Nl}EfgnYh}aGhdl^, xrefs: 0040C715
[lnLg|d_he|l^, xrefs: 0040CD58
@g}l{gl}Nl}Jffb`l^, xrefs: 0040CFCC
]{hgzeh}lDlzzhnl, xrefs: 0040BF79
ZANl}Yh}aO{fd@ME`z}^, xrefs: 0040D12B
Zl}O`elYf`g}l{, xrefs: 0040C409
Zl}Zpz}ldJ|{zf{, xrefs: 0040BF16
@g}l{gl}Fylg^, xrefs: 0040CEE2
\gdhy_`l~FoO`el, xrefs: 0040C51A
[lnJ{lh}lBlp^, xrefs: 0040CDCD
[lhmO`el, xrefs: 0040C47E
^{`}lO`el, xrefs: 0040C457
Nl}Je`ykfh{mMh}h, xrefs: 0040C147
ez}{jyp^, xrefs: 0040CBF5
\[EDFG'MEE, xrefs: 0040C20D
Nl}O`elZ`sl, xrefs: 0040C430
Z}{JdyG@^, xrefs: 0040D068
\[EMf~gefhm]fO`el^, xrefs: 0040C231
NefkheDldf{pZ}h}|z, xrefs: 0040C6A0
Nl}Hmhy}l{z@gof, xrefs: 0040CE69
[lnMlel}l_he|l^, xrefs: 0040CE1B
[lelhzlD|}lq, xrefs: 0040C9AC
|zl{:;'MEE, xrefs: 0040BE0A
[lnJefzlBlp, xrefs: 0040CD0A
[lelhzlMJ, xrefs: 0040C189
Nl}\zl{Ghdl^, xrefs: 0040CC47
ZaleeLqlj|}l^, xrefs: 0040D0DD
Nl}]`jbJf|g}, xrefs: 0040C3BB
[lnLg|dBlp^, xrefs: 0040CD31
Lg|d^`gmf~z, xrefs: 0040C060
Fylg@gy|}Mlzb}fy, xrefs: 0040C081
Nl}_fe|dl@gof{dh}`fg^, xrefs: 0040C937
@g}l{gl}JefzlAhgmel, xrefs: 0040CF7E
JefzlAhgmel, xrefs: 0040C4A5
J{lh}lM`{lj}f{p^, xrefs: 0040C62B
JefzlJe`ykfh{m, xrefs: 0040C168
Zl}O`elH}}{`k|}lz^, xrefs: 0040C910
O`gm^`gmf~^, xrefs: 0040BEB3
Lq`}^`gmf~zLq, xrefs: 0040C03F
Zl}J|{zf{Yfz, xrefs: 0040BFBB
Nl}BlpZ}h}l, xrefs: 0040C1EC
J{lh}lY`yl, xrefs: 0040C73C
@g}l{gl}Fylg\{e^, xrefs: 0040CF09
JfypO`el^, xrefs: 0040C58F
O`gmJefzl, xrefs: 0040CBA7
]l{d`gh}l]a{lhm, xrefs: 0040C679
[lhmY{fjlzzDldf{p, xrefs: 0040C31F
Nl}Mlzb}fy^`gmf~, xrefs: 0040C105
@g}l{gl}Zl}Fy}`fg^, xrefs: 0040CFF3
[lnZl}_he|lLq^, xrefs: 0040CDA6
Nl}Jfdy|}l{Ghdl^, xrefs: 0040CBCE
Efhm[lzf|{jl, xrefs: 0040CA6F
@g}l{gl}Nl}Jfgglj}lmZ}h}l, xrefs: 0040CEBB
Efjb[lzf|{jl, xrefs: 0040CA96
FylgY{fjlzz, xrefs: 0040C283
J{lh}l]a{lhm, xrefs: 0040C9FA
Nl}Y{fjlzz]`dlz, xrefs: 0040C826
Dhy_`l~FoO`el, xrefs: 0040C4F3
YllbGhdlmY`yl, xrefs: 0040C763
Yh}aO`elLq`z}z^, xrefs: 0040D041
^h`}Of{Z`gnelFkclj}, xrefs: 0040C8E9
Mlel}lO`el^, xrefs: 0040C604
[lnMlel}lBlp^, xrefs: 0040CDF4
Zpz}ldYh{hdl}l{z@gof^, xrefs: 0040BF37
Nl}HzpgjBlpZ}h}l, xrefs: 0040C1CB
J{lh}lY{fjlzz^, xrefs: 0040C2AA
]l{d`gh}lY{fjlzz, xrefs: 0040C652
^`gLqlj, xrefs: 0040CA21
zalee:;'MEE, xrefs: 0040D0B6
_`{}|heHeefjLq, xrefs: 0040C2D1
Nl}M`zbO{llZyhjlLq^, xrefs: 0040CB32
O`el]`dl]fEfjheO`el]`dl, xrefs: 0040C874

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: LibraryLoad$AddressProc$lstrlen
String ID: @g}l{gl}Fylg\{e^$@g}l{gl}Fylg^$@g}l{gl}JefzlAhgmel$@g}l{gl}Nl}Jffb`l^$@g}l{gl}Nl}Jfgglj}lmZ}h}l$@g}l{gl}Zl}Fy}`fg^$@g}l{gl}Zl}Jffb`l^$@g}l{gl}[lhmO`el$@yAeyHy`'MEE$A}}yX|l{p@gof^$Dhy_`l~FoO`el$Dhy_`{}|heBlp^$Efhm[lzf|{jl$Efjb[lzf|{jl$Fylg@gy|}Mlzb}fy$FylgD|}lq^$FylgJe`ykfh{m$FylgY{fjlzz$FylgY{fjlzz]fblg$JefzlAhgmel$JefzlJe`ykfh{m$JefzlMlzb}fy$Jefzl^`gmf~$JfypO`el^$J{lh}lD|}lq^$J{lh}lM`{lj}f{p^$J{lh}lO`elDhyy`gn^$J{lh}lO`el^$J{lh}lY`yl$J{lh}lY{fjlzz^$J{lh}l]a{lhm$Kefjb@gy|}$Lg|d^`gmf~z$Lq`}Y{fjlzz$Lq`}^`gmf~zLq$M`zyh}jaDlzzhnl^$Mlel}lO`el^$NefkheDldf{pZ}h}|z$Nl}BlpZ}h}l$Nl}Dfm|elO`elGhdl^$Nl}Dlzzhnl^$Nl}EfgnYh}aGhdl^$Nl}Hmhy}l{z@gof$Nl}HzpgjBlpZ}h}l$Nl}Je`ykfh{mMh}h$Nl}JehzzGhdl^$Nl}Jfdy|}l{Ghdl^$Nl}J|{{lg}Y{fjlzz$Nl}J|{{lg}Y{fjlzz@m$Nl}M`zbO{llZyhjlLq^$Nl}Mlzb}fy^`gmf~$Nl}O`elZ`sl$Nl}Y{fjlzz]`dlz$Nl}Zpz}ldDl}{`jz$Nl}Zpz}ld]`dlHzO`el]`dl$Nl}\zl{Ghdl^$Nl}]`jbJf|g}$Nl}]a{lhmJfg}lq}$Nl}^`gmf~]a{lhmY{fjlzz@m$Nl}_fe|dl@gof{dh}`fg^$Nl}_l{z`fgLq^$O`el]`dl]fEfjheO`el]`dl$O`el]`dl]fZpz}ld]`dl$O`gmGlq}O`el^$O`gmJefzl$O`gmO`{z}O`el^$O`gm[lzf|{jl^$O`gm^`gmf~Lq^$O`gm^`gmf~^$Oehza^`gmf~$O{ll[lzf|{jl$Yh}a@zM`{lj}f{p^$Yh}aO`elLq`z}z^$YllbGhdlmY`yl$ZANl}Yh}aO{fd@ME`z}^$ZANl}Zylj`heOfeml{Efjh}`fg$ZaleeLqlj|}l^$Zl}J|{zf{Yfz$Zl}L{{f{Dfml$Zl}O`elH}}{`k|}lz^$Zl}O`elYf`g}l{$Zl}Zpz}ldJ|{zf{$Zl}]a{lhmJfg}lq}$Zl}]a{lhmMlzb}fy$Zpz}ldYh{hdl}l{z@gof^$Z}{JdyG@^$[lelhzlD|}lq$[lelhzlMJ$[lhmO`el$[lhmY{fjlzzDldf{p$[lnFylgBlp^$[lnJefzlBlp$[lnJ{lh}lBlp^$[lnLg|dBlp^$[lnLg|d_he|l^$[lnMlel}lBlp^$[lnMlel}l_he|l^$[lnX|l{p_he|lLq^$[lnZl}_he|lLq^$[lz|dl]a{lhm$\[EDFG'MEE$\[EMf~gefhm]fO`el^$\gdhy_`l~FoO`el$]l{d`gh}lY{fjlzz$]l{d`gh}l]a{lhm$]{hgzeh}lDlzzhnl$^`gLqlj$^h`}Of{Z`gnelFkclj}$^{`}lO`el$^{`}lY{fjlzzDldf{p$_`{}|heHeefjLq$bl{gle:;'MEE$ez}{jyp^$zae~hy`'MEE$zalee:;'MEE$|zl{:;'MEE$~`g`gl}'MEE
API String ID: 2738378989-3024355689
Opcode ID: 425d9794fa0212803315e0c732f6b49e0cda1e53e6c546beca72f7af03797b15
Instruction ID: 4438aff9bfd592f4c2ae5199af2438c9166828cfa366d28cfe1c4cb90c63c00d
Opcode Fuzzy Hash: 425d9794fa0212803315e0c732f6b49e0cda1e53e6c546beca72f7af03797b15
Instruction Fuzzy Hash: 19A2AFB49113049BC740BBB6CCC29DD76ADEF45318F40857BB405BB282DA7C9D648BAE

Function 004082B8 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,004084DD,?,?), ref: 004082F1
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,004084DD,?,?), ref: 0040833A
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,004084DD,?,?), ref: 0040835C
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 0040837A
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 00408398
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 004083B6
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 004083D4
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,004084C0,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,004084DD), ref: 00408414
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,004084C0,?,80000001), ref: 0040843F
RegCloseKey.ADVAPI32(?,004084C7,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,004084C0,?,80000001,Software\Embarcadero\Locales), ref: 004084BA

Strings

Software\Borland\Delphi\Locales, xrefs: 004083CA
Software\CodeGear\Locales, xrefs: 00408370, 0040838E
Software\Borland\Locales, xrefs: 004083AC
Software\Embarcadero\Locales, xrefs: 00408330, 00408352

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: 014a0b9b99b7be46c737f40711a5b5c9164359921bb32e17d70cbc9f2a686574
Instruction ID: f754047bae0af19bad0102a25d5850afbc03eb5733155dacdeeb846caf687fb8
Opcode Fuzzy Hash: 014a0b9b99b7be46c737f40711a5b5c9164359921bb32e17d70cbc9f2a686574
Instruction Fuzzy Hash: A5513975B402097FEB20DAA5CD46FAE73BCEB08704F50447BBA44F65C1EAB89A40865D

Function 0043F770 Relevance: 24.9, APIs: 2, Strings: 12, Instructions: 400
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(00000030,00000000,0043FD8B,?,?,00486664,00000000,00000000,?,004436A7,00000000,004436EF,?,?,00000021,00000000), ref: 0043F7E6

Part of subcall function 0040B918: CompareStringW.KERNEL32(00000400,00000001,00000000,000000FF,00000000,000000FF,00486680,?,00437D4A,?,00000000,00437DA0,?,?,?,00486680), ref: 0040B939

Part of subcall function 00428590: LoadLibraryW.KERNEL32(00000000,00000000,004286D4,?,?,00486680,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0043F2F2), ref: 004285C3
Part of subcall function 00428590: LoadLibraryW.KERNEL32(00000000,00000000,00000000,004286D4,?,?,00486680,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042866C

Part of subcall function 0043DD30: ShowWindow.USER32(00020562,00000001,00486734,00486680,0043F9AE), ref: 0043DD3F

Part of subcall function 0043DD80: UnregisterClassW.USER32(Regedit_fast_jump,00400000), ref: 0043DD8B

Strings

$5_, xrefs: 0043F819
WINDIR, xrefs: 0043F883
XXX_, xrefs: 0043F861
$0_, xrefs: 0043F83D
Not Config, xrefs: 0043F7F2
_:E`}l'lql, xrefs: 0043FB9C
SOFTWARE\XXX_, xrefs: 0043F873
$1_, xrefs: 0043F84F
4gH, xrefs: 0043F787
$2_, xrefs: 0043F82B
j3U}lz}U}lz}, xrefs: 0043F947
GGT, xrefs: 0043F7ED

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: LibraryLoadWindow$ClassCompareForegroundShowStringUnregister
String ID: $0_$$1_$$2_$$5_$4gH$GGT$Not Config$SOFTWARE\XXX_$WINDIR$XXX_$_:E`}l'lql$j3U}lz}U}lz}
API String ID: 954628970-2741076856
Opcode ID: bc92d85b10e44bac47d5ed77af867d521b9c1cf5a18a2f9b64f3959704bf9c47
Instruction ID: 5e7b73b35abb561ea2aea0d9688f48cf422379d0deacb349a846aead5bae2168
Opcode Fuzzy Hash: bc92d85b10e44bac47d5ed77af867d521b9c1cf5a18a2f9b64f3959704bf9c47
Instruction Fuzzy Hash: 37E1A870A002154BDF10FB72D88279A33A5AF49308F10A4BBFC45AB697CB3D9D598B5D

Function 00407F84 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(0044CB84,00000000,00408088,?,?,?,00000000,?,00408950,00000000,004089AF,?,?,00000000,00000000,00000000), ref: 00407FA2
LeaveCriticalSection.KERNEL32(0044CB84,0044CB84,00000000,00408088,?,?,?,00000000,?,00408950,00000000,004089AF,?,?,00000000,00000000), ref: 00407FC6
LeaveCriticalSection.KERNEL32(0044CB84,0044CB84,00000000,00408088,?,?,?,00000000,?,00408950,00000000,004089AF,?,?,00000000,00000000), ref: 00407FD5
IsValidLocale.KERNEL32(00000000,00000002,0044CB84,0044CB84,00000000,00408088,?,?,?,00000000,?,00408950,00000000,004089AF), ref: 00407FE7
EnterCriticalSection.KERNEL32(0044CB84,00000000,00000002,0044CB84,0044CB84,00000000,00408088,?,?,?,00000000,?,00408950,00000000,004089AF), ref: 00408044
LeaveCriticalSection.KERNEL32(0044CB84,0044CB84,00000000,00000002,0044CB84,0044CB84,00000000,00408088,?,?,?,00000000,?,00408950,00000000,004089AF), ref: 0040806D

Strings

en-GB,en,en-US,, xrefs: 00407FB2, 00408059

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-GB,en,en-US,
API String ID: 975949045-3021119265
Opcode ID: f6d86eee62b6bf2d3840db3cc2fcc52f00c729b128c34464cea3ae48f6cc2a76
Instruction ID: 89e35a22fce1ca92aca6ca6f157c9b85d33dba724616c188b81eab689516efc9
Opcode Fuzzy Hash: f6d86eee62b6bf2d3840db3cc2fcc52f00c729b128c34464cea3ae48f6cc2a76
Instruction Fuzzy Hash: A421EE3470564157E710B7BA9D9371A3188CB45748F66407FB081B62D7CEBCAC04877E

Function 0043D9B0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowTextW.USER32(000B0068,00000000), ref: 0043DA7F
DefWindowProcW.USER32(?,?,?,?,00000000,0043DB6A), ref: 0043DB4D

Strings

BUTTON, xrefs: 0043DA43
Fast jump, xrefs: 0043DA3E
MZP, xrefs: 0043DA0A, 0043DA3B
HKEY_CURRENT_USER\Control Panel\Desktop, xrefs: 0043DA5D
EDIT, xrefs: 0043DA0D

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: Window$ProcText
String ID: BUTTON$EDIT$Fast jump$HKEY_CURRENT_USER\Control Panel\Desktop$MZP
API String ID: 2218353596-2216858624
Opcode ID: e69d02082d12059add0810c350757150de9edb807d28e4ce6e4d838992b731ef
Instruction ID: 29dd7edaff14d80a172b70b85ca7432f0e91f08ba1914f13b3f7aed7ea465baa
Opcode Fuzzy Hash: e69d02082d12059add0810c350757150de9edb807d28e4ce6e4d838992b731ef
Instruction Fuzzy Hash: A8316F75A04208ABEB10EF69EC52F6E73E8EB0C700F525436F900EB2D1D678ED109769

Function 0040B654 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 80
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,0040B734,?,?,00486734,00486680), ref: 0040B67A
LoadLibraryW.KERNEL32(kernel32.dll,kernel32.dll,00000000,0040B734,?,?,00486734,00486680), ref: 0040B68A
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,00000000,kernel32.dll,00000000,0040B734,?,?,00486734,00486680), ref: 0040B6DD
GetNativeSystemInfo.KERNEL32(?,?,?,00486734,00486680), ref: 0040B6FE

Strings

kernel32.dll, xrefs: 0040B675, 0040B685
@z^f~?=Y{fjlzz, xrefs: 0040B69C

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: CurrentHandleInfoLibraryLoadModuleNativeProcessSystem
String ID: @z^f~?=Y{fjlzz$kernel32.dll
API String ID: 407697875-2470416289
Opcode ID: cf400a607496727c57d8b79e2d90979a375013f491e65cfe34c017647f0dda60
Instruction ID: cc312165b627e4cdb14975307c8c75a868c5ce4217f7475409fe1e9344262d1c
Opcode Fuzzy Hash: cf400a607496727c57d8b79e2d90979a375013f491e65cfe34c017647f0dda60
Instruction Fuzzy Hash: 2121BE31901315AEC712ABB98C51AEF72A8EB85718F954437F800B73C1EB3C8C1596EE

Function 0043DC14 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 61
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,00486734,00486680,0043F7AF,00000000,0043FD8B,?,?,00486664,00000000,00000000,?,004436A7,00000000,004436EF), ref: 0043DC42
RegisterClassW.USER32(00486C08), ref: 0043DC52
KiUserCallbackDispatcher.NTDLL(00000000,00000000,00486734,00486680,0043F7AF,00000000,0043FD8B,?,?,00486664,00000000,00000000,?,004436A7,00000000,004436EF), ref: 0043DC65

Strings

Regedit fast jump V1.2, xrefs: 0043DCB4
Regedit_fast_jump, xrefs: 0043DC2B, 0043DCB9

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: CallbackClassDispatcherHandleModuleRegisterUser
String ID: Regedit fast jump V1.2$Regedit_fast_jump
API String ID: 2026650474-4282503210
Opcode ID: cc5dc9e7916a9fd9ffcc6e7132985b69ea0554bfb4b0e75fc1fa52871a3855d4
Instruction ID: ff227f2102c6a89d754623d3dc831d9a7ff48536fe2538a773c3bd321e84cfba
Opcode Fuzzy Hash: cc5dc9e7916a9fd9ffcc6e7132985b69ea0554bfb4b0e75fc1fa52871a3855d4
Instruction Fuzzy Hash: 16113AB5B517105FE3A0DF68ED85B6A32E4EB08708F01593EF645DB2D0DBB9A8048B49

Function 00407E68 Relevance: 6.1, APIs: 4, Instructions: 95
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetThreadUILanguage.KERNELBASE(?,00000000), ref: 00407E79
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 00407ED7
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 00407F34
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 00407F67

Part of subcall function 00407E24: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,00407EE5), ref: 00407E3B
Part of subcall function 00407E24: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,00407EE5), ref: 00407E58

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 64e88a95cc42ba7287f90517dc0aa7ad91b6f4ea3144bac7362c88a4aa254beb
Instruction ID: c64547fa24ced421637df5c0631d32c6e461f39fc0f139bc27309100008ee978
Opcode Fuzzy Hash: 64e88a95cc42ba7287f90517dc0aa7ad91b6f4ea3144bac7362c88a4aa254beb
Instruction Fuzzy Hash: 63317230E0511A9BDB10DFA5D885AAEB7B8FF04304F0045BAE515F72D1D778AE05CB99

Function 0040A748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,Regedit_fast_jump,0043D9B0,?,?,?,00000005,?,?,?,?,?), ref: 0040A787

Strings

Regedit fast jump V1.2, xrefs: 0040A74B
Regedit_fast_jump, xrefs: 0040A785

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: CreateWindow
String ID: Regedit fast jump V1.2$Regedit_fast_jump
API String ID: 716092398-4282503210
Opcode ID: 52ed684031a3f60b859464a8a3777d52d3d04c0f90a715adbf70d004a935ed74
Instruction ID: a517241aa0c29f4206de9bdbe5aa9f665dbdabb8af3f7c10e9afbeb71ed45618
Opcode Fuzzy Hash: 52ed684031a3f60b859464a8a3777d52d3d04c0f90a715adbf70d004a935ed74
Instruction Fuzzy Hash: 1FF074B6700118AF8B44DE9DDC81DDF77ECEB8D264B054129BA08E3201D634ED1187A4

Function 00408898 Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,004089AF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00408A36,00000000,?,00000105), ref: 00408943
GetSystemDefaultUILanguage.KERNEL32(00000000,004089AF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00408A36,00000000,?,00000105), ref: 0040896B

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: 60f1217627a62caf21864717d1d1ffa422a3aae7c1e8c1ff22f971d71f3af604
Instruction ID: d299ade2d0cde5e0e6b4ac4308b209071da85b2919ee7819c01997859eb2786b
Opcode Fuzzy Hash: 60f1217627a62caf21864717d1d1ffa422a3aae7c1e8c1ff22f971d71f3af604
Instruction Fuzzy Hash: F8314C70A002099BDB10FBA9C981BAEB7B4AB44304F60447FE481B33D1DB7CAD45CB5A

Function 004089BC Relevance: 3.1, APIs: 2, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,00408A76,?,00400000,00444C08), ref: 004089F8
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,00408A76,?,00400000,00444C08), ref: 00408A49

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: 4b5f65d131dd44abe89ba08c5592b5a98fb8228b2147084425797af8f58d8da9
Instruction ID: ff3da6a666be0d6ffa05517e973b0afc017d91cd30ce0c1a03a3bebe0d5e188f
Opcode Fuzzy Hash: 4b5f65d131dd44abe89ba08c5592b5a98fb8228b2147084425797af8f58d8da9
Instruction Fuzzy Hash: 03116031A4021C9BDB14EB60CD86BDD73B8DB04304F5140BBB509B22D1DA785E848AA8

Function 0040B948 Relevance: 3.0, APIs: 2, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentVariableW.KERNEL32(00000000,?,00000208,004866F8,0043D0E3,00000000,0043D13A,?,00486680,00000001,00000000,00000000,?,00437AE2,?,00000000), ref: 0040B95D
GetLongPathNameW.KERNELBASE(?,?,00000208), ref: 0040B972

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: EnvironmentLongNamePathVariable
String ID:
API String ID: 2057972008-0
Opcode ID: 15b9029d297ef0175ab10ccc5325bcd8575cfd201a7f1f65d94be1b2a52fba4c
Instruction ID: dc435742a546365fcd1a1d8ae548f6de60c2f229cc9ad4274613245ab6a971ca
Opcode Fuzzy Hash: 15b9029d297ef0175ab10ccc5325bcd8575cfd201a7f1f65d94be1b2a52fba4c
Instruction Fuzzy Hash: DAE086FAA0030067D3409794DC89C8B77AD9BC8710F04C53A7699C2291EA3899045762

Function 0043A7B4 Relevance: 1.6, APIs: 1, Instructions: 79fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0043A7D9

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e6026e072492908bd2ac8bec586b219015e7024cba609ac1c8d8e6f45bb31c07
Instruction ID: effb560f06ffb086691e009eb791961bbbf3811e5e89f95771296192e7b8b082
Opcode Fuzzy Hash: e6026e072492908bd2ac8bec586b219015e7024cba609ac1c8d8e6f45bb31c07
Instruction Fuzzy Hash: AD213A753402007FE220EB5DDC85F6B33D8EB89B20F504135FA58EB2E0DA70AD099769

Function 00407744 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00400000,?,0000020A), ref: 00407762

Part of subcall function 004089BC: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,00408A76,?,00400000,00444C08), ref: 004089F8
Part of subcall function 004089BC: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,00408A76,?,00400000,00444C08), ref: 00408A49

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: 358e5c818d4021d8e6dfb070530815b4a7e06f116bb450956073f4b4dbaad43c
Instruction ID: 0c0d8af671378e37ef2f8f11867f171fa8a64e733914af962fdd6609c9811da0
Opcode Fuzzy Hash: 358e5c818d4021d8e6dfb070530815b4a7e06f116bb450956073f4b4dbaad43c
Instruction Fuzzy Hash: 84E0C9B1A003109BCB14EFA8CAC5A563794AB18754F0445AAED68DF386D375E910C7D6

Function 00426564 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,0045F0B0), ref: 0042656E

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: 3edcd535bb5d69f2c68979e5168ea0cfe4d657896c45878ceb297bf3764585b6
Instruction ID: 44ae0b0028eb01218a78a6d63e91cbd5235d5447584bcb4ff0911ab5febe76ad
Opcode Fuzzy Hash: 3edcd535bb5d69f2c68979e5168ea0cfe4d657896c45878ceb297bf3764585b6
Instruction Fuzzy Hash: C3B01232362340CED6002B711D0EB4B2E544701ED3F0C40BA7840C50F3C594C00C8B2F

Function 00408F10 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00408F14

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 229177a228d713a9a14fcff98108d9cc5e97c52a54c35a4239ee1928f04f60af
Instruction ID: 2d2288808e5448b03cee85edb9978ee3a4aa03205f7dde6b98229f7bffd1799a
Opcode Fuzzy Hash: 229177a228d713a9a14fcff98108d9cc5e97c52a54c35a4239ee1928f04f60af
Instruction Fuzzy Hash: CCA012104085020BC908E7294D4340F31801940118FC402247C5CA96C2E62D856442DB

Function 0043D50C Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000,0043F16D,00000000,0043F406,?,00486734,00486680,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0043F560), ref: 0043D514

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: a0191236da1e67e117a1b66312cff757390ddd695378a7c2c551f2080355b048
Instruction ID: 0a4ffff9a5bd2a53c67e581a33889ca5d833dc331c66d4bcfab812d2debc2eb1
Opcode Fuzzy Hash: a0191236da1e67e117a1b66312cff757390ddd695378a7c2c551f2080355b048
Instruction Fuzzy Hash: D7A002BC2010008F8640EB6DDC80D09B3E8AB8E20171040A5F814C7334CF70AD049F15

Function 004027A8 Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,00402DBB,FFFFFFDC,00402A8C), ref: 004027BE

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6e83b55374e38ba348886defc969fcf363bb13e5c12b6dfeb1a80ee92d75bf7a
Instruction ID: d7f275c02b8ff420755371fd827dccc32f36ce75ba3383e112499b9bd2685023
Opcode Fuzzy Hash: 6e83b55374e38ba348886defc969fcf363bb13e5c12b6dfeb1a80ee92d75bf7a
Instruction Fuzzy Hash: 4AF049B1B803404BEB09DF798E853027AD6A78A304F24803EE508FB7E9E6B48415CB09

Non-executed Functions

Function 004080C8 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00416CA8,?,?), ref: 004080E5
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 004080F6
FindFirstFileW.KERNEL32(?,?,kernel32.dll,00416CA8,?,?), ref: 004081F6
FindClose.KERNEL32(?,?,?,kernel32.dll,00416CA8,?,?), ref: 00408208
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,00416CA8,?,?), ref: 00408214
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,00416CA8,?,?), ref: 00408259

Strings

kernel32.dll, xrefs: 004080E0
\, xrefs: 00408226
GetLongPathNameW, xrefs: 004080F0

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: c0075b3f116daeefb17eaddd3ceca8e9c16820536a0e8076f9c9bbe445cf2216
Instruction ID: 9b698579dee47a5ce6c7e6d575a683c27756de6a4c8f4362d234e3b766aaeab0
Opcode Fuzzy Hash: c0075b3f116daeefb17eaddd3ceca8e9c16820536a0e8076f9c9bbe445cf2216
Instruction Fuzzy Hash: 6F41B431E006189BCB10EBA9CD85ADE73B5AF44310F1445FE9944F72D4EBBCAE41CA59

Function 00431870 Relevance: 33.4, APIs: 3, Strings: 16, Instructions: 168libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,00000000,00431AB5,?,00486680,00000000,00000000,?,00437EA6,?,00000000,00437F69,?,00000000,00000000,00000000), ref: 004318A4
GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004319C9

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,00000000), ref: 0040A4F2

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00431A4D

Strings

J{lh}lM@KZlj}`fg, xrefs: 00431932
M~dLghkelJfdyfz`}`fg, xrefs: 00431A7C
nm`:;'MEE, xrefs: 00431891
Nl}J|{zf{@gof, xrefs: 00431A19
Nl}J|{zf{Yfz, xrefs: 004319F8
M^DHY@'MEE, xrefs: 00431A3A
Nl}J|{{lg}Fkclj}, xrefs: 004318AE
Zlelj}Fkclj}, xrefs: 00431953
Nl}MJ, xrefs: 004319D7
|zl{:;'MEE, xrefs: 004319B6
K`}Ke}, xrefs: 00431974
Nl}M@K`}z, xrefs: 004318CF
Mlel}lMJ, xrefs: 00431995
J{lh}lJfdyh}`kelMJ, xrefs: 00431911
M~d@zJfdyfz`}`fgLghkelm, xrefs: 00431A5B
Mlel}lFkclj}, xrefs: 004318F0

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: AddressLibraryLoadProc$HandleModulelstrlen
String ID: J{lh}lJfdyh}`kelMJ$J{lh}lM@KZlj}`fg$K`}Ke}$M^DHY@'MEE$Mlel}lFkclj}$Mlel}lMJ$M~d@zJfdyfz`}`fgLghkelm$M~dLghkelJfdyfz`}`fg$Nl}J|{zf{@gof$Nl}J|{zf{Yfz$Nl}J|{{lg}Fkclj}$Nl}M@K`}z$Nl}MJ$Zlelj}Fkclj}$nm`:;'MEE$|zl{:;'MEE
API String ID: 9417994-4209024249
Opcode ID: 46f01f209ac1517e14f76089b48cfb9a6098342ea4fa0bf20f801332cc3d7d5f
Instruction ID: d210e15e72295cd6b726f6c75a30a71111ee1474a08510ed185e98678324d597
Opcode Fuzzy Hash: 46f01f209ac1517e14f76089b48cfb9a6098342ea4fa0bf20f801332cc3d7d5f
Instruction Fuzzy Hash: CB517D759113049BCB40FBA6CC828DE77ADEF48318F41993BB401B6396EA7C98144BAD

Function 00425F00 Relevance: 31.7, APIs: 1, Strings: 17, Instructions: 184libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B,?,?,00486664,00000000,00000000), ref: 00425F34

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,00000000), ref: 0040A4F2

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

Strings

nl}zfjbfy}, xrefs: 004260CA
nl}afz}kpghdl, xrefs: 00425FA1
jfgglj}, xrefs: 00426067
jefzlzfjbl}, xrefs: 00426088
a}fgz, xrefs: 00426046
^ZH@fj}e, xrefs: 00425F3E
~z;V:;'MEE, xrefs: 00425F21
^ZHNl}Ehz}L{{f{, xrefs: 00425F5F
^ZHZ}h{}|y, xrefs: 00425F80
zlgm, xrefs: 00426004
`gl}Vg}fh, xrefs: 004260EB
`gl}Vhmm{, xrefs: 0042610C
zfjbl}, xrefs: 00425FC2
zlelj}, xrefs: 0042614E
g}faz, xrefs: 0042612D
zl}zfjbfy}, xrefs: 004260A9
za|}mf~g, xrefs: 00425FE3

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: AddressProc$LibraryLoadlstrlen
String ID: ^ZH@fj}e$^ZHNl}Ehz}L{{f{$^ZHZ}h{}|y$`gl}Vg}fh$`gl}Vhmm{$a}fgz$g}faz$jefzlzfjbl}$jfgglj}$nl}afz}kpghdl$nl}zfjbfy}$za|}mf~g$zfjbl}$zlelj}$zlgm$zl}zfjbfy}$~z;V:;'MEE
API String ID: 1729337914-1815106237
Opcode ID: 8f734a74b5820445d690829d2c52daff7a50941e13d6a135ceb200ec9b92a943
Instruction ID: 5c4a131c88f9612ba7b75e74eb8d09919213aae810613ce822a12766d2a0e463
Opcode Fuzzy Hash: 8f734a74b5820445d690829d2c52daff7a50941e13d6a135ceb200ec9b92a943
Instruction Fuzzy Hash: A66153B56113049ACB00FBB5DC828DE77ADEF44319B81857BB401B7297DA7C98148BAE

Function 00432368 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 00432373
LoadCursorW.USER32(00000000,00007F01), ref: 00432385
LoadCursorW.USER32(00000000,00007F02), ref: 00432397
LoadCursorW.USER32(00000000,00007F03), ref: 004323A9
LoadCursorW.USER32(00000000,00007F04), ref: 004323BB
LoadCursorW.USER32(00000000,00007F80), ref: 004323CD
LoadCursorW.USER32(00000000,00007F81), ref: 004323DF
LoadCursorW.USER32(00000000,00007F82), ref: 004323F1
LoadCursorW.USER32(00000000,00007F83), ref: 00432403
LoadCursorW.USER32(00000000,00007F84), ref: 00432415
LoadCursorW.USER32(00000000,00007F85), ref: 00432427
LoadCursorW.USER32(00000000,00007F86), ref: 00432439
LoadCursorW.USER32(00000000,00007F88), ref: 0043244B
LoadCursorW.USER32(00000000,00007F89), ref: 0043245D
LoadCursorW.USER32(00000000,00007F8A), ref: 0043246F
LoadCursorW.USER32(00000000,00007F8B), ref: 00432481
DestroyIcon.USER32(?,00000000,00007F8B,00000000,00007F8A,00000000,00007F89,00000000,00007F88,00000000,00007F86,00000000,00007F85,00000000,00007F84,00000000), ref: 00432496

Strings

d, xrefs: 004324AB

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: CursorLoad$DestroyIcon
String ID: d
API String ID: 4160882069-2564639436
Opcode ID: bf7c25c0758c83dd8361d29cf79b8cbd3adabcf9f3f7ee9b71b899f0064be9ea
Instruction ID: eca3b65f90c1fbf3b1966a39f07301b07b48cd0bd549073b7d2622b705562fcd
Opcode Fuzzy Hash: bf7c25c0758c83dd8361d29cf79b8cbd3adabcf9f3f7ee9b71b899f0064be9ea
Instruction Fuzzy Hash: 54315974A9C3016AF7507F614883BB639619B00B05F09457AFF4C6E2C7EBB914544BAB

Function 00436E6C Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 290sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0040B4DC: GetModuleHandleW.KERNEL32(kernel32.dll,?,00486680,0043F20A,00000001,00000000,?,00486734,00486680,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B4E5

OutputDebugStringW.KERNEL32(00000000), ref: 004370E3
Sleep.KERNEL32(000003E8,00000000), ref: 004370ED
OutputDebugStringW.KERNEL32(00000000), ref: 00437113
DuplicateHandle.KERNEL32(00000000), ref: 00437150
Sleep.KERNEL32(0000000A,00000000), ref: 004371B6

Part of subcall function 00436E28: Sleep.KERNEL32(0000000A), ref: 00436E53

DuplicateHandle.KERNEL32(00000000), ref: 004371AD
OutputDebugStringW.KERNEL32(00000000), ref: 00437072

Part of subcall function 0040B918: CompareStringW.KERNEL32(00000400,00000001,00000000,000000FF,00000000,000000FF,00486680,?,00437D4A,?,00000000,00437DA0,?,?,?,00486680), ref: 0040B939

Strings

D, xrefs: 00436FFC
SysWOW64\cmd.exe, xrefs: 00436F39
OK , xrefs: 0043705F
SysWOW64\conime.exe, xrefs: 00436F85
BH---------------------, xrefs: 00437100
4gH, xrefs: 00436E86
NO , xrefs: 004370D0
wbem\WmiPrvSE.exe, xrefs: 00436FD1
SysWOW64\wbem\WmiPrvSE.exe, xrefs: 00436F5F
system32\cmd.exe, xrefs: 00436FAB

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: String$DebugHandleOutputSleep$Duplicate$CompareModule
String ID: 4gH$BH---------------------$D$NO $OK $SysWOW64\cmd.exe$SysWOW64\conime.exe$SysWOW64\wbem\WmiPrvSE.exe$system32\cmd.exe$wbem\WmiPrvSE.exe
API String ID: 1574471335-2317324235
Opcode ID: 8a35ef10e14ccf33a42443dbd4394bd668ecb9194afc7e98b384c13bee5a23bd
Instruction ID: f05568c7d4dfcf692034845640a9875653ac5b9122fc9bc2ab6e3659e48a1b66
Opcode Fuzzy Hash: 8a35ef10e14ccf33a42443dbd4394bd668ecb9194afc7e98b384c13bee5a23bd
Instruction Fuzzy Hash: BCB15F74604205AFDB10EFA9C885B9E77E8EF49304F10407AF949EB395DB38AD04DB69

Function 0043DDC4 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 136windowsleepCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000001), ref: 0043DE20
SetForegroundWindow.USER32(?), ref: 0043DE58
SetForegroundWindow.USER32(00000000), ref: 0043DE5E
SetFocus.USER32(00000000,00000000,?), ref: 0043DE64
SendMessageW.USER32(00000000,00000100,00000027,00000000), ref: 0043DE78
SendMessageW.USER32(00000000,00000102,?,00000000), ref: 0043DEAD
SendMessageW.USER32(00000000,00000100,00000027,00000000), ref: 0043DEBE
Sleep.KERNEL32(000000C8,00000000,00000100,00000027,00000000,00000000,00000000,?), ref: 0043DED2
SetForegroundWindow.USER32(00000000), ref: 0043DEF1
SetFocus.USER32(00000000,00000000), ref: 0043DEF7
SendMessageW.USER32(00000000,00000100,00000024,00000000), ref: 0043DF06
SendMessageW.USER32(00000000,00000102,?,00000000), ref: 0043DF34

Strings

RegEdit_RegEdit, xrefs: 0043DDDA, 0043DE05
SysTreeView32, xrefs: 0043DE3C
regedit.exe, xrefs: 0043DDF5
SysListView32, xrefs: 0043DED9

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: MessageSend$Window$Foreground$Focus$ShowSleep
String ID: RegEdit_RegEdit$SysListView32$SysTreeView32$regedit.exe
API String ID: 2024206484-319980174
Opcode ID: a6ada2b0a3f51e6a3f696ae2be7fe5d5f0b08d7e2f9d3f57d138b3c66f60823b
Instruction ID: ba1137598a63224ba6c654e925c15ac110f6c28f76abf197ed28cf60a58f3b56
Opcode Fuzzy Hash: a6ada2b0a3f51e6a3f696ae2be7fe5d5f0b08d7e2f9d3f57d138b3c66f60823b
Instruction Fuzzy Hash: CF41A370A44301BBE221EB58DCC6F3F36E4AB99B04F10442AF584EF2D1D6B8DC40931A

Function 0042FE9C Relevance: 24.6, APIs: 2, Strings: 12, Instructions: 139libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,00000000,0043007B,?,00486680,00000005,00000000,00000000,?,00437EAB,?,00000000,00437F69,?,00000000,00000000), ref: 0042FED1
LoadLibraryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0043007B,?,00486680,00000005,00000000,00000000,?,00437EAB,?), ref: 0042FF30

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,00000000), ref: 0040A4F2

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

Strings

@JNl}@gof, xrefs: 0042FF5B
jhyJ{lh}lJhy}|{l^`gmf~^, xrefs: 0042FEDB
H_@JHY:;'MEE, xrefs: 0042FEBE
@JFylg, xrefs: 00430000
@JJfdy{lzzf{O{ll, xrefs: 0042FFDF
@JZlxJfdy{lzzO{hdlZ}h{}, xrefs: 0042FF7C
@JJefzl, xrefs: 00430021
@JZlgmDlzzhnl, xrefs: 00430042
@JZlxJfdy{lzzO{hdl, xrefs: 0042FFBE
DZ_O^:;'MEE, xrefs: 0042FF1D
@J@gof, xrefs: 0042FF3A
@JZlxJfdy{lzzO{hdlLgm, xrefs: 0042FF9D

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: AddressLibraryLoadProc$lstrlen
String ID: @J@gof$@JFylg$@JJefzl$@JJfdy{lzzf{O{ll$@JNl}@gof$@JZlgmDlzzhnl$@JZlxJfdy{lzzO{hdl$@JZlxJfdy{lzzO{hdlLgm$@JZlxJfdy{lzzO{hdlZ}h{}$DZ_O^:;'MEE$H_@JHY:;'MEE$jhyJ{lh}lJhy}|{l^`gmf~^
API String ID: 268393782-1352645916
Opcode ID: 089b21e976e5bb31fd2e61345d4ec2166a8204ce257b80a6789a54d5fa0b185f
Instruction ID: b421654733045ff7ed06dadf9d5dc222b4f2467a359c68ce7b13b02f7cc919b0
Opcode Fuzzy Hash: 089b21e976e5bb31fd2e61345d4ec2166a8204ce257b80a6789a54d5fa0b185f
Instruction Fuzzy Hash: AA416D75910304ABCB40FBA5DC8299E77BDEF48318F41853BB401B6296EA7C9D144BAE

Function 00428C28 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 172stringCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00428E6C), ref: 00428C51
GetWindowTextW.USER32(?,?,00000200), ref: 00428C9C
EnterCriticalSection.KERNEL32(00486718,[,?,[,?,[,?,[), ref: 00428D2A
lstrlenW.KERNEL32(00000000,00000000,00428DB4,?,00486718,[,?,[,?,[,?,[), ref: 00428D46
LeaveCriticalSection.KERNEL32(00486718,00428DBB,?,[,?,[,?,[), ref: 00428DAE
lstrlenW.KERNEL32(?,00000000,00428E6C), ref: 00428DBF
EnterCriticalSection.KERNEL32(00486718,?,00000000,00428E6C), ref: 00428DDB
LeaveCriticalSection.KERNEL32(00486718,00428E46,00000000,00428E6C), ref: 00428E39

Part of subcall function 0040BAE8: FileTimeToLocalFileTime.KERNEL32(?,?,00000000,0040BC14,?,?,?,00486680), ref: 0040BB24
Part of subcall function 0040BAE8: FileTimeToSystemTime.KERNEL32(?,?,?,?,?,00486680), ref: 0040BB3A

Strings

[, xrefs: 00428CCF
[, xrefs: 00428CD7
4gH, xrefs: 00428C62, 00428D18, 00428D21, 00428D64, 00428D86, 00428DA5, 00428DD2, 00428DF4, 00428E11, 00428E30
[, xrefs: 00428CF8
[, xrefs: 00428D00

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: CriticalSectionTime$File$EnterLeaveWindowlstrlen$ForegroundLocalSystemText
String ID: [$[$[$[$4gH
API String ID: 3203209789-4231738031
Opcode ID: 553d9157399e13fad3db8783b02503fa42ac75fcbc7655638e3930898fa68555
Instruction ID: cd6cea95f2fdff4dc38500494d2ec49a0396264a133fbde8197061e77fe4df3e
Opcode Fuzzy Hash: 553d9157399e13fad3db8783b02503fa42ac75fcbc7655638e3930898fa68555
Instruction Fuzzy Hash: B2511975700608AFDB00DF99DC85E8EBBF9EB49304F814069F504E72A2DB38ED548B68

Function 0042BAFC Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 191windowCOMMON

Download Yara Rule

APIs

CreateFontW.GDI32(0000000C,00000006,00000000,00000000,000000C8,00000000,00000000,00000000,00000086,00000000,00000000,00000000,00000000,Arial), ref: 0042BC24
SendMessageW.USER32(?,00000030,?,00000000), ref: 0042BC35
SendMessageW.USER32(?,00000030,?,00000000), ref: 0042BC48
SendMessageW.USER32(?,00000030,?,00000000), ref: 0042BC5B
DefWindowProcW.USER32(?,?,?,?), ref: 0042BD17

Strings

Arial, xrefs: 0042BBFF
BUTTON, xrefs: 0042BBC0, 0042BBEE
EDIT, xrefs: 0042BB5F, 0042BB8D
sQ , xrefs: 0042BBE9

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: MessageSend$CreateFontProcWindow
String ID: Arial$BUTTON$EDIT$sQ
API String ID: 369421526-1325858889
Opcode ID: 91081239d773ded964b170543547179827420fda9424dc9f98072b94967eb520
Instruction ID: a2bb92f48b7c9c5c0a2ca1f4238ce0aeea9e52c4f4215f0c1d5f0f2e55f97722
Opcode Fuzzy Hash: 91081239d773ded964b170543547179827420fda9424dc9f98072b94967eb520
Instruction Fuzzy Hash: 185112713903147BF720AA59AC56FAB2768E700B44FA44427F700BF2D1DBB9AC01879E

Function 00409148 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 258COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00409200

Strings

(R, xrefs: 0040932A, 00409334

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: ExceptionRaise
String ID: (R
API String ID: 3997070919-2743311286
Opcode ID: 2ff4fce7c77f293058c68d3cc450b499553666d9f0ef4978638c54b6cd64c25f
Instruction ID: 102a0f0c3ce5befaca2a965e61597f0f4c621f32d06faf9af7fb97871bd771b6
Opcode Fuzzy Hash: 2ff4fce7c77f293058c68d3cc450b499553666d9f0ef4978638c54b6cd64c25f
Instruction Fuzzy Hash: 0CA16F759012099FDB15DFA8D8C0BAEB7B5AB88300F14453EE905B73C2DB78AD45CB58

Function 00428590 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 102libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,00000000,004286D4,?,?,00486680,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0043F2F2), ref: 004285C3
LoadLibraryW.KERNEL32(00000000,00000000,00000000,004286D4,?,?,00486680,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042866C

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,00000000), ref: 0040A4F2

Strings

Nl}Dfm|elO`elGhdlLq^, xrefs: 00428617
^]ZO{llDldf{p, xrefs: 0042869B
Lg|dY{fjlzzlz, xrefs: 004285D5
^}zhy`:;'mee, xrefs: 00428659
YzHy`'MEE, xrefs: 004285B0
Nl}Y{fjlzz@dhnlO`elGhdl^, xrefs: 00428638
^]ZLg|dl{h}lY{fjlzzlz^, xrefs: 0042867A
Lg|dY{fjlzzDfm|elz, xrefs: 004285F6

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: AddressLibraryLoadProc$lstrlen
String ID: Lg|dY{fjlzzDfm|elz$Lg|dY{fjlzzlz$Nl}Dfm|elO`elGhdlLq^$Nl}Y{fjlzz@dhnlO`elGhdl^$YzHy`'MEE$^]ZLg|dl{h}lY{fjlzzlz^$^]ZO{llDldf{p$^}zhy`:;'mee
API String ID: 268393782-2693748152
Opcode ID: ffa61641ab19f340686b4a17e72a16458ca9a0a1770ddef71ab0c5d47f97fb7c
Instruction ID: b2abc951f42fac8fa2330dbee562f4288950d046d5c14a321555204371fbe9ee
Opcode Fuzzy Hash: ffa61641ab19f340686b4a17e72a16458ca9a0a1770ddef71ab0c5d47f97fb7c
Instruction Fuzzy Hash: F7318075A123159BCB41FBA5DC428DE77A9EF85318B81813BB400B7682DB3C9D144BAE

Function 0042DC10 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 255stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(?, /c "), ref: 0042DD92
lstrcatW.KERNEL32(?,00000000,?, /c "), ref: 0042DDA7
lstrcatW.KERNEL32(?,0042DF9C,?,00000000,?, /c "), ref: 0042DDB8

Part of subcall function 0042B474: lstrlenW.KERNEL32(00000000,00000000,0042B658,?,?,?,00000001), ref: 0042B4AE

Strings

/c ", xrefs: 0042DD86
|aH, xrefs: 0042DCC8
D, xrefs: 0042DD3A
8[B, xrefs: 0042DC58
COMSPEC, xrefs: 0042DD78
HfH, xrefs: 0042DC6B

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: lstrcat$lstrlen
String ID: /c "$8[B$COMSPEC$D$HfH$|aH
API String ID: 751011610-206186839
Opcode ID: 052fad98bc2d18d6d84550cfe2fd370de0678df48a72e9a094c45fe774489eba
Instruction ID: 81ed9846a7d3f65a68619d801d78e7a443c993b2260b494b6be705ed66106b92
Opcode Fuzzy Hash: 052fad98bc2d18d6d84550cfe2fd370de0678df48a72e9a094c45fe774489eba
Instruction Fuzzy Hash: 9AA14B70A002199FDB11DBA9DC81F9EB3F8FB48304F91417AF544EB291DB79A944CB68

Function 0041A870 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 219threadCOMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000001,00000000,0041AB5F,?,?,?,?,00000000,00000000), ref: 0041A897
GetThreadLocale.KERNEL32(?,00000001,00000000,0041AB5F,?,?,?,?,00000000,00000000), ref: 0041A8A0

Part of subcall function 0041A844: GetLocaleInfoW.KERNEL32(?,0000000F,0041A950,00000002,0000002C,?,?,?,0041A950), ref: 0041A857

Part of subcall function 0041A7F8: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 0041A816

Strings

mmmm d, yyyy, xrefs: 0041A9D0
:mm, xrefs: 0041AAF7
:mm:ss, xrefs: 0041AB12
m/d/yy, xrefs: 0041A9AB
2, xrefs: 0041AB3B
AMPM , xrefs: 0041AAE7
AMPM, xrefs: 0041AAD8

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: Locale$Info$ThreadValid
String ID: AMPM$2$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 233154393-3379564615
Opcode ID: 94823e5df3ed155d42373aeca29090d4622e880d401ed27dd137ea8507bc74b4
Instruction ID: 5b46dc006f98231a26cae34b1307f24b2f5ea33c94de3b4259bcb689306f24a8
Opcode Fuzzy Hash: 94823e5df3ed155d42373aeca29090d4622e880d401ed27dd137ea8507bc74b4
Instruction Fuzzy Hash: C77154347011585BDB01EBA5C841BDE76BAEF48304F50807BF515AB286DB3CDEA2879E

Function 0041B074 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 175threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040514C: GetTickCount.KERNEL32 ref: 00405183
Part of subcall function 0040514C: GetTickCount.KERNEL32 ref: 0040519B

Part of subcall function 0041A7F8: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 0041A816

GetThreadLocale.KERNEL32(00000000,00000004), ref: 0041B10F
EnumCalendarInfoW.KERNEL32(0041AF60,00000000,00000000,00000004), ref: 0041B11A
GetThreadLocale.KERNEL32(00000000,00000003,0041AF60,00000000,00000000,00000004), ref: 0041B14A
EnumCalendarInfoW.KERNEL32(0041AFEC,00000000,00000000,00000003,0041AF60,00000000,00000000,00000004), ref: 0041B155
GetThreadLocale.KERNEL32(00000000,00000004), ref: 0041B1E6
EnumCalendarInfoW.KERNEL32(0041AF60,00000000,00000000,00000004), ref: 0041B1F1
GetThreadLocale.KERNEL32(00000000,00000003,0041AF60,00000000,00000000,00000004), ref: 0041B223
EnumCalendarInfoW.KERNEL32(0041AFEC,00000000,00000000,00000003,0041AF60,00000000,00000000,00000004), ref: 0041B22E

Strings

B.C., xrefs: 0041B194

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: InfoLocale$CalendarEnumThread$CountTick
String ID: B.C.
API String ID: 1601775584-621294921
Opcode ID: bc8247d33fe5370433e2fd6ccc15e77975c242f0979f0cb17630a33c32e31ca2
Instruction ID: d5467c5867d662d48c46f78aef8c8699bdd0855b3e6aaee3d787cd1117f7295e
Opcode Fuzzy Hash: bc8247d33fe5370433e2fd6ccc15e77975c242f0979f0cb17630a33c32e31ca2
Instruction Fuzzy Hash: 2B51F474A016005FD310EB29DC85BAE7766EB49318F14817AF800AB3E2C77E9D55878E

Function 0041B8F4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041B6FC: VirtualQuery.KERNEL32(?,?,0000001C,00000000,0041B8A8), ref: 0041B72F
Part of subcall function 0041B6FC: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0041B753
Part of subcall function 0041B6FC: GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0041B76E
Part of subcall function 0041B6FC: LoadStringW.USER32(00000000,0000FFEA,?,00000100), ref: 0041B809

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,0041BA19), ref: 0041B955
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041B988
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041B99A
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041B9A0
GetStdHandle.KERNEL32(000000F4,0041BA34,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 0041B9B4
WriteFile.KERNEL32(00000000,000000F4,0041BA34,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 0041B9BA
LoadStringW.USER32(00000000,0000FFEB,?,00000040), ref: 0041B9DE
MessageBoxW.USER32(00000000,?,?,00002010), ref: 0041B9F8

Strings

@, xrefs: 0041B9CA

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID: @
API String ID: 135118572-216407459
Opcode ID: 5e5b58603649367f128015842687fb9cd620b316ebe1d037fa3627f5dde79ee1
Instruction ID: f4c401843c9c291ca3b94f10bb34d76506db394776c8f349b425d2b96d247647
Opcode Fuzzy Hash: 5e5b58603649367f128015842687fb9cd620b316ebe1d037fa3627f5dde79ee1
Instruction Fuzzy Hash: A43170B5640204BFE710EB95CC82FDA73ACEB04704F6041BAB644F71D1DAB46E80876D

Function 0042CF20 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 92libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,00000000,0042D072,?,00000000,00000000,00000000,00000000,00000000,00000000,?,0042C75E,00000000,0042CB8F), ref: 0042CF4F

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,00000000), ref: 0040A4F2

Strings

Zl}]jyLg}{p, xrefs: 0042D001
Nl}Lq}lgmlm\my]hkel, xrefs: 0042CFDB
Nl}Lq}lgmlm]jy]hkel, xrefs: 0042CFB5
Heefjh}lHgmNl}]jyLq]hkelO{fdZ}hjb, xrefs: 0042CF69
@yAeyHy`'MEE, xrefs: 0042CF3C
Heefjh}lHgmNl}\myLq]hkelO{fdZ}hjb, xrefs: 0042CF8F

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: AddressProc$LibraryLoadlstrlen
String ID: @yAeyHy`'MEE$Heefjh}lHgmNl}\myLq]hkelO{fdZ}hjb$Heefjh}lHgmNl}]jyLq]hkelO{fdZ}hjb$Nl}Lq}lgmlm\my]hkel$Nl}Lq}lgmlm]jy]hkel$Zl}]jyLg}{p
API String ID: 1729337914-77311109
Opcode ID: 24fcab706ba486010333c345a5a4c1ee916a8591a563e09837591bfc18d52602
Instruction ID: e9226c6078ce630d9dc907993224ef77e34ecd6abfb291ef623e07e235766894
Opcode Fuzzy Hash: 24fcab706ba486010333c345a5a4c1ee916a8591a563e09837591bfc18d52602
Instruction Fuzzy Hash: 5C318571A102009FC780FBADED89A5E37E9EB45318F81493EB441B72A3D77C59148B6D

Function 00404F84 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 00404F9A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00404FA0
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00404FB3
GetLastError.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00404FBC
GetLogicalProcessorInformation.KERNEL32(?,?,00000000,00405030,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00404FE7

Strings

GetLogicalProcessorInformation, xrefs: 00404F90
kernel32.dll, xrefs: 00404F95

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-812649623
Opcode ID: 35201d4d745a74f346a6d86facebae3d15b37a8ffc1e75ce2ae731f58a1f64b0
Instruction ID: 54b7ebe99e7f302da2557309956b5d9292d5a3a304b6d3c4cb150c26000b97f2
Opcode Fuzzy Hash: 35201d4d745a74f346a6d86facebae3d15b37a8ffc1e75ce2ae731f58a1f64b0
Instruction Fuzzy Hash: 8A118471904604AEDF10EBA5CD46B5FB7ACEB44318F2040BBE504B21C2D67D9A80DE5D

Function 00404F82 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 52libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 00404F9A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00404FA0
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00404FB3
GetLastError.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00404FBC
GetLogicalProcessorInformation.KERNEL32(?,?,00000000,00405030,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00404FE7

Strings

GetLogicalProcessorInformation, xrefs: 00404F90
kernel32.dll, xrefs: 00404F95

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-812649623
Opcode ID: bd05037c37d740ab1b4dc7fa39a3e26f1e2793f84830334b598c92dfe34fff13
Instruction ID: 8199570454523d895cc0032b24ada9d2fbf36891f81a90a2ad8e621ecca28dd4
Opcode Fuzzy Hash: bd05037c37d740ab1b4dc7fa39a3e26f1e2793f84830334b598c92dfe34fff13
Instruction Fuzzy Hash: DC016571904604AADF10EBA18D45A5FB7ACEB04318F20407BF504F61C1D67D9A809E5D

Function 00405CB8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?,?,00405E86,00404023,0040406A,00000000,?), ref: 00405CF1
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?,?,00405E86,00404023,0040406A,00000000), ref: 00405CF7
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?), ref: 00405D12
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000), ref: 00405D18
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00405D36

Strings

Error, xrefs: 00405D2A
Runtime error at 00000000, xrefs: 00405CEA, 00405D2F

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 9da2a348520ae705558052009ceb975953c61fbff1b85c89fbedfe3754430604
Instruction ID: 8e6b3ae1d0950b207053b0f6b2d9b368760f02a7951139c7a1ba30855beff3be
Opcode Fuzzy Hash: 9da2a348520ae705558052009ceb975953c61fbff1b85c89fbedfe3754430604
Instruction Fuzzy Hash: CEF096A168578039F710B7A44D0FF5B2248AB85F19F24857FB610B40D2D6FC48D4DA2E

Function 00402E44 Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?), ref: 00402EDA
Sleep.KERNEL32(0000000A,00000000,?), ref: 00402EF4

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: eb1b30fa2819bb7e9c26078b3c9538032f65093cedfba747be72939952c37498
Instruction ID: 3880d568d444d35d86371686d009cb09ec6d1a72a8af32c9c49ca4f9918148e7
Opcode Fuzzy Hash: eb1b30fa2819bb7e9c26078b3c9538032f65093cedfba747be72939952c37498
Instruction Fuzzy Hash: 1471E2716443008FD715DF29CB88B16BBE4AB86314F18817FE488AB3D2D7F89945C79A

Function 0043E080 Relevance: 12.2, APIs: 1, Strings: 7, Instructions: 169sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

Sleep.KERNEL32(000001F4), ref: 0043E2BF

Strings

HEPhj'hpl, xrefs: 0043E169
HZM\y'lql, xrefs: 0043E221
D\ymh}l;'lql, xrefs: 0043E243
_:E`}lLqy'lql, xrefs: 0043E1BB
HPHnlg}'hpl, xrefs: 0043E147
_:E`}l'lql, xrefs: 0043E1DD
HP]hzb'hpl, xrefs: 0043E103

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: Sleeplstrlen
String ID: D\ymh}l;'lql$HEPhj'hpl$HPHnlg}'hpl$HP]hzb'hpl$HZM\y'lql$_:E`}l'lql$_:E`}lLqy'lql
API String ID: 404571708-2566769197
Opcode ID: c1a7c98b22a2f22b02d8b9bb3fec9843a6aa04b2a1bf0e8831c885995607f298
Instruction ID: acd5230c7a7213d7fe97c03c0ffc7f1d30c64ff60ca5bdd317cc2c1716e60a4c
Opcode Fuzzy Hash: c1a7c98b22a2f22b02d8b9bb3fec9843a6aa04b2a1bf0e8831c885995607f298
Instruction Fuzzy Hash: A4716134A00248DFDB00DB99C181BCDB7B5EF49308F645096E841BB382C779EE54DBAA

Function 0040303C Relevance: 10.9, APIs: 7, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebb56015c37a3f9fb8dd09f6843bc0f113a4137dadc24ef096fcc9bb47d10006
Instruction ID: d6e953f600fa62a4cb01c07aad8c81ca5a5721795a0ae764ee1700970c6b3899
Opcode Fuzzy Hash: ebb56015c37a3f9fb8dd09f6843bc0f113a4137dadc24ef096fcc9bb47d10006
Instruction Fuzzy Hash: DDC139727102000BD7149E7D9E8932EB7899BC5315F18827FE254EB3D6DABCCD458399

Function 0042C71C Relevance: 10.9, APIs: 4, Strings: 3, Instructions: 365stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000002,00000002,00000000,0042CB8F,?,?,?,?,00000008,00000000,00000000), ref: 0042C7BC
lstrlenW.KERNEL32(00000000,?,00000000,0042CB8F,?,?,?,?,00000008,00000000,00000000), ref: 0042C864
lstrlenW.KERNEL32(00000000,?,00000000,0042CB8F,?,?,?,?,00000008,00000000,00000000), ref: 0042CA7A

Strings

TCP, xrefs: 0042C87C
System, xrefs: 0042C815, 0042C822, 0042CA2B, 0042CA38
UDP, xrefs: 0042CA92

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: lstrlen$HeapProcess
String ID: System$TCP$UDP
API String ID: 3046081391-2438800281
Opcode ID: 2e587ecefdbb139cbce253a7460bddf1e7960b3cb139078374ca670e3306fb08
Instruction ID: 35f293c671a670b9e6b81fc65c15e8a90b22f42eb6ca05dc6d7e89f087aa4173
Opcode Fuzzy Hash: 2e587ecefdbb139cbce253a7460bddf1e7960b3cb139078374ca670e3306fb08
Instruction Fuzzy Hash: 57D18F31B40219AFDB00EBA5EC86FAEBBB5AF48704F504466F510F7292D778A905CB58

Function 004038AC Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 285windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,004024F8,00002010), ref: 00403CA0

Strings

0$@, xrefs: 00403A06, 00403A18
\$@, xrefs: 00403A8A, 00403A98
$@, xrefs: 00403B58, 00403B66
7, xrefs: 00403A24
, xrefs: 00403BD9

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: Message
String ID: $0$@$7$\$@$$@
API String ID: 2030045667-1228603798
Opcode ID: ac19fcd5adda951769c91ee1a6c17dc81187d7c120c71253a4f0a3854113e247
Instruction ID: e812cd3dc2fef7569f4f822b6a4b970610b3f81895bdd3cedabc248f3003e63a
Opcode Fuzzy Hash: ac19fcd5adda951769c91ee1a6c17dc81187d7c120c71253a4f0a3854113e247
Instruction Fuzzy Hash: 18B1CA30B042548BDB21DF2DC885B997BF8AB4A709F0441FAE449F7382CB785E85CB59

Function 0042E088 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 241stringsleepCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,0042E424,?,?,00000000,00000000), ref: 0042E0BD
lstrlenW.KERNEL32(?,00000000,00000000,0042E424,?,?,00000000,00000000), ref: 0042E0C8
Sleep.KERNEL32(00000001), ref: 0042E263

Part of subcall function 0042DFF8: lstrlenW.KERNEL32(00000000,?,0042E25D), ref: 0042E004

Strings

\, xrefs: 0042E391
., xrefs: 0042E32F
*.*, xrefs: 0042E2E8

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: lstrlen$Sleep
String ID: *.*$.$\
API String ID: 429307061-3468707253
Opcode ID: 12244ae98e7790e0bcfe0dc87e16b914e91ade2e89f473010b1b4e49b66439e0
Instruction ID: 874b38f9c15a16064f5124428c196f5401a35f00216acdfa7908766dcb98f518
Opcode Fuzzy Hash: 12244ae98e7790e0bcfe0dc87e16b914e91ade2e89f473010b1b4e49b66439e0
Instruction Fuzzy Hash: BDA193306002299FDB60EB65EC85B9D77F8EB48304F9145F6E409E32A1DB789E84CF58

Function 0043AFDC Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 163COMMON

Download Yara Rule

Strings

" ", xrefs: 0043B069, 0043B073
/Update, xrefs: 0043B06E
HfH, xrefs: 0043B03A, 0043B0AE, 0043B0FB, 0043B147, 0043B1A5
.exe, xrefs: 0043B000

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: CriticalSection$EnterExistsFileLeavePath
String ID: " "$.exe$/Update$HfH
API String ID: 3310751803-1929450815
Opcode ID: aa955d9050df199ca6804f25a1b4324a74b4dc30d2bbef1dc68e39435076f8d9
Instruction ID: 609c13bec061a5d4637fb112db9b101bfdfe75ff76c94aae5f827595d8871324
Opcode Fuzzy Hash: aa955d9050df199ca6804f25a1b4324a74b4dc30d2bbef1dc68e39435076f8d9
Instruction Fuzzy Hash: 6951A374604205AFDB10EBA9C8A2B9F73E4EB0D344F105066FA10D7391DB7DAD049B99

Function 0043CCA8 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 162libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0043CDCF
LoadLibraryW.KERNEL32(00000000,00000000), ref: 0043CE1C

Strings

*.*, xrefs: 0043CD46
XXX_Starting, xrefs: 0043CE3B
XXX_Plugs\, xrefs: 0043CD0F
XXX_InfoW, xrefs: 0043CE2B

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: HandleLibraryLoadModule
String ID: *.*$XXX_InfoW$XXX_Plugs\$XXX_Starting
API String ID: 4133054770-2785245216
Opcode ID: f71acd30243d42f49c7826a7ce0a7bd6944551d3629e193985cfb457d1c80ab8
Instruction ID: 5c59f4733bd3e6e152ae9da63c784154abf35261a6166e2ebc2e54f53956f2ea
Opcode Fuzzy Hash: f71acd30243d42f49c7826a7ce0a7bd6944551d3629e193985cfb457d1c80ab8
Instruction Fuzzy Hash: 9F518471A056199FCB10EB65DC89A8EB7F5EF48304F1181FBA409F3291DB389E548F58

Function 0042E47C Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 135sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004265F0: htons.WS2_32(?), ref: 00426637
Part of subcall function 004265F0: gethostbyname.WS2_32(00000000), ref: 00426665
Part of subcall function 004265F0: connect.WS2_32(?,00000008,00000010), ref: 00426690
Part of subcall function 004265F0: WSAGetLastError.WS2_32(?,?,00000000,00000000), ref: 004266B9
Part of subcall function 004265F0: Sleep.KERNEL32(00000002,?,?,00000000,00000000), ref: 004266CA

Part of subcall function 004264A8: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 004264C7

Part of subcall function 00426468: setsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 0042647E

Part of subcall function 0042B474: lstrlenW.KERNEL32(00000000,00000000,0042B658,?,?,?,00000001), ref: 0042B4AE

Part of subcall function 0040B948: GetEnvironmentVariableW.KERNEL32(00000000,?,00000208,004866F8,0043D0E3,00000000,0043D13A,?,00486680,00000001,00000000,00000000,?,00437AE2,?,00000000), ref: 0040B95D
Part of subcall function 0040B948: GetLongPathNameW.KERNELBASE(?,?,00000208), ref: 0040B972

Sleep.KERNEL32(000001F4,0042E635,?,00000064,00000000,00000000,0042E65B,?,00000000,0042E67D), ref: 0042E61E

Part of subcall function 0042E088: lstrlenW.KERNEL32(00000000,00000000,0042E424,?,?,00000000,00000000), ref: 0042E0BD
Part of subcall function 0042E088: lstrlenW.KERNEL32(?,00000000,00000000,0042E424,?,?,00000000,00000000), ref: 0042E0C8

Strings

\, xrefs: 0042E577
WINDIR, xrefs: 0042E545
8[B, xrefs: 0042E49B
\Temp, xrefs: 0042E557
:, xrefs: 0042E571
HfH, xrefs: 0042E4BC

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: lstrlen$Sleepsetsockopt$EnvironmentErrorLastLongNamePathVariableconnectgethostbynamehtons
String ID: 8[B$:$HfH$WINDIR$\$\Temp
API String ID: 916843999-738507572
Opcode ID: a8029911b969878f78ac764834f3b201bdd0417c20dfb5ba0b09e840580c8ea6
Instruction ID: ba3bdb42cb812209f095133bc7201274ca052839750dfdcc6e646bdf85a6b18d
Opcode Fuzzy Hash: a8029911b969878f78ac764834f3b201bdd0417c20dfb5ba0b09e840580c8ea6
Instruction Fuzzy Hash: E2515AB4B10610AFD741EFAAEC51A5A37E5FB19308F82847AE400973E1EB789C41CB5C

Function 0040514C Relevance: 10.6, APIs: 7, Instructions: 131threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004053E8: GetCurrentThreadId.KERNEL32 ref: 004053EB

GetTickCount.KERNEL32 ref: 00405183
GetTickCount.KERNEL32 ref: 0040519B
GetCurrentThreadId.KERNEL32 ref: 004051CB
GetTickCount.KERNEL32 ref: 004051F6
GetTickCount.KERNEL32 ref: 0040522D
GetTickCount.KERNEL32 ref: 00405257
GetCurrentThreadId.KERNEL32 ref: 004052C7

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: f9d61921e35b482ef1f14d4eaeacaa075d63589b9816c89e841c04f0b3fb69e2
Instruction ID: e96b3358484ed09efb32f7bf407c562274a0588feb759182786de9b46f441b21
Opcode Fuzzy Hash: f9d61921e35b482ef1f14d4eaeacaa075d63589b9816c89e841c04f0b3fb69e2
Instruction Fuzzy Hash: EF418D30608B419FD721EE78C58431FBAD1EF94354F15897EE8D89B3C1EA7898818F5A

Function 0040BC54 Relevance: 9.1, APIs: 6, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040BC87
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,40000000,00000000), ref: 0040BCB8
HttpQueryInfoW.WININET(00000000,20000005,?,00000004,?), ref: 0040BCFA
InternetCloseHandle.WININET(00000000), ref: 0040BD8F

Part of subcall function 0040B634: VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004,00428AA0,?,?,00486734,00486680,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B63E

InternetReadFile.WININET(00000000,?,?,?), ref: 0040BD2F

Part of subcall function 0040B644: VirtualFree.KERNEL32(00000000,00000000,00008000,00428B66,?,?,00486734,00486680,00000000,00000000,00000000,00000000,00000000,00000000,?,00437E88), ref: 0040B64C

InternetCloseHandle.WININET(00000000), ref: 0040BDAE

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: Internet$CloseHandleOpenVirtual$AllocFileFreeHttpInfoQueryRead
String ID:
API String ID: 436716311-0
Opcode ID: 3e7517a180f2519e9ef8862004f9ea7d21659a34cfeb77de3d18cea408e80831
Instruction ID: 2d81d751fc6afc2710d3bfc5214d13ec27d882b95dc00282e94316269f0eb743
Opcode Fuzzy Hash: 3e7517a180f2519e9ef8862004f9ea7d21659a34cfeb77de3d18cea408e80831
Instruction Fuzzy Hash: 90417975A04208AFDB11DFA4DC95BAEB7B8EB49700F114476F505E3290DB389900CB68

Function 00402AC0 Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,FFFFFFDC,00402A8C), ref: 00402B77
Sleep.KERNEL32(0000000A,00000000,FFFFFFDC,00402A8C), ref: 00402B8D
Sleep.KERNEL32(00000000,?,?,FFFFFFDC,00402A8C), ref: 00402BBB
Sleep.KERNEL32(0000000A,00000000,?,?,FFFFFFDC,00402A8C), ref: 00402BD1

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 00e817329ed30a61a1e3ce9785030074bf56165d3748735972e8587115fb55d2
Instruction ID: e9b8b7081cf30ab9f8610f5ddeb7dffbd4721761cd41d76955e75723a6189a5d
Opcode Fuzzy Hash: 00e817329ed30a61a1e3ce9785030074bf56165d3748735972e8587115fb55d2
Instruction Fuzzy Hash: 89C149766013108FDB19CF29DB88316BBE0AB86314F18827FD444AB3D5C7B8D955CB9A

Function 004038AA Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 207COMMON

Download Yara Rule

Strings

0$@, xrefs: 00403A06, 00403A18
\$@, xrefs: 00403A8A, 00403A98
7, xrefs: 00403A24
, xrefs: 00403BD9

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID:
String ID: $0$@$7$\$@
API String ID: 0-4266993835
Opcode ID: 0898838d16f207543cc06ffe88efb152eba2014c6d30357a487cafd616e18d10
Instruction ID: b3e4678ffb9dae527c939fda3aba35b48a12a95a819a0055bfac3d4281ef8523
Opcode Fuzzy Hash: 0898838d16f207543cc06ffe88efb152eba2014c6d30357a487cafd616e18d10
Instruction Fuzzy Hash: 1881C730B042548FDB21DF2DC885B99BBF8AB4A709F0441F6E049F7382DB785A85CB59

Function 0041B6FC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,0041B8A8), ref: 0041B72F
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0041B753
GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0041B76E
LoadStringW.USER32(00000000,0000FFEA,?,00000100), ref: 0041B809

Strings

MZP, xrefs: 0041B76D

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: MZP
API String ID: 3990497365-2889622443
Opcode ID: 33485dccd570a2a0afe39b740a752237986253bc9c59ef7515bff66579f2bf26
Instruction ID: c27a278696c1af428c112a5138f6c708912e0e629acd6ed950e1bdc93ff39661
Opcode Fuzzy Hash: 33485dccd570a2a0afe39b740a752237986253bc9c59ef7515bff66579f2bf26
Instruction Fuzzy Hash: 19411F70A002589FDB20EF65CC81BCAB7B9EB88314F0040FAE508E7281D7799E95CF59

Function 0042C13C Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 105windowCOMMON

Download Yara Rule

APIs

GetWindowTextW.USER32(?,00485D2C,00000200), ref: 0042C179
IsWindowVisible.USER32(?), ref: 0042C239

Strings

,_H, xrefs: 0042C1E9
,]H, xrefs: 0042C1B7
(]H, xrefs: 0042C254

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: Window$TextVisible
String ID: (]H$,]H$,_H
API String ID: 1670992164-2296990632
Opcode ID: e467966b9a8c0fefa1ccc827f78f29989ba23366127c3093c9771cb756a8b563
Instruction ID: d95932ed8a37d93c08fe9a1a55fadeb8aae1f262f1f2142a84b6d5f9324e449e
Opcode Fuzzy Hash: e467966b9a8c0fefa1ccc827f78f29989ba23366127c3093c9771cb756a8b563
Instruction Fuzzy Hash: 7C319D31B00214AFEB01EBA1DC82EAE77B5EF48704F518477B50172191CA7D9D15972C

Function 0042BD88 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72registryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00465CA0,0042C023,?,00000064,00000000,00000000,0042C0D8), ref: 0042BDB6
RegisterClassW.USER32(00465CD8), ref: 0042BDC6
ShowWindow.USER32(?,00000001,00000000,?,00000000,00000000,0000015E,000001F4,?,?,100F0080), ref: 0042BE64
SetForegroundWindow.USER32(?), ref: 0042BE6F

Strings

RAT_Chat, xrefs: 0042BD9F, 0042BE36

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: Window$ClassForegroundHandleModuleRegisterShow
String ID: RAT_Chat
API String ID: 3776541383-1508558188
Opcode ID: 3da53fab4287da6ac28a1f121945f4a6c5748e60b917b128f9c393c7511c022f
Instruction ID: e3e0ff72afeb0ca95b62b861ee8d58a389ac77bdb3e2b56e9a420627b55a5118
Opcode Fuzzy Hash: 3da53fab4287da6ac28a1f121945f4a6c5748e60b917b128f9c393c7511c022f
Instruction Fuzzy Hash: DA211D75740B109BE710DF68EC45BA633E4EB04708F94853AF644DB3D1EBB9A804878E

Function 0040E83C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

GetUserObjectInformationW.USER32(00000000,00000002,?,00000100,?,?,004328AD,?,00000000,0043294A), ref: 0040E886
OpenWindowStationW.USER32(winsta0,00000000,0000037F), ref: 0040E8A8
SetProcessWindowStation.USER32(00000000,?,004328AD,?,00000000,0043294A), ref: 0040E8B4
OpenDesktopW.USER32(?,00000000,00000000,000001FF), ref: 0040E8CB

Strings

winsta0, xrefs: 0040E8A3

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: OpenStationWindow$DesktopInformationObjectProcessUser
String ID: winsta0
API String ID: 3539518509-3440837585
Opcode ID: 159005afdda627ef5a1ff0f0402107ecf24fb7b8575005aeb33b992befac07c1
Instruction ID: 07935d2aa83b5d675ff6c58e78f2920d5cf53bccb1719f4e7f0ccf1e20ed6600
Opcode Fuzzy Hash: 159005afdda627ef5a1ff0f0402107ecf24fb7b8575005aeb33b992befac07c1
Instruction Fuzzy Hash: 5C1124752443016FE310EBA9DC81F6B73EC6B45700F44483AB984EB3D1DAB9ED14972A

Function 004265F0 Relevance: 7.6, APIs: 5, Instructions: 97networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004265CC: socket.WS2_32(00000002,00000001,00000000), ref: 004265DB

htons.WS2_32(?), ref: 00426637
gethostbyname.WS2_32(00000000), ref: 00426665
connect.WS2_32(?,00000008,00000010), ref: 00426690
WSAGetLastError.WS2_32(?,?,00000000,00000000), ref: 004266B9
Sleep.KERNEL32(00000002,?,?,00000000,00000000), ref: 004266CA

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: ErrorLastSleepconnectgethostbynamehtonssocket
String ID:
API String ID: 2864911191-0
Opcode ID: 9f28b064d525dcda550846062e3a93fcd66620e325ef5e3ebc0512ee41a5b598
Instruction ID: 0dd1b41a93d19dc09989b8233b659783f6ed969359d15ac89dd0c57dc2224665
Opcode Fuzzy Hash: 9f28b064d525dcda550846062e3a93fcd66620e325ef5e3ebc0512ee41a5b598
Instruction Fuzzy Hash: 50319F74A002149FCB10DFA5D985A9E77B8FF48314F5284BAE904EB291D738CD44CB69

Function 0040BA5C Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000,00000000,?,0043F7E0), ref: 0040BA70
FindResourceW.KERNEL32(00000000,00000000,0000000A,00000000,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000), ref: 0040BA82
LoadResource.KERNEL32(00000000,00000000,00000000,0040BAD8,?,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680), ref: 0040BAA4
LockResource.KERNEL32(00000000,?,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000,00000000), ref: 0040BAB1
FreeResource.KERNEL32(00000000,0040BADF,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000,00000000,?,0043F7E0,00000000), ref: 0040BAD1

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: Resource$FindFreeHandleLoadLockModule
String ID:
API String ID: 2355082082-0
Opcode ID: 3f0eb233740970fe425e4189b138455d4fb9001c1d9e8dd3634329448ef4e4b8
Instruction ID: 1a3ff52bf1ac6d4834992fad00352ded9c14d174eaf5e093c7de7b05a94e74d9
Opcode Fuzzy Hash: 3f0eb233740970fe425e4189b138455d4fb9001c1d9e8dd3634329448ef4e4b8
Instruction Fuzzy Hash: 3101F776B41304BFE701ABB9AC85B2ABBECDB89715F150436F506E3281DA799D00866C

Function 0040BA58 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000,00000000,?,0043F7E0), ref: 0040BA70
FindResourceW.KERNEL32(00000000,00000000,0000000A,00000000,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000), ref: 0040BA82
LoadResource.KERNEL32(00000000,00000000,00000000,0040BAD8,?,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680), ref: 0040BAA4
LockResource.KERNEL32(00000000,?,?,00486680,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000,00000000), ref: 0040BAB1
FreeResource.KERNEL32(00000000,0040BADF,00000001,0000000F,?,00437564,00000000,00437B2F,?,00486734,00486680,00000000,00000000,?,0043F7E0,00000000), ref: 0040BAD1

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: Resource$FindFreeHandleLoadLockModule
String ID:
API String ID: 2355082082-0
Opcode ID: 42ae530f8878b1a679c5bb975ed892b2aba36b703ce15ae7888e2b82efbc6652
Instruction ID: 7bba7a99e39e5116ed02c681e27dab3f3a696a6cdaaff79990abd0375f4619b6
Opcode Fuzzy Hash: 42ae530f8878b1a679c5bb975ed892b2aba36b703ce15ae7888e2b82efbc6652
Instruction Fuzzy Hash: 2201A2B5B41300BFE711ABB59C99B2B7AECDB49704F154436F502E3291D6B89D008A6C

Function 0042A7F0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 290COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNEL32(000F001F,00000000,00000000,00000000,0042AC2E,?,?,?,00000001,0000000D,00000000,00000000,?,0042A482), ref: 0042A825

Part of subcall function 0040ACA4: lstrlenW.KERNEL32(00000000,?,?,00486730,?), ref: 0040ACDD

Strings

Hr,g:, xrefs: 0042A8F1
/f&TleQ , xrefs: 0042AB4E
GG-Team, xrefs: 0042A8E7

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: FileMappingOpenlstrlen
String ID: /f&TleQ $GG-Team$Hr,g:
API String ID: 290263465-1553010781
Opcode ID: 423f67120d0e721894976c1fa9bc8b348bc44398491a29f8b1c635831bf7f120
Instruction ID: 88ff79b281bd7af9570e5b325977c4e31f3e4296546c137c43f7e8822453c311
Opcode Fuzzy Hash: 423f67120d0e721894976c1fa9bc8b348bc44398491a29f8b1c635831bf7f120
Instruction Fuzzy Hash: 51B1D630740629AFDB04DBA2DD41FEEB3B6FF88705F904126B500B61C1D7BC69249B9A

Function 00426F90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,0042716D), ref: 00426FCA
CharUpperW.USER32(?,00000000,00000000,0042716D), ref: 00426FEE

Strings

|/Is\|, xrefs: 00426FD7, 004270C9, 0042711F
:, xrefs: 00427001

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: CharUpperlstrlen
String ID: :$|/Is\|
API String ID: 108730823-2327451341
Opcode ID: ba4b3e01cebbaa481af6e6a77b06f47b08762847adc1fc8c6b2a5010666fc814
Instruction ID: 93d54500de09d398291ab5124b2714aa455b2298479d6696639ba076840c05b2
Opcode Fuzzy Hash: ba4b3e01cebbaa481af6e6a77b06f47b08762847adc1fc8c6b2a5010666fc814
Instruction Fuzzy Hash: 24514934A041299BDB00EF99D841AEEBBB5FF48304F51807BF405B3351D7799A25CBA9

Function 004321E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

,fH, xrefs: 004321E7

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID:
String ID: ,fH
API String ID: 0-2243322645
Opcode ID: 444ee87d13a1e58113508bf6b43ac74097dd93d3b7794e398f154b7624a7e6a3
Instruction ID: 3e325106465cb2dd41976618392b57abfc7347bc5e4f7f75e8d06feff1e239a5
Opcode Fuzzy Hash: 444ee87d13a1e58113508bf6b43ac74097dd93d3b7794e398f154b7624a7e6a3
Instruction Fuzzy Hash: A7414D357052409FDB01DF99C9C0FE737A4AB0A750F1801BAFE499F68AC3A898418B76

Function 00405D48 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00405D81
FreeLibrary.KERNEL32(00400000,?,00000000,?,?,00405E86,00404023,0040406A,00000000,?,00404083,?,?,?,?,00486734), ref: 00405E22
ExitProcess.KERNEL32(00000000,?,00000000,?,?,00405E86,00404023,0040406A,00000000,?,00404083,?,?,?,?,00486734), ref: 00405E5E

Part of subcall function 00405CB8: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?,?,00405E86,00404023,0040406A,00000000,?), ref: 00405CF1
Part of subcall function 00405CB8: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?,?,00405E86,00404023,0040406A,00000000), ref: 00405CF7
Part of subcall function 00405CB8: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?), ref: 00405D12
Part of subcall function 00405CB8: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000), ref: 00405D18

Strings

MZP, xrefs: 00405E21

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: MZP
API String ID: 3490077880-2889622443
Opcode ID: d90ee3a893a0dc72c3848248a1873dcb725225a210599cc20fd1a5d12a6e168f
Instruction ID: e92a30f647e059f84c3662a5853805e55c155ad4ddc6fc357ea8e0081ace97c3
Opcode Fuzzy Hash: d90ee3a893a0dc72c3848248a1873dcb725225a210599cc20fd1a5d12a6e168f
Instruction Fuzzy Hash: 62315C34601B418BE761ABB9A48935B76E0EF45318F14483FE581A72D2D77CA884CF5E

Function 00405D50 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00405D81
FreeLibrary.KERNEL32(00400000,?,00000000,?,?,00405E86,00404023,0040406A,00000000,?,00404083,?,?,?,?,00486734), ref: 00405E22
ExitProcess.KERNEL32(00000000,?,00000000,?,?,00405E86,00404023,0040406A,00000000,?,00404083,?,?,?,?,00486734), ref: 00405E5E

Part of subcall function 00405CB8: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?,?,00405E86,00404023,0040406A,00000000,?), ref: 00405CF1
Part of subcall function 00405CB8: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?,?,00405E86,00404023,0040406A,00000000), ref: 00405CF7
Part of subcall function 00405CB8: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000,?), ref: 00405D12
Part of subcall function 00405CB8: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00405D71,?,00000000), ref: 00405D18

Strings

MZP, xrefs: 00405E21

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: MZP
API String ID: 3490077880-2889622443
Opcode ID: 476567bd706faa08b2860b4bdb782b6af1774b5e27a4e3545c261a0e26a7b744
Instruction ID: b38e6e20968f9dd51013dd86da7a5adcd4d42222583a8947ff30ec8df154a19c
Opcode Fuzzy Hash: 476567bd706faa08b2860b4bdb782b6af1774b5e27a4e3545c261a0e26a7b744
Instruction Fuzzy Hash: 7E316D34600B418BE760AB69E48971B76E4EF45318F14443FE580A73D2D77CA884CF5D

Function 0040B5E8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Not Config,0040B610,?), ref: 0040B5FB
MessageBoxW.USER32(00000000,Not Config,GGT,?), ref: 0040B606

Strings

Not Config, xrefs: 0040B5F9, 0040B604
GGT, xrefs: 0040B603

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: Message
String ID: GGT$Not Config
API String ID: 2030045667-3135470170
Opcode ID: 4b8a4c59b1f7a2e123fa8cac472319ef520fd058445deb380fb68a97e84f0c4a
Instruction ID: 09803daf9443879b7dc9e8754dbd7872eb60d7eb9ad1f4574c2174cc229b4f7d
Opcode Fuzzy Hash: 4b8a4c59b1f7a2e123fa8cac472319ef520fd058445deb380fb68a97e84f0c4a
Instruction Fuzzy Hash: 0FD0A9A112432875D4202A130C02DB32A2CCC917A03088C3BB90472182863BAC2040FF

Function 00439284 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0048664C,00000000,00439427,?,?,?,?,00000000,00000000), ref: 004392B4
lstrlenW.KERNEL32(00000000,?,00439448,?,00439448,?,00439448,?,?,0048664C,00000000,00439427), ref: 00439396
LeaveCriticalSection.KERNEL32(0048664C,00439404,00439427,?,?,?,?,00000000,00000000), ref: 004393F7

Strings

4gH, xrefs: 004392E0

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: CriticalSection$EnterLeavelstrlen
String ID: 4gH
API String ID: 3224049430-2392367260
Opcode ID: 47defe703287ea594ae1c07abb13b2d47f8dddb316f1a99fff683f0de99b3499
Instruction ID: 4ccfdad5408f303f1bc6ef96d1109fe59f5890f2a7af6574d1485d49e1ed1b7c
Opcode Fuzzy Hash: 47defe703287ea594ae1c07abb13b2d47f8dddb316f1a99fff683f0de99b3499
Instruction Fuzzy Hash: 9541A031604208AFDB01EBA5CC42F9E77F8EB4D714F614076F500F72D1DAB9AE119A69

Function 0040B0EC Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 114memorystringCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001400,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B123
lstrlenW.KERNEL32(00000000,?,?,00000000,00001400,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0040B1DF
VirtualFree.KERNEL32(00000000,00000000,00008000,0040B218,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B20B

Strings

0.0.0.0, xrefs: 0040B1C5

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: Virtual$AllocFreelstrlen
String ID: 0.0.0.0
API String ID: 1037993708-3771769585
Opcode ID: 6564ce073df12d48193ef6cc336d6408e1dcfe9c11b139c9fa22ed32b664ca5a
Instruction ID: d9e483307b11907a1b336cc8d58400cd9b3fb6a4ef8d040ba9d6bd8e813edc8e
Opcode Fuzzy Hash: 6564ce073df12d48193ef6cc336d6408e1dcfe9c11b139c9fa22ed32b664ca5a
Instruction Fuzzy Hash: DC419270A40209AFEB01EB95CC92B9E77B8EB48304F5044BAF101F72D1D778AE14DB99

Function 00427EE0 Relevance: 6.1, APIs: 4, Instructions: 82stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32(00000202,?,00000000,00428009), ref: 00427F25
QueryDosDeviceW.KERNEL32(00000000,?,?,00000072,00000202,?,00000000,00428009), ref: 00427F7B
lstrlenW.KERNEL32(?,00000000,?,?,00000072,00000202,?,00000000,00428009), ref: 00427F87
StrCmpNIW.SHLWAPI(?,?,00000000,?,00000000,?,?,00000072,00000202,?,00000000,00428009), ref: 00427F97

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: DeviceDriveLogicalQueryStringslstrlen
String ID:
API String ID: 243930641-0
Opcode ID: a7e4fb706dae23cce2e3905365d5b76be73495882ece122b121f7eb275b18a5a
Instruction ID: c93e83704bf87b4d3c7b7635578ed03522896ac4e1c9abb0733d05025df9e800
Opcode Fuzzy Hash: a7e4fb706dae23cce2e3905365d5b76be73495882ece122b121f7eb275b18a5a
Instruction Fuzzy Hash: 51318775A052189FDB60EB25DC49A9E73B8EB48300F5185FBF409E3251EE38DE548F58

Function 0040B0EB Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 77memorystringCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001400,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B123
lstrlenW.KERNEL32(00000000,?,?,00000000,00001400,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0040B1DF
VirtualFree.KERNEL32(00000000,00000000,00008000,0040B218,00001000,00000004,00000000,0040B246,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B20B

Strings

0.0.0.0, xrefs: 0040B1C5

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: Virtual$AllocFreelstrlen
String ID: 0.0.0.0
API String ID: 1037993708-3771769585
Opcode ID: 95f96f50283596cd0208414d3cbcbce02a8cb6110614ffbb8205cf7f9e9816dc
Instruction ID: 2a2c1df8ae4463708a3bec380d016629bdb2d6206de091ed7e9d638ff9ecaf91
Opcode Fuzzy Hash: 95f96f50283596cd0208414d3cbcbce02a8cb6110614ffbb8205cf7f9e9816dc
Instruction Fuzzy Hash: 4F217C70640204AFEB11EBA9C8A6B9E77A8EB49304F1044BAF501F76D1C7789950C699

Function 0042BA24 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0042BA43
SendMessageW.USER32(?,0000000D,?,00465D1C), ref: 0042BA86
SetWindowTextW.USER32(?,00000000), ref: 0042BACA
SetFocus.USER32(?,?,00000000,?,?,0000000E,00000000,00000000,00000000,0042BAF0,?,00000000), ref: 0042BAD5

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: MessageSend$FocusTextWindow
String ID:
API String ID: 2333564098-0
Opcode ID: a88227335cca2f77a9519455c1fe331fca11a6a158101077e538482d452faf54
Instruction ID: c5c6d1f71d7d5abd3f140a9d873e570a62db933a69622a8a51123b3dec96c00d
Opcode Fuzzy Hash: a88227335cca2f77a9519455c1fe331fca11a6a158101077e538482d452faf54
Instruction Fuzzy Hash: 97112E74640704ABD710EB55FC5AB5A73F8E748704FA0883AF5009B2E1D7F9A950875D

Function 00409428 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 004094F7
LocalFree.KERNEL32(0052E328,00000000), ref: 00409511

Strings

(R, xrefs: 0040944B

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: Free$LibraryLocal
String ID: (R
API String ID: 3007483513-2743311286
Opcode ID: f1440c9207516d799bff01a95fb1b780083962cb9caf534dbe967da67f6cd1a4
Instruction ID: 794add6f56abb578411f7ef61ae6dacc1c24b6d74e6f65c8e1d29d9f289a045b
Opcode Fuzzy Hash: f1440c9207516d799bff01a95fb1b780083962cb9caf534dbe967da67f6cd1a4
Instruction Fuzzy Hash: 4731A472900105ABCB14DFA6D8C19BFB3B8AF84314B14453EE904B7382DB39DD41CBA8

Function 0040B29C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 0040B948: GetEnvironmentVariableW.KERNEL32(00000000,?,00000208,004866F8,0043D0E3,00000000,0043D13A,?,00486680,00000001,00000000,00000000,?,00437AE2,?,00000000), ref: 0040B95D
Part of subcall function 0040B948: GetLongPathNameW.KERNELBASE(?,?,00000208), ref: 0040B972

Part of subcall function 0040ACA4: lstrlenW.KERNEL32(00000000,?,?,00486730,?), ref: 0040ACDD

PathFileExistsW.SHLWAPI(00000000,?,?,00000000,00000000,Temp,?,00000000,0040B377,?,?,00486680,00000000,00000000,00000000,00000000), ref: 0040B31D

Strings

Temp, xrefs: 0040B2E0, 0040B329
Temp, xrefs: 0040B2C0

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: Path$EnvironmentExistsFileLongNameVariablelstrlen
String ID: Temp$Temp
API String ID: 2856746939-245102275
Opcode ID: fc830c92589ad5342fd4e66cf01ed2c17b86b29a44920e7f029c1e3a9a43f651
Instruction ID: 46c15489f3eb44522c785d134b2f827a4a98169e1fe77a71831a75c28b8f49eb
Opcode Fuzzy Hash: fc830c92589ad5342fd4e66cf01ed2c17b86b29a44920e7f029c1e3a9a43f651
Instruction Fuzzy Hash: 46215A70A00119AFDB01EBA1CC52DBFB7B9EF84304B61C47BB941B3690D77C9D1196A8

Function 0040B3B8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 0040B948: GetEnvironmentVariableW.KERNEL32(00000000,?,00000208,004866F8,0043D0E3,00000000,0043D13A,?,00486680,00000001,00000000,00000000,?,00437AE2,?,00000000), ref: 0040B95D
Part of subcall function 0040B948: GetLongPathNameW.KERNELBASE(?,?,00000208), ref: 0040B972

Part of subcall function 0040ACA4: lstrlenW.KERNEL32(00000000,?,?,00486730,?), ref: 0040ACDD

PathFileExistsW.SHLWAPI(00000000,?,?,00000000,00000000,Temp,?,00000000,0040B498,?,?,00486680,00000000,00000000,00000000,00000000), ref: 0040B43E

Strings

Temp, xrefs: 0040B401, 0040B44A
Temp, xrefs: 0040B3E1

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: Path$EnvironmentExistsFileLongNameVariablelstrlen
String ID: Temp$Temp
API String ID: 2856746939-245102275
Opcode ID: 7237d7c97321785c44f2b4371a02576726028b20681e666b8d51949dfb1120e9
Instruction ID: 320bcaab7f7199f54f19ef5aa5192f16669c5e948fce9d3d7dddb2f051f29b96
Opcode Fuzzy Hash: 7237d7c97321785c44f2b4371a02576726028b20681e666b8d51949dfb1120e9
Instruction Fuzzy Hash: 46215D70A001196FDB01EBA1CC51D6FB7B9EF84704F21C477B501B3295D77C9A1596A8

Function 0042A30C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0040ACA4: lstrlenW.KERNEL32(00000000,?,?,00486730,?), ref: 0040ACDD

OpenFileMappingW.KERNEL32(000F001F,00000000,00000000,00000000,00000000,00000000,0042A3BA,?,00486734,00486680,00000000,?,00437ED9,?,00000000,00437F69), ref: 0042A356
InitializeCriticalSection.KERNEL32(00465C80,?,00486734,00486680,00000000,?,00437ED9,?,00000000,00437F69,?,00000000,00000000,00000000,?,0043FD1C), ref: 0042A39F

Strings

_Share_GGT_, xrefs: 0042A33D

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: CriticalFileInitializeMappingOpenSectionlstrlen
String ID: _Share_GGT_
API String ID: 3694923735-3867152089
Opcode ID: 41f1d88d2d1c4f0c2cb4bbf11ab129d5343994423090c7a276e01615e93b37f1
Instruction ID: ce4900a62e11ce9a572bac5c0a59808664cb2c3850396779e9c8bc1c065c1da5
Opcode Fuzzy Hash: 41f1d88d2d1c4f0c2cb4bbf11ab129d5343994423090c7a276e01615e93b37f1
Instruction Fuzzy Hash: F3118674740310AFE710EB69DC42F2A73D9EB49B18FA1443BFD01E76D1D9B85C24865A

Function 0042743C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,00000000,004274B0,?,?,00486680,00000000,00000000,?,0043F226,?,00486734,00486680,00000000,00000000,00000000), ref: 00427469

Part of subcall function 0040ADB8: lstrlenW.KERNEL32(00000000,?,?,00486734,00486680,00425F2B,00000000,00426187,?,00486680,00000000,00000000,?,0043F7A0,00000000,0043FD8B), ref: 0040ADD7

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Strings

zalee:;'MEE, xrefs: 00427456
ZAO`elFyl{h}`fg^, xrefs: 00427477

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: AddressLibraryLoadProclstrlen
String ID: ZAO`elFyl{h}`fg^$zalee:;'MEE
API String ID: 2991167014-1447228337
Opcode ID: c820523d15c9dbf95b80c6cde00e35f83b407bfca9d4687b59677f06df80f873
Instruction ID: 077bc46651e9a40de25fcd03cddb1c768f49804e1acef1ba0aff0074e990fe41
Opcode Fuzzy Hash: c820523d15c9dbf95b80c6cde00e35f83b407bfca9d4687b59677f06df80f873
Instruction Fuzzy Hash: FAF0C231605718ABD711FBA1DC02B5DBBACEF45718FD2407AF800B7681D67CAE1046AD

Function 004303EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0043042A

Strings

#32770, xrefs: 004303F4
Button, xrefs: 0043040B

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: MessagePost
String ID: #32770$Button
API String ID: 410705778-3763930512
Opcode ID: 80110679f937891faa6f7cba931e5fed77503df53b31854cfd618e18af252cd2
Instruction ID: 28ed841a6425ce2d44e84357510c75fb6cb91fbfeaac2ff36796f76db45616d3
Opcode Fuzzy Hash: 80110679f937891faa6f7cba931e5fed77503df53b31854cfd618e18af252cd2
Instruction Fuzzy Hash: F3E086743C13026FE62097588CE6F1A63A85739B04F246176B700FB2E0CEE8EE14D61C

Function 0040B4DC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00486680,0043F20A,00000001,00000000,?,00486734,00486680,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B4E5

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Strings

kernel32.dll, xrefs: 0040B4E0
Wow64DisableWow64FsRedirection, xrefs: 0040B4EC

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 1646373207-3689287502
Opcode ID: 2dac5d5c5663db8a0450eab5fd166fe870256cbb9f231f614ab9bd4640426b9f
Instruction ID: 2aacd0a7d080d4f8486dfed4c2e02e9ea53df2493b021d7d88a6b83d7c6298d6
Opcode Fuzzy Hash: 2dac5d5c5663db8a0450eab5fd166fe870256cbb9f231f614ab9bd4640426b9f
Instruction Fuzzy Hash: 26C0129231272439E50071F91CC6EF7028CC9453AE31004B3F900F11C2E7AC4D2011EE

Function 0040B564 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00486680,0043F3D6,00000000,?,00486734,00486680,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B56D

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Strings

kernel32.dll, xrefs: 0040B568
Wow64RevertWow64FsRedirection, xrefs: 0040B574

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 1646373207-1355242751
Opcode ID: 95d41de4b2aaa3d5bceb4c6ece1da09edf5c32e92841572d0be30113edd33b41
Instruction ID: 8249db6378fdea734a8c5b5c79ccac93c87cf519fdf57918cf521f3dbb983d50
Opcode Fuzzy Hash: 95d41de4b2aaa3d5bceb4c6ece1da09edf5c32e92841572d0be30113edd33b41
Instruction Fuzzy Hash: 5CC002963563243DE65172F51CC69EB528CC9557AE36408B7FD00F11C3E7AD4D2111ED

Function 0043E4A4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,00000000,00000000,00000000,0043E626), ref: 0043E4B0

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Strings

ntdll.dll, xrefs: 0043E4AB
NtUnmapViewOfSection, xrefs: 0043E4B7

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 2574300362-1050664331
Opcode ID: 31b82d30f3ad7dba5dbea5cdbf4706ed8ff0013fde9a1af21a2c0f08b4647315
Instruction ID: 4e69b6650e6ade436c82b191c502fd32af055e20bfb3fd8e8d0f99f71a318bac
Opcode Fuzzy Hash: 31b82d30f3ad7dba5dbea5cdbf4706ed8ff0013fde9a1af21a2c0f08b4647315
Instruction Fuzzy Hash: 05C012523036103A911031E71C86D6B454CCCEAAB53105037B514E2182D4AC4C114179

Function 0041D238 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00443377,00000000,004433AE), ref: 0041D23E

Part of subcall function 0040A4AC: GetProcAddress.KERNEL32(?,?), ref: 0040A4D0

Strings

kernel32.dll, xrefs: 0041D239
GetDiskFreeSpaceExW, xrefs: 0041D249

Memory Dump Source

Source File: 0000000F.00000002.2036220931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2036220931.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000486000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.0000000000489000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2036220931.000000000048C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_TASLogin.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: a79e509d4b5e1b93e5af0388efdb664cba8b92b54a70f921204110405e308a7a
Instruction ID: 1ed0fb5f9b62a531acb68cd7a06d8274aa2f261e9248045f22735aa701152202
Opcode Fuzzy Hash: a79e509d4b5e1b93e5af0388efdb664cba8b92b54a70f921204110405e308a7a
Instruction Fuzzy Hash: 80D0A9F8E423604ED700EBE09DC6B823798879A308F0000BBB02057283CBBCC89C820C

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report #Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Privilege Escalation

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\gz.txt

C:\Users\Public\BRBUAU

C:\Users\Public\Documents\A9Q9P9\TASLogin.KInf

C:\Users\Public\Documents\A9Q9P9\TASLogin.exe

C:\Users\Public\Documents\A9Q9P9\TASLoginBase.dll

C:\Users\Public\Documents\A9Q9P9\gii.png

C:\Users\Public\Documents\A9Q9P9\lee0923.hwp

C:\Users\Public\Music\LI1L1K\1YH1H1.url

C:\Users\Public\Music\LI1L1K\4N7N6N.url

C:\Users\Public\Music\LI1L1K\52M2L5.url

C:\Users\Public\Music\LI1L1K\84O4N7.url

C:\Users\Public\Music\LI1L1K\96P9P8.url

C:\Users\Public\Music\LI1L1K\ARAUAU.url

C:\Users\Public\Music\LI1L1K\CSBSBV.url

C:\Users\Public\Music\LI1L1K\DXGXG0.url

C:\Users\Public\Music\LI1L1K\N6M6P6.url

C:\Users\Public\Music\LI1L1K\QAT9TC.url

C:\Users\Public\Music\LI1L1K\SBRBRB.url

C:\Users\Public\Music\LI1L1K\T9SCSC.url

Windows Analysis Report
#Uc774#Uc9c0#Ud604_#Uc785#Uc0ac#Uc9c0#Uc6d0#Uc11c.hpw.scr.exe

Function 0040AEE0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 328
COMMON

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre