Edit tour

Windows Analysis Report
oaUNY8P657.exe

Overview

General Information

Sample name:	oaUNY8P657.exe renamed because original name is a hash value
Original sample name:	4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe
Analysis ID:	1557202
MD5:	4f0c8a81138b78a1f40ef1d383632130
SHA1:	96b6c6ff5c5b1aa90014e975bb851d23acbed598
SHA256:	4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42
Tags:	exeuser-Chainskilabs
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

Sample uses string decryption to hide its real strings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May check the online IP address of the machine

One or more processes crash

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Use Short Name Path in Command Line

Yara signature match

Classification

Process Tree

System is w10x64

oaUNY8P657.exe (PID: 7400 cmdline: "C:\Users\user\Desktop\oaUNY8P657.exe" MD5: 4F0C8A81138B78A1F40EF1D383632130)

conhost.exe (PID: 7408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

oaUNY8P657.exe (PID: 7456 cmdline: "C:\Users\user\Desktop\oaUNY8P657.exe" MD5: 4F0C8A81138B78A1F40EF1D383632130)

sms561F.tmp (PID: 7508 cmdline: "C:\Users\user~1\AppData\Local\Temp\sms561F.tmp" MD5: 8032A5E68376A879472C297749CDB4C4)

WerFault.exe (PID: 7752 cmdline: C:\Windows\system32\WerFault.exe -u -p 7508 -s 1664 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["left-noon.gl.at.ply.gg"], "Port": 60705, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "US11B.exe"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\sms561F.tmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Local\Temp\sms561F.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\sms561F.tmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xe912:$s6: VirtualBox 0xe870:$s8: Win32_ComputerSystem 0x11399:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x11436:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1154b:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xff57:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.1578890311.000000000234C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000003.00000002.1580895297.000001F9C5F20000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000003.00000002.1580895297.000001F9C5F20000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xe992:$s6: VirtualBox 0xe8f0:$s8: Win32_ComputerSystem 0x11419:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x114b6:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x115cb:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xffd7:$cnc4: POST / HTTP/1.1
00000004.00000000.1298513996.00000000001E2000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000004.00000000.1298513996.00000000001E2000.00000002.00000001.01000000.00000004.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xe712:$s6: VirtualBox 0xe670:$s8: Win32_ComputerSystem 0x11199:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x11236:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1134b:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xfd57:$cnc4: POST / HTTP/1.1
Process Memory Space: oaUNY8P657.exe PID: 7456	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: sms561F.tmp PID: 7508	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.0.sms561F.tmp.1e0000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
4.0.sms561F.tmp.1e0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.0.sms561F.tmp.1e0000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xe912:$s6: VirtualBox 0xe870:$s8: Win32_ComputerSystem 0x11399:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x11436:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1154b:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xff57:$cnc4: POST / HTTP/1.1

Sigma Signatures

System Summary

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\sms561F.tmp", CommandLine: "C:\Users\user~1\AppData\Local\Temp\sms561F.tmp", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\sms561F.tmp, NewProcessName: C:\Users\user\AppData\Local\Temp\sms561F.tmp, OriginalFileName: C:\Users\user\AppData\Local\Temp\sms561F.tmp, ParentCommandLine: "C:\Users\user\Desktop\oaUNY8P657.exe", ParentImage: C:\Users\user\Desktop\oaUNY8P657.exe, ParentProcessId: 7456, ParentProcessName: oaUNY8P657.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\sms561F.tmp", ProcessId: 7508, ProcessName: sms561F.tmp

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: left-noon.gl.at.ply.gg

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp

Avira: detection malicious, Label: TR/Spy.Gen

Found malware configuration

Source: 00000004.00000002.1578890311.000000000234C000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Xworm {"C2 url": ["left-noon.gl.at.ply.gg"], "Port": 60705, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "US11B.exe"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp

ReversingLabs: Detection: 79%

Multi AV Scanner detection for submitted file

Source: oaUNY8P657.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: oaUNY8P657.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 4.0.sms561F.tmp.1e0000.0.unpack	String decryptor: left-noon.gl.at.ply.gg
Source: 4.0.sms561F.tmp.1e0000.0.unpack	String decryptor: 60705
Source: 4.0.sms561F.tmp.1e0000.0.unpack	String decryptor: <123456789>
Source: 4.0.sms561F.tmp.1e0000.0.unpack	String decryptor: <Xwormmm>
Source: 4.0.sms561F.tmp.1e0000.0.unpack	String decryptor: US11B.exe

Source: oaUNY8P657.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Xml.ni.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: mscorlib.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdbRSDS source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Management.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Management.ni.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.pdbSystem.Core.ni.dllMicrosoft.VisualBasic.dllpD6 source: WER7417.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdbh source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Xml.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER7417.tmp.dmp.8.dr

Source: C:\Users\user\Desktop\oaUNY8P657.exe	Code function: 4x nop then push rbx		0_2_00007FF78CB221D6
Source: C:\Users\user\Desktop\oaUNY8P657.exe	Code function: 4x nop then push rbx		3_2_00007FF78CB221D6

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: left-noon.gl.at.ply.gg

Yara detected Generic Downloader

Source: Yara match	File source: 4.0.sms561F.tmp.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\sms561F.tmp, type: DROPPED

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: unknown

DNS query: name: ip-api.com

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: ip-api.com

Source: sms561F.tmp, 00000004.00000002.1579490182.000000001B1ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.micu
Source: sms561F.tmp, 00000004.00000002.1578890311.00000000023E8000.00000004.00000800.00020000.00000000.sdmp, sms561F.tmp, 00000004.00000002.1578890311.0000000002400000.00000004.00000800.00020000.00000000.sdmp, sms561F.tmp, 00000004.00000002.1578890311.00000000023F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: oaUNY8P657.exe, 00000003.00000002.1580895297.000001F9C5F20000.00000004.00000020.00020000.00000000.sdmp, sms561F.tmp, 00000004.00000002.1578890311.000000000234C000.00000004.00000800.00020000.00000000.sdmp, sms561F.tmp, 00000004.00000000.1298513996.00000000001E2000.00000002.00000001.01000000.00000004.sdmp, sms561F.tmp.3.dr	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: sms561F.tmp, 00000004.00000002.1578890311.00000000023E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net
Source: oaUNY8P657.exe, 00000003.00000002.1580895297.000001F9C5F20000.00000004.00000020.00020000.00000000.sdmp, sms561F.tmp, 00000004.00000000.1298513996.00000000001E2000.00000002.00000001.01000000.00000004.sdmp, sms561F.tmp.3.dr	String found in binary or memory: https://i.ibb.co/Dwrj41N/Image.png

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.0.sms561F.tmp.1e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000002.1580895297.000001F9C5F20000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000004.00000000.1298513996.00000000001E2000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\oaUNY8P657.exe	Code function: 3_2_00402203	3_2_00402203
Source: C:\Users\user\Desktop\oaUNY8P657.exe	Code function: 3_2_00401F98	3_2_00401F98
Source: C:\Users\user\Desktop\oaUNY8P657.exe	Code function: 3_2_004021DB	3_2_004021DB
Source: C:\Users\user\Desktop\oaUNY8P657.exe	Code function: 3_2_00401F6F	3_2_00401F6F
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Code function: 4_2_00007FFAAC481148	4_2_00007FFAAC481148
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Code function: 4_2_00007FFAAC487372	4_2_00007FFAAC487372
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Code function: 4_2_00007FFAAC4861C6	4_2_00007FFAAC4861C6
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Code function: 4_2_00007FFAAC481659	4_2_00007FFAAC481659
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Code function: 4_2_00007FFAAC4810F2	4_2_00007FFAAC4810F2
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Code function: 4_2_00007FFAAC4821C9	4_2_00007FFAAC4821C9

Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7508 -s 1664

Source: oaUNY8P657.exe

Static PE information: Number of sections : 18 > 10

Source: oaUNY8P657.exe, 00000003.00000002.1580895297.000001F9C5F20000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameWizClient.exe4 vs oaUNY8P657.exe

Source: 4.0.sms561F.tmp.1e0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000002.1580895297.000001F9C5F20000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000004.00000000.1298513996.00000000001E2000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: sms561F.tmp.3.dr, 2PFYT6fKVKtP258l.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: sms561F.tmp.3.dr, CfOxDqrrlu3NvLEu.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: sms561F.tmp.3.dr, CfOxDqrrlu3NvLEu.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: sms561F.tmp.3.dr, 2PFYT6fKVKtP258l.cs	Base64 encoded string: 'rPuqQq1xOQbCQnrE4cq3Xs26BOFqQQv8fkMLyoFP3mFIfcMAXi9zpr4HpV3emTR4kkIpPbFiKpeip3fFC9mg'
Source: sms561F.tmp.3.dr, CfOxDqrrlu3NvLEu.cs	Base64 encoded string: 'QoM0VtExe81XcnZLEO3SM3sBMNMMGshqFTI06NW2EkIjr5SFk5zrB7vGunPUecofdrwAzpGpvPa3MxoWEIWG', 'J5eCkOtQfZsc0XN4pnjoW5hUYGSrxCBHFKzOJAoW6ZsSXJJXf5JpoiqPX285IGbpnW3jmTdFcEXjVjE8PpXU', 'ZEvC59Na6zoJgAE8FRZpal7eF8ajvJxnl45AXgmT5cVmrRixgpsBTdWgXweiQ4o3Y5QwJGEivlYCc7ljTLZk', 'mFulPueE5RKEZTKk8GQyJItfTzZH3oMRQ7R4F7E4PlxGrtlNNYPVp4cTipHD039pix8itKW8o1BXB1soM4qG'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/6@1/1

Source: C:\Users\user\Desktop\oaUNY8P657.exe

Code function: 0_2_00007FF78CB21450 GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,

0_2_00007FF78CB21450

Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7508
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Mutant created: \Sessions\1\BaseNamedObjects\FgDl5YTJAMA8a3S4
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7408:120:WilError_03

Source: C:\Users\user\Desktop\oaUNY8P657.exe

File created: C:\Users\user~1\AppData\Local\Temp\sms561F.tmp

Jump to behavior

Source: oaUNY8P657.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\oaUNY8P657.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: oaUNY8P657.exe

ReversingLabs: Detection: 50%

Source: unknown	Process created: C:\Users\user\Desktop\oaUNY8P657.exe "C:\Users\user\Desktop\oaUNY8P657.exe"
Source: C:\Users\user\Desktop\oaUNY8P657.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\oaUNY8P657.exe	Process created: C:\Users\user\Desktop\oaUNY8P657.exe "C:\Users\user\Desktop\oaUNY8P657.exe"
Source: C:\Users\user\Desktop\oaUNY8P657.exe	Process created: C:\Users\user\AppData\Local\Temp\sms561F.tmp "C:\Users\user~1\AppData\Local\Temp\sms561F.tmp"
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7508 -s 1664
Source: C:\Users\user\Desktop\oaUNY8P657.exe	Process created: C:\Users\user\Desktop\oaUNY8P657.exe "C:\Users\user\Desktop\oaUNY8P657.exe"	Jump to behavior
Source: C:\Users\user\Desktop\oaUNY8P657.exe	Process created: C:\Users\user\AppData\Local\Temp\sms561F.tmp "C:\Users\user~1\AppData\Local\Temp\sms561F.tmp"	Jump to behavior

Source: C:\Users\user\Desktop\oaUNY8P657.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaUNY8P657.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaUNY8P657.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: oaUNY8P657.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: oaUNY8P657.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Xml.ni.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: mscorlib.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdbRSDS source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Management.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Management.ni.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.pdbSystem.Core.ni.dllMicrosoft.VisualBasic.dllpD6 source: WER7417.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdbh source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Xml.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER7417.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb source: WER7417.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER7417.tmp.dmp.8.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: sms561F.tmp.3.dr, MznL2R1AhOkghzwOdAYEOHu2ZE8TJXeufGdSA08XoR9P01q0IfoZPud7IvhhHTE0VwleriSnfV.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{U6Miq7mg8dicdNkJ0c9GvnLFQzMpASd2h1bUt3iIgXGEtDqs2sXc9xBz83yqN1MtZb5lKvBBrm0Jync59Tm8cIJXE.Qn58Ydns0vSS4KeRMKOGcNopDzqwDcDkHdX2ES9OsP6Y9BWWSi3SuF8agxOO0WO15mENKIKc3OHJYJmyie8qU1Xcj,U6Miq7mg8dicdNkJ0c9GvnLFQzMpASd2h1bUt3iIgXGEtDqs2sXc9xBz83yqN1MtZb5lKvBBrm0Jync59Tm8cIJXE.FoU2PbuQD8JnrF7IKWp6OMwNkNSWrPSdF57ErpqX9vT6znJpXI64FljVixvQ46Pm2h1FZBxLsvTIkRrjTKl6knNMD,U6Miq7mg8dicdNkJ0c9GvnLFQzMpASd2h1bUt3iIgXGEtDqs2sXc9xBz83yqN1MtZb5lKvBBrm0Jync59Tm8cIJXE._6RigNdzcvotYMmJS6U16u2yCAgrqsQh8Z9KFZiMmQMl7yP2OAN0XZZqO0Dmjyj6LBvYvyEQ3Z6j6ONUEUys24zm5V,U6Miq7mg8dicdNkJ0c9GvnLFQzMpASd2h1bUt3iIgXGEtDqs2sXc9xBz83yqN1MtZb5lKvBBrm0Jync59Tm8cIJXE.vypUA3oiLGxAFvRxTlknguPph3w0VcEFujOlqFnfI6P0pGGmKK1GVUepWNMnW0iCeOZiGu84HYeUjUEXwBMVXgxlY,CfOxDqrrlu3NvLEu.lHwfqQSpAbfiN3IY()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: sms561F.tmp.3.dr, MznL2R1AhOkghzwOdAYEOHu2ZE8TJXeufGdSA08XoR9P01q0IfoZPud7IvhhHTE0VwleriSnfV.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{MzDGpvkFkxueUC0I[2],CfOxDqrrlu3NvLEu.hIozlAtr03U5MtF3(Convert.FromBase64String(MzDGpvkFkxueUC0I[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: sms561F.tmp.3.dr, MznL2R1AhOkghzwOdAYEOHu2ZE8TJXeufGdSA08XoR9P01q0IfoZPud7IvhhHTE0VwleriSnfV.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { MzDGpvkFkxueUC0I[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: sms561F.tmp.3.dr, MznL2R1AhOkghzwOdAYEOHu2ZE8TJXeufGdSA08XoR9P01q0IfoZPud7IvhhHTE0VwleriSnfV.cs	.Net Code: kBeA5MeiWf2bbj5tp0YDkgaCeztrGKF6ZnPxIyaJSuJ5VrVKFjh87xrqn5HRQaMHzKcO3JNnNO System.AppDomain.Load(byte[])
Source: sms561F.tmp.3.dr, MznL2R1AhOkghzwOdAYEOHu2ZE8TJXeufGdSA08XoR9P01q0IfoZPud7IvhhHTE0VwleriSnfV.cs	.Net Code: _3Iirrw5wIfKEI8SD System.AppDomain.Load(byte[])
Source: sms561F.tmp.3.dr, MznL2R1AhOkghzwOdAYEOHu2ZE8TJXeufGdSA08XoR9P01q0IfoZPud7IvhhHTE0VwleriSnfV.cs	.Net Code: _3Iirrw5wIfKEI8SD
Source: sms561F.tmp.3.dr, CfOxDqrrlu3NvLEu.cs	.Net Code: zyOcyhiuwKGcUmq8 System.AppDomain.Load(byte[])

Source: oaUNY8P657.exe	Static PE information: real checksum: 0x133cf should be: 0x2a5d8
Source: sms561F.tmp.3.dr	Static PE information: real checksum: 0x0 should be: 0x22e57

Source: oaUNY8P657.exe	Static PE information: section name: .xdata
Source: oaUNY8P657.exe	Static PE information: section name: /4
Source: oaUNY8P657.exe	Static PE information: section name: /19
Source: oaUNY8P657.exe	Static PE information: section name: /31
Source: oaUNY8P657.exe	Static PE information: section name: /45
Source: oaUNY8P657.exe	Static PE information: section name: /57
Source: oaUNY8P657.exe	Static PE information: section name: /70
Source: oaUNY8P657.exe	Static PE information: section name: /81

Source: sms561F.tmp.3.dr, ZZY0kMSImmoTRszS.cs	High entropy of concatenated method names: '_7IVTtTcQI7aGvndt', 'uEQ71lTA2MCMxbvw', '_4BoSgaszw5Iy4eAH', '_9FOJheTGl08HwdTlDmlKcOlJV3', 'PURMgtnSsZQcEiMCzRaO1rvLi3', 'hD8euee6JJwU7hmtBhXtaruLOq', 'Q7jJjtBxODrzWyzrqfC2zIjNCd', 'AIw6wZS3KrTLB9oOI0xz6vdTiV', 'sX9e7zKrLVCp3iXqgE8Rr1llWa', 'PTJdgYinzBcsGQ52kYDxNkSOJK'
Source: sms561F.tmp.3.dr, U6Miq7mg8dicdNkJ0c9GvnLFQzMpASd2h1bUt3iIgXGEtDqs2sXc9xBz83yqN1MtZb5lKvBBrm0Jync59Tm8cIJXE.cs	High entropy of concatenated method names: 'UzBps6fpp8QsyChO4HS08jfb43edsKm3UJ', 'x3tRJiMLynOThwr76IqFrTJ0QLexFcLiCP', 'oAiSvL14AyxYrNUMWf6I4ZLMX9E4Hn5bgB', 'NL7cMLH3i4zSQy47tiRsUHC4th9WMa8xgF'
Source: sms561F.tmp.3.dr, 54qJ9nuCm42kYVfcKKKLcxZh1yBzrUOZUOKYADh0tX2vgbqCdmkuX8h3K.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'uxEAk38JOD8NrzrSDGhdspIXavg4QpfGdt', '_3Jm2QcrD1vk4T3iUyOOjT3suTtS8ijV5bh', 'XLp21V89RgXLntZ9NCqb7ifKyJbOaEELRB', 'aQ72rOcP3bGFEBOmEWzmcKZBM0KKkBXUEi'
Source: sms561F.tmp.3.dr, Jm0j5mjozQ9zCcZx.cs	High entropy of concatenated method names: 'IkTuRcUhzkUGr4cp', 'JMm8DaPbu4ouVJlIoL86SG6SbcJrhQIritR8afuu85iEVXYv8L3hs0RwcS67fvRk2e', 'v8ZqP2g0K2hTNMxAlBbhQLIzzikXXYgvlYOobGZsy7Mvw43MTVwzqVtAe71RF6weN8', 'n1AklyhOz13CH86BMJ73VWxzo4GglkuaqPxUOVjbDC8PKyEV5hd9YyV8WaYebfFLtK', 'OXOEPq0ll3xpBwopsqkyGp7TXLGO5pAj2Eo81k4YpaU4PRHkDjiNg1l3iX4GbbqQOs'
Source: sms561F.tmp.3.dr, Ux5xT5SdUDgrmJoYwkXZ4wPj9TszCC1UbemG1uUDQeFag98fKpJjriWIEJYvAT5JeU3ZRcThgCIknGrOw2vbdhXCg.cs	High entropy of concatenated method names: 'UzHOFA4VUd3iiJHLlRLT5m1VPBoz16haBPufTWd7ZVA23vbnRkU0CuCm2pTRQRMjXs0LdzRdlPZx6RiHLlimnPFJt', 'kHjfMRg5q7RpD34WVdDJM64d861pkZ3TDGtbPsbacWyUkNzdhJQ8YZaGaKc86pf9e6nUIQz99aK96b3IvoHQMex5s', 'VpsaG5I2MD4kMUGFk6hwdgCXWIy8o106pHamoQvxrTdEWyjrw9avITLVvPMsEYBx1Y0XT7zhuxbp0iG84mEEUixB0', 'wATTPfpRc10N0eufHRyVVoHsmMAtEdl5hnO38Rl2vpoKvTI2w2zk2Nv0Sy89UB6vC9X8GCoADvaC4Zfac0J51TlJr', 'QCAJYvJDTWIydB5yXGJGqG9fjSLLGyPHcjvGa6JLCvXvWvrB28kQodhez2I2x64fDM7uuzXCkxzNMHWTviNZeRjuS', 'D7Rosv8SiKfCVIZikT4ROx5G4Z4p3v61TsrzpydcQvh53rCwbziqa2R3DzcgAHu2qMk9QuzXKHR47JojfOx4T296R', '_9Ca0VrI51E2MUkIeYk6ftvJ1ahqLp0tSiHL5WvnUZRZgLI2ZUPPCOdL9zwK3b3xnLP088s8zjrIRNJ9cRwlBxMI9V', '_38fqEuegyVhrKBrsLiNrmwgJ1SnOFCffafGImGJcMa05gDGSKq7YAuQWyaiQwVJcSfyo36jwrFMPT9jNSuocpmfM2', '_79WmPsrHLl33ufsC4LsYyQFOh6crYOiqkL9rGLtmRSTRKjw91haNC66T6tC9BGQZwJrAzItcPG5dc9D55odIS0MFa', 'EiUzB5Q1VAbOeTFIhvkrGIL799E5Hg3w1r4BKnc68Ac63ZGqPIKu5VifnTP1W4YzxB7Rd8mzIOLnasyHbX08Xw3s0'
Source: sms561F.tmp.3.dr, 2PFYT6fKVKtP258l.cs	High entropy of concatenated method names: 'ovJ69SMjolPj9MF5', 'CeqBJ7e9ZFYqv1UNgv5n6J0ocyYyCJ3OjHm73WfSSFkbYndeq1vinse0DCr63tpGycMuFybRGAX9X2OtKCk7', 'QgaurUKqWrvwJVa59QIYAkCQ6XEBD3wh80SZhu879n2VmrxZrFwiiBNclbFso80E1Ybs4UesgjkMMa0EyoLW', 'zqrlK2TEtLXi8eCzQmB77pmOgQ3LNr8ePoC242UBvpczjMrTLwblU4ZN5GNgPkq0LM6KpbPAxzuwaEpIiT6m', 'hh5odrhWvNu8lr2kA9Rvh22XzyJcbuyTnMf1mZTQ2eQ5GtgS54bgLJ2ygEs813CyJZ1BMksRMDZZsk8Qz5Zm'
Source: sms561F.tmp.3.dr, GxjjaV2cUpDuUZiR.cs	High entropy of concatenated method names: '_2hFRviCosJqAAAku', 'O38Zj7OdzaOl1obR', 'QsccK2WP0FXimxh8', 'vZaFrjVVCQ5Mdg4UXVPQXA03HFp1pV2jyWwxn73K4LT58HfJWGCCUEEyFmov0NoTtg', 'na2WokX7EpIDJccJeBcJkTkN3TEXwBbkV3M42ps2Gah4qFzJuz4SGBy1iCwp9Gkj99', '_6ZlcJaM9J6FBzHTTUYTPrbXWpqjllkUzL1S6xGkctMSAAZUvSmO', 'fkzXpJ0nZaBkVC739qyLKRXm9KscK8iPtkDbqYIfunO7SZcUvOl', 'FgE6AThVg0ug7JhYWCQd9U1gIIdLRaSzidWtxtRz13OATIsG7If', 'R7XRtOaBRMMgW6BSHoUZkyHBKrALXwBI1Eb89VhzTl0bSbUZuNk', 'iijy5ZRjUEF0jvbzqNSYc0AWRMByS7MQaOgCtcvAz4Ss6RNdI2U'
Source: sms561F.tmp.3.dr, 8AcBw83iTTZR0gzOLr4D7gMPEV1kMtgYpJXHnJwhGkoKVV8Q4esUC8oADm8sux5LS019SK7qTTVTv9FBj4VPUeMGz.cs	High entropy of concatenated method names: 'AHs9hYLZtHlvzhPB5egmLag6VVUND0ukDILJXfDpwCivkUAx2hAWqt2aBmfaGAOMAlT5jKWU62027iHiMjQbj60uI', '_3XOd53yGytMw0xVXZW9GjsWQMVxmVKE9LOimwKZ0l5EXvTG0nRb6QSfpA8k6sAIRzICC0q3HeoUGQyA7aCOFSqAqE', '_5wdxGPqPrGs9DzhtY9YatjiuMvXqfx3Qh6RkuEdSoMg57WhF8P8oebAaUS9VcSYTKDD8zURzdJx7J54s4tfLq1gRu', '_3OIeSsBy77psmlQA3gABEcuJYMOXz9b4pT3zPBfheophnYH7fEzFuFR8QoqNSDSGqryZ6cG4HLvxp5uDKvaMgTpRz', '_3EAy6OYn78QehlUvg9O3dcryr5VEt4ul9J04iTzxpbCRGjIoI9PeFWyk8torqPQSmXkMe1sv5kfT1AjzFuJ905IAg', 'xuOBzT4OUN2rOxBPWq4jdVyAJacIYPseni6iRj5uG8wk5WsRd2IyswUcIDqEyrwlReISqXCJGdcycOIIYgdzzguhW', '_8ebUR9S6nPyzTmWbvGFm3JcRqIBPylvJpaYR5aqTWuBbMlmSN0FPvltQWqpqIvHeBzLnQXOuoW', 'nZNrra2V1RvvxlNX3p7DZtJKMtpwIq0637OOcCDf4ZIUowrzwpc0EdoAU2pORdigjNyoBCuBAq', 'jLwd3zwzkLEU8BYtF0KLaBUelayoKyiZTe2IiNfdk2UhBZ3HFQTBIiESxb8DeR7DWQ7YtXYHvx', 'GioTMhUYsqPzfRxFwGqjaiaI9meiZh0Q3j3XF2aGTkOD3Gin3c6uh5Ge7cM4bWRyzk86tBquzp'
Source: sms561F.tmp.3.dr, qscAgj4aPLGJ38vR.cs	High entropy of concatenated method names: 's7t483xDEddrktVx', 'S69T85VOd4y3bwhO', 'ug35Tss1pRsniwZg', 'R8SGq2kONKo5XjSH', 'xUglXcaJZqHHlkFWxplNlNPsr7W70E3Kmzs89NCNCWVAlrtWy6q', 'dHII5vmLBYQAhUhgszWSVzsIevuBl2tKWsGzg3GuqHlVEIJ7XaB', '_8b0MFfgkVAcyQp37764nAsZX8GITDTSnhGHB8Bo7QUsy1ULkIek', 'dDUXAmhif1eIqQPgu8aR4MbtxLUKn0pqhmK78q6b9TsmJGeOe6l', 'OOXu3EwIMu2kZ1GIH4uGMnEFIhyPNjNlhHOAZAeWFv3BP1W8jCU', 'hdbl6cTLNfFwmcjEXJKfTjPPKE4mTw5U7AUoZ4azaANBll7JHCo'
Source: sms561F.tmp.3.dr, MznL2R1AhOkghzwOdAYEOHu2ZE8TJXeufGdSA08XoR9P01q0IfoZPud7IvhhHTE0VwleriSnfV.cs	High entropy of concatenated method names: 'BZBi7xApW8b9VeZsKqV74Hob6URHF0U7qBJxyUdOeP3RZ7I92LFa93QsclzS9jgoKcNeJYkHPk', 'kBeA5MeiWf2bbj5tp0YDkgaCeztrGKF6ZnPxIyaJSuJ5VrVKFjh87xrqn5HRQaMHzKcO3JNnNO', 'Wy3EMKMXP0xOOeRS75yH0SH12dnWmjTxbvzXhGtbVPvLu2WqJqcVS5S2JWJp3vruxJBYJwF2c4', '_6syQ1FNEp9LoDKGQG8IEYR5bEvFXgEqPXv8SdL1zYsVY24dPF1VCaCDR5Jp52Sh6cLe4MVHv3M', '_68zoW2eAfYPyeTKtwXzr5NoSJOdTZHObvVTLPeW0kdXGDMwlgO1FtAGUbjr35aUfrPnRNcnRYD', 'T1yZa7r0qpIPaLAYvIN7o5uALhB5hR1Pl0S4poLul3vYx5M84rxIft0RCevkClirA8pqvEKBDJ', 'OiaqDKql7eyByXmMBXPHKnhwAn8pLZhMKVEKWgs9Mx5nsQFsraOk7RmntpEpm89ODOLGsFkH2O', 'Brr5OtJlVzK2D88vAszYDISZmNR6ue3XOsHklYy17wiLDGYnQXNJb4hBHCsNuEXx2h4EuPFz4B', 'n1cm6SVhrxdk7TLga9qWAzujWP96MG3bLzciBJk8qILqCijftpgGPUPqKCDsJfUn3d9mzEBye0', '_5KJywWKXXbatDKz2'
Source: sms561F.tmp.3.dr, CfOxDqrrlu3NvLEu.cs	High entropy of concatenated method names: 'kFRgAy4ceH6sLvWU', '_55FZ68YNLufkVkYm', 'iMhSIAmSzNQwTrQT', '_2ncpsofLzCWtDE7V', 'WSHgnj4COP5DmpCo', 'UfIW6IRrWjwb8HBr', 'vZDPzR4ro93fiARX', 'DpfZq4FF1WqQb75o', 'AZz6uTt9Jv1sYycA', 'lCM3qwIKhEyacjsV'
Source: sms561F.tmp.3.dr, cc0HsONsZA56M57M.cs	High entropy of concatenated method names: 'QuTpVFjs5LhShU7t', 'SlbqSbp4X3V7uCLt', 'qB60QbG21Hk9JdQw', 'XsJgWzdQoQ9wnK74', 'p7olRxmfiVujoiwJ', '_3QQijd5s0gqMxRi9', 'Do2gm9jNiZZCKvMl', '_8A21HtwwODJIgloB', 'RhjgRJF8pzBni2Ck', 'hqBaphWstNJ8LeF2'

Source: C:\Users\user\Desktop\oaUNY8P657.exe

File created: C:\Users\user\AppData\Local\Temp\sms561F.tmp

Jump to dropped file

Source: C:\Users\user\Desktop\oaUNY8P657.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: oaUNY8P657.exe, 00000003.00000002.1580895297.000001F9C5F20000.00000004.00000020.00020000.00000000.sdmp, sms561F.tmp, 00000004.00000000.1298513996.00000000001E2000.00000002.00000001.01000000.00000004.sdmp, sms561F.tmp.3.dr	Binary or memory string: SBIEDLL.DLLEBCQPZPPECY2J0TKFUUETJZ0U2QVRLEC4GSEXHANNPFMT7RZB6LKTR1Y9THG1RIIFL8CYZEQLAGMIGK9ZQ0OHCPPV0389XHAQKGWHO66OEQUNXBGHG18JI1FABXSOB4MEHR15D2AOACREJWFYPZOTTFCKVSTJPJ3QEV00EG0RE7BBJFEQYMKXWCRLQHDUBPVYUVULQYFKJXS6NFTXAEZQ8Q5DJ5HY5WXDNIMBMKGGFUO1YF0GMTAYE5CNDKG9FU0EALQICNT404AQ89Q0EEBAGXGETDLDEXRFDDSYNX2O4UCUCWUYPXMPBN4YAJEKIWQ3AQXRCMFBZO7TOP8XF5T8PWZSTA68FE9LHA0OWVQPLF2BJ7RFARMJPMSBGGULCMN8E7QSBRF7T9N1S2EIPKYVFCICREW9O4JXI2ME4HNPSI3JZDQNIIMAL65C4LPDLAAMOA0AQCEZBM2N1UJ11IYNFCOPBGQASSIWEZ4WQC0PAINFO
Source: sms561F.tmp, 00000004.00000002.1578890311.000000000234C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Memory allocated: 21E0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp	Memory allocated: 1A340000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\oaUNY8P657.exe

API coverage: 9.0 %

Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: sms561F.tmp.3.dr	Binary or memory string: vmware
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: sms561F.tmp, 00000004.00000002.1579490182.000000001B1ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllo
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp

Code function: 4_2_00007FFAAC487B71 CheckRemoteDebuggerPresent,

4_2_00007FFAAC487B71

Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\oaUNY8P657.exe	Code function: 0_2_00007FF78CB21180 Sleep,Sleep,SetUnhandledExceptionFilter,_set_invalid_parameter_handler,malloc,strlen,malloc,memcpy,_initterm,	0_2_00007FF78CB21180
Source: C:\Users\user\Desktop\oaUNY8P657.exe	Code function: 0_2_00007FF78CB283AC SetUnhandledExceptionFilter,	0_2_00007FF78CB283AC
Source: C:\Users\user\Desktop\oaUNY8P657.exe	Code function: 0_2_00007FF78CB22E61 SetUnhandledExceptionFilter,	0_2_00007FF78CB22E61
Source: C:\Users\user\Desktop\oaUNY8P657.exe	Code function: 3_2_00007FF78CB283AC SetThreadContext,SetUnhandledExceptionFilter,WriteProcessMemory,__p__wenviron,	3_2_00007FF78CB283AC
Source: C:\Users\user\Desktop\oaUNY8P657.exe	Code function: 3_2_00007FF78CB283AC SetThreadContext,SetUnhandledExceptionFilter,WriteProcessMemory,__p__wenviron,	3_2_00007FF78CB283AC
Source: C:\Users\user\Desktop\oaUNY8P657.exe	Code function: 3_2_00007FF78CB283AC SetThreadContext,SetUnhandledExceptionFilter,WriteProcessMemory,__p__wenviron,	3_2_00007FF78CB283AC
Source: C:\Users\user\Desktop\oaUNY8P657.exe	Code function: 3_2_00007FF78CB22E61 SetUnhandledExceptionFilter,	3_2_00007FF78CB22E61
Source: C:\Users\user\Desktop\oaUNY8P657.exe	Code function: 3_2_00007FF78CB21180 Sleep,Sleep,SetUnhandledExceptionFilter,_set_invalid_parameter_handler,malloc,strlen,malloc,memcpy,_initterm,	3_2_00007FF78CB21180

Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\oaUNY8P657.exe

Code function: 0_2_00007FF78CB21522 GetConsoleWindow,GetConsoleWindow,ShowWindow,memset,memset,GetModuleFileNameA,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,SetThreadContext,ResumeThread,ResumeThread,WaitForSingleObject,

0_2_00007FF78CB21522

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\oaUNY8P657.exe

Memory written: C:\Users\user\Desktop\oaUNY8P657.exe base: 400000 value starts with: 4D5A

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\oaUNY8P657.exe

Thread register set: target process: 7456

Jump to behavior

Source: C:\Users\user\Desktop\oaUNY8P657.exe	Process created: C:\Users\user\Desktop\oaUNY8P657.exe "C:\Users\user\Desktop\oaUNY8P657.exe"			Jump to behavior
Source: C:\Users\user\Desktop\oaUNY8P657.exe	Process created: C:\Users\user\AppData\Local\Temp\sms561F.tmp "C:\Users\user~1\AppData\Local\Temp\sms561F.tmp"			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp

Queries volume information: C:\Users\user\AppData\Local\Temp\sms561F.tmp VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 4.0.sms561F.tmp.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1578890311.000000000234C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1580895297.000001F9C5F20000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.1298513996.00000000001E2000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oaUNY8P657.exe PID: 7456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sms561F.tmp PID: 7508, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\sms561F.tmp, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 4.0.sms561F.tmp.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1578890311.000000000234C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1580895297.000001F9C5F20000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.1298513996.00000000001E2000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oaUNY8P657.exe PID: 7456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sms561F.tmp PID: 7508, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\sms561F.tmp, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	3 Virtualization/Sandbox Evasion	OS Credential Dumping	431 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	3 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	1 System Network Configuration Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
oaUNY8P657.exe	50%	ReversingLabs	Win64.Spyware.AsyncRAT
oaUNY8P657.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\sms561F.tmp	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Local\Temp\sms561F.tmp	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\sms561F.tmp	79%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT

Source	Detection	Scanner	Label	Link
left-noon.gl.at.ply.gg	100%	Avira URL Cloud	malware
http://go.micu	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/line/?fields=hosting	false		high
left-noon.gl.at.ply.gg	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://i.ibb.co/Dwrj41N/Image.png	oaUNY8P657.exe, 00000003.00000002.1580895297.000001F9C5F20000.00000004.00000020.00020000.00000000.sdmp, sms561F.tmp, 00000004.00000000.1298513996.00000000001E2000.00000002.00000001.01000000.00000004.sdmp, sms561F.tmp.3.dr	false		high
http://upx.sf.net	Amcache.hve.8.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	sms561F.tmp, 00000004.00000002.1578890311.00000000023E8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://go.micu	sms561F.tmp, 00000004.00000002.1579490182.000000001B1ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com	sms561F.tmp, 00000004.00000002.1578890311.00000000023E8000.00000004.00000800.00020000.00000000.sdmp, sms561F.tmp, 00000004.00000002.1578890311.0000000002400000.00000004.00000800.00020000.00000000.sdmp, sms561F.tmp, 00000004.00000002.1578890311.00000000023F6000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557202
Start date and time:	2024-11-17 19:19:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	oaUNY8P657.exe renamed because original name is a hash value
Original Sample Name:	4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/6@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 4 Number of non-executed functions: 29
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: oaUNY8P657.exe

Simulations

Behavior and APIs

Time	Type	Description
14:59:16	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	IAdjMfB2A5.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	dkKMw0OlZ9.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	EternalPredictor.exe	Get hash	malicious	Blank Grabber, Skuld Stealer, XWorm	Browse	ip-api.com/json/?fields=225545
	program.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	skuld.exe	Get hash	malicious	Skuld Stealer	Browse	ip-api.com/line/?fields=hosting
	SolaraBostrappers.exe	Get hash	malicious	DCRat	Browse	ip-api.com/line/?fields=hosting
	svhost.exe	Get hash	malicious	DCRat	Browse	ip-api.com/line/?fields=hosting
	Midnight.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	exe030.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	GRAINS.vbs	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	IAdjMfB2A5.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	dkKMw0OlZ9.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	EternalPredictor.exe	Get hash	malicious	Blank Grabber, Skuld Stealer, XWorm	Browse	208.95.112.1
	program.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	skuld.exe	Get hash	malicious	Skuld Stealer	Browse	208.95.112.1
	SolaraBostrappers.exe	Get hash	malicious	DCRat	Browse	208.95.112.1
	svhost.exe	Get hash	malicious	DCRat	Browse	208.95.112.1
	Midnight.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	exe030.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	GRAINS.vbs	Get hash	malicious	AgentTesla	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TUT-ASUS	IAdjMfB2A5.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	dkKMw0OlZ9.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	EternalPredictor.exe	Get hash	malicious	Blank Grabber, Skuld Stealer, XWorm	Browse	208.95.112.1
	program.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	skuld.exe	Get hash	malicious	Skuld Stealer	Browse	208.95.112.1
	SolaraBostrappers.exe	Get hash	malicious	DCRat	Browse	208.95.112.1
	svhost.exe	Get hash	malicious	DCRat	Browse	208.95.112.1
	Midnight.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	exe030.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	GRAINS.vbs	Get hash	malicious	AgentTesla	Browse	208.95.112.1

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_sms561F.tmp_942c3da8370deac9a4ef501abf272bdc1219b_47ac16bd_5ad1f071-b479-4c6d-8e86-ee4719fcda92\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.208255629454617
Encrypted:	false
SSDEEP:	192:7qJ987OrF0NxMP5iaWz8iyUp2lxPzuiFXZ24lO890:Wj87OaNxMQa48iMxPzuiFXY4lO8m
MD5:	840D528E630F741A185B5F765E83E859
SHA1:	43B0B974C070EB73AFEE6A8749D0C336667DD2ED
SHA-256:	916B2819E65C966CA0C6B307FD623A5CD746041F27FA7879CBCE81E74BBC226F
SHA-512:	C3D913048BC81D76B170B1497E7C43C812556E91A8C5F66E58C33F9F15266A9980F048E8B5A45D52D1ADE8AEF1786D0FE35DD6ED3C435D350582601159C62C2B
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.6.3.4.1.2.1.4.6.9.4.8.3.7.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.6.3.4.1.2.1.7.3.9.7.9.5.3.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.a.d.1.f.0.7.1.-.b.4.7.9.-.4.c.6.d.-.8.e.8.6.-.e.e.4.7.1.9.f.c.d.a.9.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.e.0.8.3.d.f.3.-.1.a.e.8.-.4.d.1.6.-.a.a.f.3.-.9.4.a.8.7.6.6.c.c.1.3.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.s.m.s.5.6.1.F...t.m.p.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.W.i.z.C.l.i.e.n.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.5.4.-.0.0.0.1.-.0.0.1.4.-.0.4.4.6.-.6.f.5.4.1.d.3.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.0.7.b.1.3.3.8.4.2.3.3.f.7.0.1.7.8.1.c.2.7.1.4.1.1.d.e.4.3.5.2.0.0.0.0.0.0.0.0.!.0.0.0.0.d.6.a.9.6.c.5.2.8.7.f.1.d.7.6.b.4.1.f.6.0.5.e.c.a.e.b.1.6.8.8.d.2.0.8.c.7.2.0.a.!.s.m.s.5.6.1.F...t.m.p.....

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7417.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Sun Nov 17 18:20:16 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	439559
Entropy (8bit):	3.113725737405662
Encrypted:	false
SSDEEP:	3072:GQjpebF78/Vz+nt1CCqkrLVy3+vBmXRIc4XIUAcSCPMfHP:5jpebaKlqWy3Q2X7Civ
MD5:	67CD203A9D1706F9596D3F132E86E135
SHA1:	BACF422D8F517CDA55650094726CC06625E6AE89
SHA-256:	88D4AE14F3574731DD666E19E0EC90570DF064804484B8AB54BD5C0293752AA8
SHA-512:	740396855CC7E86E93691969D33ED04DFF0DB273668D4B960899251DB7A3AFDED79DF3E939B829E787C0579B330F173B4FA461A290E104315F86AFE303611B0C
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........3:g........................d...........<...((......0...d(.......7..j...........l.......8...........T............@..Gt...........6...........8..............................................................................eJ.......9......Lw......................T.......T....3:g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B9A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8702
Entropy (8bit):	3.697640471585611
Encrypted:	false
SSDEEP:	192:R6l7wVeJTtIek46Y5GjgmfZJCopDp89b82EfkP0m:R6lXJZV6Y4jgmfXCT8NfkJ
MD5:	ACADD6BFC16175EE8E699D942B5D0CB7
SHA1:	1F86D0524742038BEDC88C9D458C06794BF93AF2
SHA-256:	DCA57623517AF0023B6235FC13C40DFE19CAB85989D30D97CA72196A1BB78500
SHA-512:	F57F65DB67472E4BCB5E6B3F73CA6EE36A60020988E13C9C66E24BD2179052BE33F881DBC33A02F4F3B5D6F38366B2AF2E33C3AB98E2149D37FBDAF25E42B61B
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7C08.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4745
Entropy (8bit):	4.427180456738418
Encrypted:	false
SSDEEP:	48:cvIwWl8zseNJg771I9DoWpW8VYaYm8M4JGLPF/Byq8v8LcVf9Rod:uIjfenI7YB7VmJwBWbVlRod
MD5:	F65BC5E8EA48A17D6D2ECB6CE6ED5E4B
SHA1:	0E0BCFA76397D75DE210781B54B4AD8368EBD004
SHA-256:	619FE8D3D680D2D179FBA51A7FF5FDF0FC5726B17F9F2E135619B78A877C312F
SHA-512:	733ADF962E94DFC6A50BD80808A28DB965EA9C0EEB25FC19E6781B85B1B91F1698E863FFFD36410670234830960CA614EAD157B4B23E4964207A4494064B0AE5
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="592402" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Temp\sms561F.tmp

Download File

Process:	C:\Users\user\Desktop\oaUNY8P657.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	79392
Entropy (8bit):	5.983605297716181
Encrypted:	false
SSDEEP:	1536:x5sFO8g/9VM5dQ+aomobhr3KXg6wzOB1SmOnU7Ua+GJ:x5sU9Vv4bbhr6SOB1S5nU7MGJ
MD5:	8032A5E68376A879472C297749CDB4C4
SHA1:	D6A96C5287F1D76B41F605ECAEB1688D208C720A
SHA-256:	FA3DD88248218CD597232333C70E0996801817B003C234994102452712A23D1D
SHA-512:	B75D6429844E643FC7920EFE1D30B15B0E631DED561F5F0021E105A68A729EBF308A23501C9136EFBF4637BB068DBA5C0056FF85195CD54D56E05205193D6C21
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3.:g.................,...........K... ...`....@.. ....................................@.................................PK..K....`............................................................................... ............... ..H............text....+... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B.................K......H.......Hj..........&.....................................................(.....r...p. .(T...(.....r#..p. ^....s.........s.........s.........s..........ri..p. .t...r...p. 7V...r...p. M.)..r;..p. .....r...p. F.....((....r;..p.r...p. S....(+...-.(,...,.+.(-...,.+.(...,.+.()...,..(S..."(....+.&(....&+..+5se... .... .'..of...(,...~....-.([...(Q...~....og...&.-..r...p.r...p. ....rc..p. .a...r...p. .O...r...p. ....r5..p.r{..p. .x...r...p*. '.

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.413963638087642
Encrypted:	false
SSDEEP:	6144:s/cifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNb5+:ji58oSWIZBk2MM6AFBZo
MD5:	60CECA282EC578206682FEAC46CF61C9
SHA1:	BC604B0165A37E11C0AD419DBDF617895D2B1F5C
SHA-256:	DD9FEC21C1952BC91AD3EB71D064121141ECF1E50942BEECCBC68BF78FD298D2
SHA-512:	42AA3A934DB8018203EF14FB9936EF316B266FF41E5599D81A8FE7D8512B78A3F0CB2B8960E255FCDD6887B06925E4F49DA709FDAA7521D7431FFD717E6AD3A5
Malicious:	false
Reputation:	low
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..X.9...............................................................................................................................................................................................................................................................................................................................................,.l........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	7.5978739911000535
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	oaUNY8P657.exe
File size:	118'784 bytes
MD5:	4f0c8a81138b78a1f40ef1d383632130
SHA1:	96b6c6ff5c5b1aa90014e975bb851d23acbed598
SHA256:	4560c263255a3f4682b69a3e989591ee4b4df60a8a7680a3905c0c7b33a83d42
SHA512:	687dddf2a070acbb5eee3af912dc1461968a67b05992f76f5a77a5bb0d773ae1049c7e44386c4a44d5971ace7784a8601c2fc3f47f1f8dbbb06a7e04646bbf1c
SSDEEP:	3072:oziOToQz31V4b1pCoLd7H7dwsIc6rmGBLYdLrfncO:+ToQzFjox7bCs5WmGVYVrfn
TLSH:	65C3D04A2D6A04C4CED5617857FA0BFE9E98BC13514311D8F523F23E3CAA879163E8D9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....<.e.d........&....'. .....................@.....................................3....`... ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x1400013f0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x65E93C0D [Thu Mar 7 04:01:17 2024 UTC]
TLS Callbacks:	0x40001aa0, 0x1, 0x40001a70, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2c09257c32ec1acab9920857c33802f6

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00003025h]
mov dword ptr [eax], 00000000h
call 00007FB1D105C09Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007FB1D105DAACh
dec eax
cmp eax, 01h
sbb eax, eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007FB1D105C2F9h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 40h
mov dword ptr [ebp+10h], ecx
dec eax
mov dword ptr [ebp+18h], edx
dec esp
mov dword ptr [ebp+20h], eax
mov ecx, 00000000h
dec eax
mov eax, dword ptr [00006EFDh]
call eax
dec eax
mov dword ptr [ebp-10h], eax
mov eax, dword ptr [ebp+10h]
movzx eax, ax
dec eax
mov ecx, eax
dec eax
mov edx, dword ptr [ebp+18h]
dec eax
mov eax, dword ptr [ebp-10h]
dec ecx
mov eax, edx
dec eax
mov edx, ecx
dec eax
mov ecx, eax
dec eax
mov eax, dword ptr [00006EB6h]
call eax
dec eax
mov dword ptr [ebp-18h], eax
dec eax
cmp dword ptr [ebp-18h], 00000000h
je 00007FB1D105C363h
dec eax
mov edx, dword ptr [ebp-18h]
dec eax
mov eax, dword ptr [ebp-10h]
dec eax
mov ecx, eax
dec eax
mov eax, dword ptr [00006ED7h]
call eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8000	0xc20	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb000	0x16a60	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x5000	0x27c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x22000	0x94	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4040	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8334	0x258	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1f38	0x2000	1643ab42acf57e13dea4cbe169d06d01	False	0.5467529296875	data	5.824830734340256	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x3000	0x100	0x200	0459eb45fdb9d8230163eac79b54aa22	False	0.19140625	data	1.4335270846780457	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x4000	0x590	0x600	8a88c6b726508e4de2f869e693a5a424	False	0.40625	data	4.074743957350813	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x5000	0x27c	0x400	8b192a1e8cff752787e94d1477ed0517	False	0.3564453125	data	2.7177913023306925	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x6000	0x1f4	0x200	6d358da226cb542ba6972623ecde707e	False	0.44140625	data	3.744470074855023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x7000	0x180	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8000	0xc20	0xe00	cf218a30062bcd2c9b5a6425174f9132	False	0.29910714285714285	data	3.7272213911388645	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x9000	0x60	0x200	63601c0161d088a32e208b68ab6ede7a	False	0.068359375	data	0.28655982431271465	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xa000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xb000	0x16a60	0x16c00	d4899949f12afd5602bfff3e53bba68f	False	0.8925137362637363	data	7.900720282264327	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x22000	0x94	0x200	55fe3e1e99784323308774e94d85f25b	False	0.2734375	data	1.7555367709711391	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/4	0x23000	0x50	0x200	ecc0436b66fbbb18e229c28047e9129e	False	0.07421875	data	0.23653878450968063	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/19	0x24000	0xfdd	0x1000	60a9579b0c2e2805bac51be7f2edc5e2	False	0.389892578125	Matlab v4 mat-file (little endian) @\001, rows 134283269, columns 0, imaginary	5.248819951176151	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/31	0x25000	0xaf	0x200	3926a4e9348a2d2f293d468143da249a	False	0.296875	data	2.128627013155538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/45	0x26000	0xa4	0x200	21da29633c5b054cff7bcd24e93edc7c	False	0.220703125	data	1.4891978798794558	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/57	0x27000	0x48	0x200	96127bf9b4a0503da8f97ccbc9448e2c	False	0.12109375	data	0.7016131348005825	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/70	0x28000	0xa3	0x200	8afdeafeeabf207c1cec78b6604a3502	False	0.27734375	data	2.4765286669598585	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/81	0x29000	0x1f8	0x200	83a4eb6d7602d34e40cc6d08d1fcfbf9	False	0.33203125	data	4.863091898681111	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
BIN	0xb060	0x16a00	data			0.8966893991712708

Imports

DLL	Import
KERNEL32.dll	CreateProcessA, DeleteCriticalSection, EnterCriticalSection, FindResourceA, GetConsoleWindow, GetLastError, GetModuleFileNameA, GetModuleHandleA, GetThreadContext, InitializeCriticalSection, LeaveCriticalSection, LoadResource, LockResource, ResumeThread, SetThreadContext, SetUnhandledExceptionFilter, SizeofResource, Sleep, TlsGetValue, VirtualAlloc, VirtualAllocEx, VirtualProtect, VirtualQuery, WaitForSingleObject, WriteProcessMemory
api-ms-win-crt-environment-l1-1-0.dll	__p__environ, __p__wenviron
api-ms-win-crt-heap-l1-1-0.dll	_set_new_mode, calloc, free, malloc
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-private-l1-1-0.dll	__C_specific_handler, memcpy
api-ms-win-crt-runtime-l1-1-0.dll	__p___argc, __p___argv, __p___wargv, _cexit, _configure_narrow_argv, _configure_wide_argv, _crt_at_quick_exit, _crt_atexit, _exit, _initialize_narrow_environment, _initialize_wide_environment, _initterm, _set_app_type, _set_invalid_parameter_handler, abort, exit, signal
api-ms-win-crt-stdio-l1-1-0.dll	__acrt_iob_func, __p__commode, __p__fmode, __stdio_common_vfprintf, __stdio_common_vfwprintf, fwrite
api-ms-win-crt-string-l1-1-0.dll	memset, strlen, strncmp
api-ms-win-crt-time-l1-1-0.dll	__daylight, __timezone, __tzname, _tzset
USER32.dll	ShowWindow

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 17, 2024 19:20:13.452867031 CET	49699	80	192.168.2.7	208.95.112.1
Nov 17, 2024 19:20:13.459054947 CET	80	49699	208.95.112.1	192.168.2.7
Nov 17, 2024 19:20:13.459198952 CET	49699	80	192.168.2.7	208.95.112.1
Nov 17, 2024 19:20:13.466835976 CET	49699	80	192.168.2.7	208.95.112.1
Nov 17, 2024 19:20:13.471844912 CET	80	49699	208.95.112.1	192.168.2.7
Nov 17, 2024 19:20:14.092298985 CET	80	49699	208.95.112.1	192.168.2.7
Nov 17, 2024 19:20:14.133857965 CET	49699	80	192.168.2.7	208.95.112.1
Nov 17, 2024 19:20:36.498614073 CET	49699	80	192.168.2.7	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 17, 2024 19:20:13.432075977 CET	52948	53	192.168.2.7	1.1.1.1
Nov 17, 2024 19:20:13.438996077 CET	53	52948	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 17, 2024 19:20:13.432075977 CET	192.168.2.7	1.1.1.1	0xe30a	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 17, 2024 19:20:13.438996077 CET	1.1.1.1	192.168.2.7	0xe30a	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	208.95.112.1	80	7508	C:\Users\user\AppData\Local\Temp\sms561F.tmp

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 19:20:13.466835976 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Nov 17, 2024 19:20:14.092298985 CET	174	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 18:20:13 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

Target ID:	0
Start time:	13:20:06
Start date:	17/11/2024
Path:	C:\Users\user\Desktop\oaUNY8P657.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\oaUNY8P657.exe"
Imagebase:	0x7ff78cb20000
File size:	118'784 bytes
MD5 hash:	4F0C8A81138B78A1F40EF1D383632130
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:20:06
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:20:06
Start date:	17/11/2024
Path:	C:\Users\user\Desktop\oaUNY8P657.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\oaUNY8P657.exe"
Imagebase:	0x7ff78cb20000
File size:	118'784 bytes
MD5 hash:	4F0C8A81138B78A1F40EF1D383632130
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000002.1580895297.000001F9C5F20000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000003.00000002.1580895297.000001F9C5F20000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:20:07
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\sms561F.tmp
Wow64 process (32bit):	false
Commandline:	"C:\Users\user~1\AppData\Local\Temp\sms561F.tmp"
Imagebase:	0x1e0000
File size:	79'392 bytes
MD5 hash:	8032A5E68376A879472C297749CDB4C4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000004.00000002.1578890311.000000000234C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000004.00000000.1298513996.00000000001E2000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000004.00000000.1298513996.00000000001E2000.00000002.00000001.01000000.00000004.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\sms561F.tmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:20:13
Start date:	17/11/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7508 -s 1664
Imagebase:	0xc00000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21.5%
Total number of Nodes:	191
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF78CB21522 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 231
injectionmemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 00007FF78CB21545
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF78CB21670
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF78CB2168A
CreateProcessA.KERNELBASE ref: 00007FF78CB21703
VirtualAlloc.KERNELBASE ref: 00007FF78CB2172F
VirtualAllocEx.KERNELBASE ref: 00007FF78CB217A9
WriteProcessMemory.KERNELBASE ref: 00007FF78CB217ED
WriteProcessMemory.KERNELBASE ref: 00007FF78CB2189A
WriteProcessMemory.KERNELBASE ref: 00007FF78CB218E2
SetThreadContext.KERNELBASE ref: 00007FF78CB21943
ResumeThread.KERNELBASE ref: 00007FF78CB21956

Strings

@, xrefs: 00007FF78CB2178E
BIN, xrefs: 00007FF78CB21562

Memory Dump Source

Source File: 00000000.00000002.1298168844.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000000.00000002.1298149173.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298186368.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298204824.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298225752.00007FF78CB28000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: Process$MemoryWrite$AllocThreadVirtualmemset$ConsoleContextCreateResumeWindow
String ID: @$BIN
API String ID: 3291313312-1916819016
Opcode ID: 1a268847dd2997d4c8cab54aa74c89ad69d0630918c7081ed8d1475344bec58a
Instruction ID: 83b161c53b02419e5038aa1079d24fae1c77d8f05e164cc33302cf12c842c9ce
Opcode Fuzzy Hash: 1a268847dd2997d4c8cab54aa74c89ad69d0630918c7081ed8d1475344bec58a
Instruction Fuzzy Hash: 0FB117A2714BC48ADBB08F26D8803DA77A1F748B88F508029DF4C8BB68DF39D605C714

Function 00007FF78CB21180 Relevance: 12.1, APIs: 8, Instructions: 146
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF78CB21406), ref: 00007FF78CB211BE
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF78CB2122F
_set_invalid_parameter_handler.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF78CB21406), ref: 00007FF78CB21246
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF78CB21406), ref: 00007FF78CB21263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF78CB21406), ref: 00007FF78CB21285
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF78CB21406), ref: 00007FF78CB21291
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF78CB21406), ref: 00007FF78CB212A9

Memory Dump Source

Source File: 00000000.00000002.1298168844.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000000.00000002.1298149173.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298186368.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298204824.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298225752.00007FF78CB28000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_set_invalid_parameter_handlermemcpystrlen
String ID:
API String ID: 959198572-0
Opcode ID: 32f55c20c8e17e7084bc6d5cf4eebd07ec7162706a3819bd0cdbd2e2e0d47b08
Instruction ID: 4a91912fea109d049a8d3ef948205f94803b55fee2d7d243ea572e9e592da219
Opcode Fuzzy Hash: 32f55c20c8e17e7084bc6d5cf4eebd07ec7162706a3819bd0cdbd2e2e0d47b08
Instruction Fuzzy Hash: 77516936E09EA281F710BB55E85067AEAA6BF48B90FE44431DD1C97795CE3CE841C720

Non-executed Functions

Function 00007FF78CB221D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

signal.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF78CB22252

Strings

CCG , xrefs: 00007FF78CB221F5

Memory Dump Source

Source File: 00000000.00000002.1298168844.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000000.00000002.1298149173.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298186368.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298204824.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298225752.00007FF78CB28000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: bee6fa8d8bd77e57e6f40c5e4f9f5187d2327c2bcb5a54c27fe908d04117a730
Instruction ID: f708a1949a43a31d5fe9f006731ee8b15127ce2098fe44342e630e2a9d9e6fc7
Opcode Fuzzy Hash: bee6fa8d8bd77e57e6f40c5e4f9f5187d2327c2bcb5a54c27fe908d04117a730
Instruction Fuzzy Hash: 1D21ED61E0CDA606FE6872E58440379AA81BF59770FB84536DA3DC33D5CD1EA881C233

Function 00007FF78CB283AC Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1298225752.00007FF78CB28000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000000.00000002.1298149173.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298168844.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298186368.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298204824.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2871c3786c38ff363ceeed3cfb9e998bcd6ec10323208de28fe13ff7350e4d1
Instruction ID: e1ae221f0c2752a24e89d6a7ee624bb666ae510db666be03311407bcf6a1dacd
Opcode Fuzzy Hash: b2871c3786c38ff363ceeed3cfb9e998bcd6ec10323208de28fe13ff7350e4d1
Instruction Fuzzy Hash: FE21EA9794EBE10BE3535A744C2506A7FA0A792D017AEC0BBD3C4836C7D81E6804C762

Function 00007FF78CB21450 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1298168844.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000000.00000002.1298149173.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298186368.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298204824.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298225752.00007FF78CB28000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94089167d9ddb5ab5d94316dab6deeefcb531f2561a945b9df9eaae1c64a4e99
Instruction ID: d13db904731a4155a8825bbfe78f1f2d766f6b3d8611c10ac769e836d3799f70
Opcode Fuzzy Hash: 94089167d9ddb5ab5d94316dab6deeefcb531f2561a945b9df9eaae1c64a4e99
Instruction Fuzzy Hash: EA21E5A2A04B5489EB40DFAAE8403AD2BB0B708B88F544435DE1D97B68DF38D950C760

Function 00007FF78CB22E61 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1298168844.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000000.00000002.1298149173.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298186368.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298204824.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298225752.00007FF78CB28000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36e89ffcd8262b68474e0e70ab5d93c5cfaddc58954e68d11aeb22d1cac9f659
Instruction ID: 64902a408a254730c418c078304824673c18d4a77f2ff1c9c51a9f6f7345a52c
Opcode Fuzzy Hash: 36e89ffcd8262b68474e0e70ab5d93c5cfaddc58954e68d11aeb22d1cac9f659
Instruction Fuzzy Hash: 51A0021384DC5189F2001B00DC121B3956DF706246F546030902851491C92DD0418925

Function 00007FF78CB21C50 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,00000000,00007FF78CB21E21,?,?,?,?,?,?,00007FF78CB24588,00000000,?), ref: 00007FF78CB21CA0
VirtualQuery.KERNEL32 ref: 00007FF78CB21D6B

Strings

Mingw-w64 runtime failure:, xrefs: 00007FF78CB21C87
Address %p has no image-section, xrefs: 00007FF78CB21CC2, 00007FF78CB21E12
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF78CB21DFE
VirtualProtect failed with code 0x%x, xrefs: 00007FF78CB21DDE

Memory Dump Source

Source File: 00000000.00000002.1298168844.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000000.00000002.1298149173.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298186368.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298204824.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298225752.00007FF78CB28000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: QueryVirtual__acrt_iob_func
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 4109086920-1534286854
Opcode ID: 113019b010cfdea372466ba8fa872585d3c6fd2c84baa86eb644bb16eb746e1d
Instruction ID: ff3716b0fe8d5be1a6bb08e7e731458547dccb9a6e70b6cd0d7a490e5b0c20bd
Opcode Fuzzy Hash: 113019b010cfdea372466ba8fa872585d3c6fd2c84baa86eb644bb16eb746e1d
Instruction Fuzzy Hash: 1151B232A08EA681EA10AF51E8406AAFF61FF88BE4FE44135DE4C57394DE3CE955C710

Function 00007FF78CB21E30 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 227
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(00007FF78CB27040,00007FF78CB27048,00000001,?,?,?,?,00007FFB2B31ADA0,00007FF78CB21228,?,?,?,00007FF78CB21406), ref: 00007FF78CB2202D

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF78CB22176
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF78CB22094
Unknown pseudo relocation protocol version %d., xrefs: 00007FF78CB22182

Memory Dump Source

Source File: 00000000.00000002.1298168844.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000000.00000002.1298149173.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298186368.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298204824.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298225752.00007FF78CB28000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 544645111-1286557213
Opcode ID: 5b7a8940f0fc2f72f6df61a936c333ae77e306589e620a94ed3973a55f756175
Instruction ID: 0a21b36cf9d2c26a679dc60d7c226859b511e6a4ad9cce14ed10b26393f81795
Opcode Fuzzy Hash: 5b7a8940f0fc2f72f6df61a936c333ae77e306589e620a94ed3973a55f756175
Instruction Fuzzy Hash: 6691B221E09DE281EA20BB65D80067AEA51BF50B74FA48231DE3C577D8DE3CEC01C621

Function 00007FF78CB21B40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF78CB21B98

Strings

Unknown error, xrefs: 00007FF78CB21C2C
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78CB21BB9

Memory Dump Source

Source File: 00000000.00000002.1298168844.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000000.00000002.1298149173.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298186368.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298204824.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298225752.00007FF78CB28000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: __acrt_iob_func
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 711238415-3474627141
Opcode ID: ec1d69525b6318d8d8343cc1e8a892cdd36d554898d484f33c722af1ba2e46a4
Instruction ID: 44f23e910d339e99c2b28e2139d0dc3750215f4da971c289a08eba3e6c337eaf
Opcode Fuzzy Hash: ec1d69525b6318d8d8343cc1e8a892cdd36d554898d484f33c722af1ba2e46a4
Instruction Fuzzy Hash: 1501C862908ED8C2D6169F1CE8011FAB774FFA975AF645321EB8C26620DF29D543C700

Function 00007FF78CB21BE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF78CB21B98

Part of subcall function 00007FF78CB22A70: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,00007FF78CB22C03,?,?,00007FF78CB27040,00007FF78CB21341), ref: 00007FF78CB22A98

Strings

Argument domain error (DOMAIN), xrefs: 00007FF78CB21BE0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78CB21BB9

Memory Dump Source

Source File: 00000000.00000002.1298168844.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000000.00000002.1298149173.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298186368.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298204824.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298225752.00007FF78CB28000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 2168557111-2713391170
Opcode ID: 275f23618c2c71a317faf6ece10275cdf799d050ef905744da1420987ee42d9f
Instruction ID: 5b91ca78ffc2b901313be918a5cc18d6896f57fd8f62e85a12595744ea4d5927
Opcode Fuzzy Hash: 275f23618c2c71a317faf6ece10275cdf799d050ef905744da1420987ee42d9f
Instruction Fuzzy Hash: E5F06213808E9482D2129F18A8001BBB774FF5E799FA55326EB8D26565DF2CD643C710

Function 00007FF78CB21BF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF78CB21B98

Part of subcall function 00007FF78CB22A70: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,00007FF78CB22C03,?,?,00007FF78CB27040,00007FF78CB21341), ref: 00007FF78CB22A98

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78CB21BB9
Partial loss of significance (PLOSS), xrefs: 00007FF78CB21BF0

Memory Dump Source

Source File: 00000000.00000002.1298168844.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000000.00000002.1298149173.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298186368.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298204824.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298225752.00007FF78CB28000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 2168557111-4283191376
Opcode ID: 1e6cd7a9a68ac3fafb46bace25494c5a3b24ec7900b807ee99d48c331c04c5e1
Instruction ID: 64e63e800f1247fcb4e961c8e923794a11b1fec15b7733fe74fcdd8a2f52ba91
Opcode Fuzzy Hash: 1e6cd7a9a68ac3fafb46bace25494c5a3b24ec7900b807ee99d48c331c04c5e1
Instruction Fuzzy Hash: BDF06213908E9482D2129F18A8001BBB774FF5E799FA55326EF8D26565DF2CD643C710

Function 00007FF78CB21C00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF78CB21B98

Part of subcall function 00007FF78CB22A70: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,00007FF78CB22C03,?,?,00007FF78CB27040,00007FF78CB21341), ref: 00007FF78CB22A98

Strings

Overflow range error (OVERFLOW), xrefs: 00007FF78CB21C00
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78CB21BB9

Memory Dump Source

Source File: 00000000.00000002.1298168844.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000000.00000002.1298149173.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298186368.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298204824.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298225752.00007FF78CB28000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 2168557111-4064033741
Opcode ID: 18d51c6244cb12bc5dd4f04bc353c537416c76c0457ae9358e107e74a2576210
Instruction ID: 494a6e32aed9c5ee5f0865d97229b414683dccaea898b96aca9a5b85cdab806e
Opcode Fuzzy Hash: 18d51c6244cb12bc5dd4f04bc353c537416c76c0457ae9358e107e74a2576210
Instruction Fuzzy Hash: 6DF0C213808E9482D2029F18A8000BBB770FF5E799FA45326EB8D26424DF2CD643C710

Function 00007FF78CB21C10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF78CB21B98

Part of subcall function 00007FF78CB22A70: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,00007FF78CB22C03,?,?,00007FF78CB27040,00007FF78CB21341), ref: 00007FF78CB22A98

Strings

The result is too small to be represented (UNDERFLOW), xrefs: 00007FF78CB21C10
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78CB21BB9

Memory Dump Source

Source File: 00000000.00000002.1298168844.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000000.00000002.1298149173.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298186368.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298204824.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298225752.00007FF78CB28000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 2168557111-2187435201
Opcode ID: 4965a13a53480363231e51f40e8bd960487f6ca1a47a5ae8a120c30841ef4640
Instruction ID: de25ed8f7e6b5784b0ad41b5b69ff7d825deabdf6a27835290b3d9cb8fcd6e09
Opcode Fuzzy Hash: 4965a13a53480363231e51f40e8bd960487f6ca1a47a5ae8a120c30841ef4640
Instruction Fuzzy Hash: 16F06213818E9482D2129F18A8000BBB770FF5E799FA55326EB8D2A565DF2CD643D710

Function 00007FF78CB21C20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF78CB21B98

Part of subcall function 00007FF78CB22A70: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,00007FF78CB22C03,?,?,00007FF78CB27040,00007FF78CB21341), ref: 00007FF78CB22A98

Strings

Total loss of significance (TLOSS), xrefs: 00007FF78CB21C20
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78CB21BB9

Memory Dump Source

Source File: 00000000.00000002.1298168844.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000000.00000002.1298149173.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298186368.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298204824.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298225752.00007FF78CB28000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 2168557111-4273532761
Opcode ID: dd1109fef1e44e27e33944e548427619ad9362c31daffd96fe08d1df9979e15b
Instruction ID: db9c45bc4cc79fec864f17b37c45d1727cca9243e8f1b2dc42d916e4d6791d9d
Opcode Fuzzy Hash: dd1109fef1e44e27e33944e548427619ad9362c31daffd96fe08d1df9979e15b
Instruction Fuzzy Hash: 22F06213808E9482D2129F18A8000BBB770FF5E799FA55326EF8D26525DF2CD643D710

Function 00007FF78CB21B78 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF78CB21B98

Part of subcall function 00007FF78CB22A70: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,00007FF78CB22C03,?,?,00007FF78CB27040,00007FF78CB21341), ref: 00007FF78CB22A98

Strings

Argument singularity (SIGN), xrefs: 00007FF78CB21B78
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78CB21BB9

Memory Dump Source

Source File: 00000000.00000002.1298168844.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000000.00000002.1298149173.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298186368.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298204824.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298225752.00007FF78CB28000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298243874.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 2168557111-2468659920
Opcode ID: 5c60b4d3e583521b1503455a1772254fd0060640fb2af6a87a6682de9bd8815d
Instruction ID: c4a7ee88cd244ea56a9d8633b08ba0442ec2185b3a048651e0fa647e7945d326
Opcode Fuzzy Hash: 5c60b4d3e583521b1503455a1772254fd0060640fb2af6a87a6682de9bd8815d
Instruction Fuzzy Hash: 0DF03623918ED482D2129F28A8001ABB774FF5E799F655326EF8D3A525DF28D583C710

Analysis Process: oaUNY8P657.exePID: 7456, Parent PID: 7400COMMON

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	0.5%
Signature Coverage:	0%
Total number of Nodes:	204
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 004011B1 Relevance: 31.9, APIs: 6, Strings: 12, Instructions: 377
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempFileNameW.KERNELBASE ref: 004013C8
CreateFileW.KERNELBASE ref: 00401434

Strings

kernel32.dll, xrefs: 004011C1
Failed to allocate memory for decryptedData, xrefs: 004012E3
WriteFile, xrefs: 0040123F
CreateFileW, xrefs: 0040121F
ResumeThread, xrefs: 0040125F
smss, xrefs: 004013AA
GetTempPathW, xrefs: 004011DF
CloseHandle, xrefs: 0040129F
CreateProcessW, xrefs: 00401637
GetTempFileNameW, xrefs: 004011FF
WaitForSingleObject, xrefs: 0040127F
tzgkZozTzU99DscsphE8S5tViNDFltAHUsQ1hpsZSSNMtssOrVAO1wHHImV5iu7k, xrefs: 0040130B

Memory Dump Source

Source File: 00000003.00000002.1580609473.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_oaUNY8P657.jbxd

Similarity

API ID: File$CreateNameTemp
String ID: CloseHandle$CreateFileW$CreateProcessW$Failed to allocate memory for decryptedData$GetTempFileNameW$GetTempPathW$ResumeThread$WaitForSingleObject$WriteFile$kernel32.dll$smss$tzgkZozTzU99DscsphE8S5tViNDFltAHUsQ1hpsZSSNMtssOrVAO1wHHImV5iu7k
API String ID: 3817792521-1963680545
Opcode ID: 8b2f88680915b736bfc22a386e4c78384dd67c8fcd555f67793947a398c48ee7
Instruction ID: eabd43d7fcba3a17b02aeddb521bde4c856c53977638f60150cda4c28548f716
Opcode Fuzzy Hash: 8b2f88680915b736bfc22a386e4c78384dd67c8fcd555f67793947a398c48ee7
Instruction Fuzzy Hash: 0AE16E71705A1089EB509B6ACC4039923B4B708BE8F504677EE5DA77E4EB7CCA81D709

Non-executed Functions

Function 00007FF78CB21180 Relevance: 12.1, APIs: 8, Instructions: 146
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF78CB21406), ref: 00007FF78CB211BE
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF78CB2122F
_set_invalid_parameter_handler.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF78CB21406), ref: 00007FF78CB21246
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF78CB21406), ref: 00007FF78CB21263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF78CB21406), ref: 00007FF78CB21285
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF78CB21406), ref: 00007FF78CB21291
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF78CB21406), ref: 00007FF78CB212A9

Memory Dump Source

Source File: 00000003.00000002.1580956009.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000003.00000002.1580925542.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1580985212.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581010156.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581038589.00007FF78CB28000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_set_invalid_parameter_handlermemcpystrlen
String ID:
API String ID: 959198572-0
Opcode ID: 32f55c20c8e17e7084bc6d5cf4eebd07ec7162706a3819bd0cdbd2e2e0d47b08
Instruction ID: 4a91912fea109d049a8d3ef948205f94803b55fee2d7d243ea572e9e592da219
Opcode Fuzzy Hash: 32f55c20c8e17e7084bc6d5cf4eebd07ec7162706a3819bd0cdbd2e2e0d47b08
Instruction Fuzzy Hash: 77516936E09EA281F710BB55E85067AEAA6BF48B90FE44431DD1C97795CE3CE841C720

Function 00007FF78CB221D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

signal.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF78CB22252

Strings

CCG , xrefs: 00007FF78CB221F5

Memory Dump Source

Source File: 00000003.00000002.1580956009.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000003.00000002.1580925542.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1580985212.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581010156.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581038589.00007FF78CB28000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: bee6fa8d8bd77e57e6f40c5e4f9f5187d2327c2bcb5a54c27fe908d04117a730
Instruction ID: f708a1949a43a31d5fe9f006731ee8b15127ce2098fe44342e630e2a9d9e6fc7
Opcode Fuzzy Hash: bee6fa8d8bd77e57e6f40c5e4f9f5187d2327c2bcb5a54c27fe908d04117a730
Instruction Fuzzy Hash: 1D21ED61E0CDA606FE6872E58440379AA81BF59770FB84536DA3DC33D5CD1EA881C233

Function 00007FF78CB21522 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF78CB21670
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF78CB2168A

Strings

BIN, xrefs: 00007FF78CB21562
@, xrefs: 00007FF78CB2178E

Memory Dump Source

Source File: 00000003.00000002.1580956009.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000003.00000002.1580925542.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1580985212.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581010156.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581038589.00007FF78CB28000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: memset
String ID: @$BIN
API String ID: 2221118986-1916819016
Opcode ID: 1a268847dd2997d4c8cab54aa74c89ad69d0630918c7081ed8d1475344bec58a
Instruction ID: 83b161c53b02419e5038aa1079d24fae1c77d8f05e164cc33302cf12c842c9ce
Opcode Fuzzy Hash: 1a268847dd2997d4c8cab54aa74c89ad69d0630918c7081ed8d1475344bec58a
Instruction Fuzzy Hash: 0FB117A2714BC48ADBB08F26D8803DA77A1F748B88F508029DF4C8BB68DF39D605C714

Function 004021DB Relevance: 2.2, Strings: 1, Instructions: 979COMMON

Download Yara Rule

Strings

J4@, xrefs: 004024D2, 004024D6, 004024F9, 00402526, 00402563, 00402866, 0040286A, 00402890, 004028BF, 004028FC, 00402C05, 00402C09, 00402C31, 00402C5E, 00402C9B, 00402FB5, 00402FCE, 00402FFD, 0040303A

Memory Dump Source

Source File: 00000003.00000002.1580609473.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_oaUNY8P657.jbxd

Similarity

API ID:
String ID: J4@
API String ID: 0-1337615203
Opcode ID: 96e0d14de975b23d2a02d8a1b8cb844d9f3b8914b3a0ea00572b5feefccb13d3
Instruction ID: c981a641303732ace0aaf0e6c1c78286eb5573bbc2f65ce16192af0868213e14
Opcode Fuzzy Hash: 96e0d14de975b23d2a02d8a1b8cb844d9f3b8914b3a0ea00572b5feefccb13d3
Instruction Fuzzy Hash: 22727A62B021744CD764AB7348616BC3BE23749B89BC104EBBD8EA77D6DE3C8648D711

Function 00402203 Relevance: 2.2, Strings: 1, Instructions: 975COMMON

Download Yara Rule

Strings

J4@, xrefs: 004024D2, 004024D6, 004024F9, 00402526, 00402563, 00402866, 0040286A, 00402890, 004028BF, 004028FC, 00402C05, 00402C09, 00402C31, 00402C5E, 00402C9B, 00402FB5, 00402FCE, 00402FFD, 0040303A

Memory Dump Source

Source File: 00000003.00000002.1580609473.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_oaUNY8P657.jbxd

Similarity

API ID:
String ID: J4@
API String ID: 0-1337615203
Opcode ID: 15f1cfc02df9505c01b21163f0f9ad1386d541124ebb7241b7cc116e2e865f36
Instruction ID: b219ce202b3ac3bb6170aebe5e642140a1c9ba396f9e901d59a5659491273e33
Opcode Fuzzy Hash: 15f1cfc02df9505c01b21163f0f9ad1386d541124ebb7241b7cc116e2e865f36
Instruction Fuzzy Hash: A8727A62B021744CD764AB7348616BC3BE23749B89BC104EBBD8EA77C6DE3C8648D711

Function 00401F6F Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1580609473.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_oaUNY8P657.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 488d05d2e00176244e08c952148f5a4d12672dc47efef7bd7a6bb70b34a9e1ea
Instruction ID: 4f068ff08c00f4e3ad025d9a024324002f699c1077911d1bedfd12ad2dd1a57b
Opcode Fuzzy Hash: 488d05d2e00176244e08c952148f5a4d12672dc47efef7bd7a6bb70b34a9e1ea
Instruction Fuzzy Hash: FF614483F0D2E45DDB15877700B22BD3FB1965674A34584D7EFEA5278AC92C8316E720

Function 00401F98 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1580609473.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_oaUNY8P657.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bed407f06197039d59fc6cf7541387df823bbabef7276a6b05298a082b3880c
Instruction ID: 84ad7b54dd490618384922845c40554ef0ed41b810b90c3e4d7872b41251fe2e
Opcode Fuzzy Hash: 5bed407f06197039d59fc6cf7541387df823bbabef7276a6b05298a082b3880c
Instruction Fuzzy Hash: 0E613383F0D2E41DDB5587B700B22BD3FB19A5674A34584D7EFEA5278AC92C8316E720

Function 00007FF78CB21C50 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,00000000,00007FF78CB21E21,?,?,?,?,?,?,00007FF78CB24588,00000000,?), ref: 00007FF78CB21CA0
VirtualQuery.KERNEL32 ref: 00007FF78CB21D6B

Strings

Address %p has no image-section, xrefs: 00007FF78CB21CC2, 00007FF78CB21E12
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF78CB21DFE
Mingw-w64 runtime failure:, xrefs: 00007FF78CB21C87
VirtualProtect failed with code 0x%x, xrefs: 00007FF78CB21DDE

Memory Dump Source

Source File: 00000003.00000002.1580956009.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000003.00000002.1580925542.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1580985212.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581010156.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581038589.00007FF78CB28000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: QueryVirtual__acrt_iob_func
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 4109086920-1534286854
Opcode ID: 113019b010cfdea372466ba8fa872585d3c6fd2c84baa86eb644bb16eb746e1d
Instruction ID: ff3716b0fe8d5be1a6bb08e7e731458547dccb9a6e70b6cd0d7a490e5b0c20bd
Opcode Fuzzy Hash: 113019b010cfdea372466ba8fa872585d3c6fd2c84baa86eb644bb16eb746e1d
Instruction Fuzzy Hash: 1151B232A08EA681EA10AF51E8406AAFF61FF88BE4FE44135DE4C57394DE3CE955C710

Function 00007FF78CB21E30 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 227
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(00007FF78CB27040,00007FF78CB27048,00000001,?,?,?,?,000086E8,00007FF78CB21228,?,?,?,00007FF78CB21406), ref: 00007FF78CB2202D

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF78CB22176
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF78CB22094
Unknown pseudo relocation protocol version %d., xrefs: 00007FF78CB22182

Memory Dump Source

Source File: 00000003.00000002.1580956009.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000003.00000002.1580925542.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1580985212.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581010156.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581038589.00007FF78CB28000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 544645111-1286557213
Opcode ID: 5b7a8940f0fc2f72f6df61a936c333ae77e306589e620a94ed3973a55f756175
Instruction ID: 0a21b36cf9d2c26a679dc60d7c226859b511e6a4ad9cce14ed10b26393f81795
Opcode Fuzzy Hash: 5b7a8940f0fc2f72f6df61a936c333ae77e306589e620a94ed3973a55f756175
Instruction Fuzzy Hash: 6691B221E09DE281EA20BB65D80067AEA51BF50B74FA48231DE3C577D8DE3CEC01C621

Function 00007FF78CB21B40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF78CB21B98

Strings

Unknown error, xrefs: 00007FF78CB21C2C
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78CB21BB9

Memory Dump Source

Source File: 00000003.00000002.1580956009.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000003.00000002.1580925542.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1580985212.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581010156.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581038589.00007FF78CB28000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: __acrt_iob_func
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 711238415-3474627141
Opcode ID: ec1d69525b6318d8d8343cc1e8a892cdd36d554898d484f33c722af1ba2e46a4
Instruction ID: 44f23e910d339e99c2b28e2139d0dc3750215f4da971c289a08eba3e6c337eaf
Opcode Fuzzy Hash: ec1d69525b6318d8d8343cc1e8a892cdd36d554898d484f33c722af1ba2e46a4
Instruction Fuzzy Hash: 1501C862908ED8C2D6169F1CE8011FAB774FFA975AF645321EB8C26620DF29D543C700

Function 00007FF78CB21BE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF78CB21B98

Part of subcall function 00007FF78CB22A70: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,00007FF78CB22C03,?,?,00007FF78CB27040,00007FF78CB21341), ref: 00007FF78CB22A98

Strings

Argument domain error (DOMAIN), xrefs: 00007FF78CB21BE0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78CB21BB9

Memory Dump Source

Source File: 00000003.00000002.1580956009.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000003.00000002.1580925542.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1580985212.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581010156.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581038589.00007FF78CB28000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 2168557111-2713391170
Opcode ID: 275f23618c2c71a317faf6ece10275cdf799d050ef905744da1420987ee42d9f
Instruction ID: 5b91ca78ffc2b901313be918a5cc18d6896f57fd8f62e85a12595744ea4d5927
Opcode Fuzzy Hash: 275f23618c2c71a317faf6ece10275cdf799d050ef905744da1420987ee42d9f
Instruction Fuzzy Hash: E5F06213808E9482D2129F18A8001BBB774FF5E799FA55326EB8D26565DF2CD643C710

Function 00007FF78CB21BF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF78CB21B98

Part of subcall function 00007FF78CB22A70: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,00007FF78CB22C03,?,?,00007FF78CB27040,00007FF78CB21341), ref: 00007FF78CB22A98

Strings

Partial loss of significance (PLOSS), xrefs: 00007FF78CB21BF0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78CB21BB9

Memory Dump Source

Source File: 00000003.00000002.1580956009.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000003.00000002.1580925542.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1580985212.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581010156.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581038589.00007FF78CB28000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 2168557111-4283191376
Opcode ID: 1e6cd7a9a68ac3fafb46bace25494c5a3b24ec7900b807ee99d48c331c04c5e1
Instruction ID: 64e63e800f1247fcb4e961c8e923794a11b1fec15b7733fe74fcdd8a2f52ba91
Opcode Fuzzy Hash: 1e6cd7a9a68ac3fafb46bace25494c5a3b24ec7900b807ee99d48c331c04c5e1
Instruction Fuzzy Hash: BDF06213908E9482D2129F18A8001BBB774FF5E799FA55326EF8D26565DF2CD643C710

Function 00007FF78CB21C00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF78CB21B98

Part of subcall function 00007FF78CB22A70: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,00007FF78CB22C03,?,?,00007FF78CB27040,00007FF78CB21341), ref: 00007FF78CB22A98

Strings

Overflow range error (OVERFLOW), xrefs: 00007FF78CB21C00
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78CB21BB9

Memory Dump Source

Source File: 00000003.00000002.1580956009.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000003.00000002.1580925542.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1580985212.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581010156.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581038589.00007FF78CB28000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 2168557111-4064033741
Opcode ID: 18d51c6244cb12bc5dd4f04bc353c537416c76c0457ae9358e107e74a2576210
Instruction ID: 494a6e32aed9c5ee5f0865d97229b414683dccaea898b96aca9a5b85cdab806e
Opcode Fuzzy Hash: 18d51c6244cb12bc5dd4f04bc353c537416c76c0457ae9358e107e74a2576210
Instruction Fuzzy Hash: 6DF0C213808E9482D2029F18A8000BBB770FF5E799FA45326EB8D26424DF2CD643C710

Function 00007FF78CB21C10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF78CB21B98

Part of subcall function 00007FF78CB22A70: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,00007FF78CB22C03,?,?,00007FF78CB27040,00007FF78CB21341), ref: 00007FF78CB22A98

Strings

The result is too small to be represented (UNDERFLOW), xrefs: 00007FF78CB21C10
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78CB21BB9

Memory Dump Source

Source File: 00000003.00000002.1580956009.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000003.00000002.1580925542.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1580985212.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581010156.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581038589.00007FF78CB28000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 2168557111-2187435201
Opcode ID: 4965a13a53480363231e51f40e8bd960487f6ca1a47a5ae8a120c30841ef4640
Instruction ID: de25ed8f7e6b5784b0ad41b5b69ff7d825deabdf6a27835290b3d9cb8fcd6e09
Opcode Fuzzy Hash: 4965a13a53480363231e51f40e8bd960487f6ca1a47a5ae8a120c30841ef4640
Instruction Fuzzy Hash: 16F06213818E9482D2129F18A8000BBB770FF5E799FA55326EB8D2A565DF2CD643D710

Function 00007FF78CB21C20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF78CB21B98

Part of subcall function 00007FF78CB22A70: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,00007FF78CB22C03,?,?,00007FF78CB27040,00007FF78CB21341), ref: 00007FF78CB22A98

Strings

Total loss of significance (TLOSS), xrefs: 00007FF78CB21C20
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78CB21BB9

Memory Dump Source

Source File: 00000003.00000002.1580956009.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000003.00000002.1580925542.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1580985212.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581010156.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581038589.00007FF78CB28000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 2168557111-4273532761
Opcode ID: dd1109fef1e44e27e33944e548427619ad9362c31daffd96fe08d1df9979e15b
Instruction ID: db9c45bc4cc79fec864f17b37c45d1727cca9243e8f1b2dc42d916e4d6791d9d
Opcode Fuzzy Hash: dd1109fef1e44e27e33944e548427619ad9362c31daffd96fe08d1df9979e15b
Instruction Fuzzy Hash: 22F06213808E9482D2129F18A8000BBB770FF5E799FA55326EF8D26525DF2CD643D710

Function 00007FF78CB21B78 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF78CB21B98

Part of subcall function 00007FF78CB22A70: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,00007FF78CB22C03,?,?,00007FF78CB27040,00007FF78CB21341), ref: 00007FF78CB22A98

Strings

Argument singularity (SIGN), xrefs: 00007FF78CB21B78
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78CB21BB9

Memory Dump Source

Source File: 00000003.00000002.1580956009.00007FF78CB21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CB20000, based on PE: true

Associated: 00000003.00000002.1580925542.00007FF78CB20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1580985212.00007FF78CB23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581010156.00007FF78CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581038589.00007FF78CB28000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1581068482.00007FF78CB48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff78cb20000_oaUNY8P657.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 2168557111-2468659920
Opcode ID: 5c60b4d3e583521b1503455a1772254fd0060640fb2af6a87a6682de9bd8815d
Instruction ID: c4a7ee88cd244ea56a9d8633b08ba0442ec2185b3a048651e0fa647e7945d326
Opcode Fuzzy Hash: 5c60b4d3e583521b1503455a1772254fd0060640fb2af6a87a6682de9bd8815d
Instruction Fuzzy Hash: 0DF03623918ED482D2129F28A8001ABB774FF5E799F655326EF8D3A525DF28D583C710

Analysis Process: sms561F.tmpPID: 7508, Parent PID: 7456COMMON

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	100%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFAAC487B71 Relevance: 1.6, APIs: 1, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32 ref: 00007FFAAC487C20

Memory Dump Source

Source File: 00000004.00000002.1580218776.00007FFAAC480000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac480000_sms561F.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: ed7168e30d9c53dfbc5bec4172090893ee7dc01ef47be0087d2b1e5c92107288
Instruction ID: 71d8dd0dee1af3813383e1d3f76c5100ef2f80d47b0ea57f28b837ea07d18ee8
Opcode Fuzzy Hash: ed7168e30d9c53dfbc5bec4172090893ee7dc01ef47be0087d2b1e5c92107288
Instruction Fuzzy Hash: B731247180871C8FDB58DF68C88A6F97BE0EF65321F04816AD489D7252DB34A846CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report oaUNY8P657.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_sms561F.tmp_942c3da8370deac9a4ef501abf272bdc1219b_47ac16bd_5ad1f071-b479-4c6d-8e86-ee4719fcda92\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7417.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B9A.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7C08.tmp.xml

C:\Users\user\AppData\Local\Temp\sms561F.tmp

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
oaUNY8P657.exe

Function 00007FF78CB21522 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 231
injectionmemorythreadCOMMON

Function 00007FF78CB21180 Relevance: 12.1, APIs: 8, Instructions: 146
sleepstringCOMMON

Function 00007FF78CB221D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81
COMMON

Function 00007FF78CB21C50 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 138
COMMON

Function 00007FF78CB21E30 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 227
memoryCOMMON

Function 00007FF78CB21B40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38
COMMON

Function 00007FF78CB21BE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Function 00007FF78CB21BF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Function 00007FF78CB21C00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Function 00007FF78CB21C10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Function 00007FF78CB21C20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Function 00007FF78CB21B78 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24
COMMON