Edit tour

Windows Analysis Report
z81zEuzkJPHHV3KYua.exe

Overview

General Information

Sample name:	z81zEuzkJPHHV3KYua.exe
Analysis ID:	1560298
MD5:	1b4a6383c2a9b4fd9d1c2ba270800a49
SHA1:	ae5c4b7b0a37b4d1c8b65d13417257b29cd2188e
SHA256:	cd60ea86b574b6b511ce6a6aff1314ce71b1953e169792e3e76a36913e85ea23
Tags:	exeuser-Porcupine
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

z81zEuzkJPHHV3KYua.exe (PID: 7404 cmdline: "C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe" MD5: 1B4A6383C2A9B4FD9D1C2BA270800A49)

powershell.exe (PID: 7468 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7736 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

z81zEuzkJPHHV3KYua.exe (PID: 7476 cmdline: "C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe" MD5: 1B4A6383C2A9B4FD9D1C2BA270800A49)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.apexrnun.com", "Username": "testlab@apexrnun.com", "Password": "%qroUozO;(C2Rlyb"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2938171995.0000000002E2D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.2938171995.0000000002E51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.2935688677.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2935688677.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.2938171995.0000000002E01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2938171995.0000000002E01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1698165840.0000000003999000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1698165840.0000000003999000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: z81zEuzkJPHHV3KYua.exe PID: 7404	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: z81zEuzkJPHHV3KYua.exe PID: 7404	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: z81zEuzkJPHHV3KYua.exe PID: 7404	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: z81zEuzkJPHHV3KYua.exe PID: 7476	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: z81zEuzkJPHHV3KYua.exe PID: 7476	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.z81zEuzkJPHHV3KYua.exe.3be88c0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.z81zEuzkJPHHV3KYua.exe.3be88c0.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.z81zEuzkJPHHV3KYua.exe.3be88c0.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32363:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x323d5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3245f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x324f1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3255b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x325cd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32663:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x326f3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32363:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x323d5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3245f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x324f1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3255b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x325cd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32663:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x326f3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.z81zEuzkJPHHV3KYua.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.z81zEuzkJPHHV3KYua.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.z81zEuzkJPHHV3KYua.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.z81zEuzkJPHHV3KYua.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34163:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x341d5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3425f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x342f1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3435b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x343cd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34463:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x344f3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.z81zEuzkJPHHV3KYua.exe.3be88c0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.z81zEuzkJPHHV3KYua.exe.3be88c0.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.z81zEuzkJPHHV3KYua.exe.3be88c0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.z81zEuzkJPHHV3KYua.exe.3be88c0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34163:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x341d5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3425f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x342f1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3435b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x343cd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34463:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x344f3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34163:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f783:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x341d5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f7f5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3425f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f87f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x342f1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f911:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3435b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f97b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x343cd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6f9ed:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34463:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6fa83:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x344f3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6fb13:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 13 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe", ParentImage: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe, ParentProcessId: 7404, ParentProcessName: z81zEuzkJPHHV3KYua.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe", ProcessId: 7468, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 185.196.9.150, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe, Initiated: true, ProcessId: 7476, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe", ParentImage: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe, ParentProcessId: 7404, ParentProcessName: z81zEuzkJPHHV3KYua.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe", ProcessId: 7468, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 2.2.z81zEuzkJPHHV3KYua.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.apexrnun.com", "Username": "testlab@apexrnun.com", "Password": "%qroUozO;(C2Rlyb"}

Multi AV Scanner detection for submitted file

Source: z81zEuzkJPHHV3KYua.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: z81zEuzkJPHHV3KYua.exe

Joe Sandbox ML: detected

Source: z81zEuzkJPHHV3KYua.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: z81zEuzkJPHHV3KYua.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: jflX.pdbSHA256 source: z81zEuzkJPHHV3KYua.exe
Source:	Binary string: jflX.pdb source: z81zEuzkJPHHV3KYua.exe

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 2.2.z81zEuzkJPHHV3KYua.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z81zEuzkJPHHV3KYua.exe.3be88c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 185.196.9.150:587

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 185.196.9.150 185.196.9.150

Source: unknown

DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 185.196.9.150:587

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: mail.apexrnun.com

Source: z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2938171995.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: z81zEuzkJPHHV3KYua.exe, 00000000.00000002.1698165840.0000000003999000.00000004.00000800.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2938171995.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2935688677.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2938171995.0000000002E2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.apexrnun.com
Source: z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.000000000101D000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2938171995.0000000002E2D000.00000004.00000800.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2942075233.0000000006468000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.000000000102E000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.0000000001060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/02
Source: z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.000000000101D000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2938171995.0000000002E2D000.00000004.00000800.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2942075233.0000000006468000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.000000000102E000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.0000000001060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: z81zEuzkJPHHV3KYua.exe, 00000000.00000002.1697345336.0000000002A03000.00000004.00000800.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2938171995.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.000000000101D000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2938171995.0000000002E2D000.00000004.00000800.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2942075233.0000000006468000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.000000000102E000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.0000000001060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.000000000101D000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2938171995.0000000002E2D000.00000004.00000800.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2942075233.0000000006468000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.000000000102E000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.0000000001060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: z81zEuzkJPHHV3KYua.exe, 00000000.00000002.1698165840.0000000003999000.00000004.00000800.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2935688677.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.raw.unpack, SKTzxzsJw.cs	.Net Code: _17HhIAJY
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3be88c0.3.raw.unpack, SKTzxzsJw.cs	.Net Code: _17HhIAJY

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.z81zEuzkJPHHV3KYua.exe.3be88c0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.z81zEuzkJPHHV3KYua.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3be88c0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 0_2_00C9D55C	0_2_00C9D55C
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 0_2_04EC67E0	0_2_04EC67E0
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 0_2_04EC67D3	0_2_04EC67D3
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 0_2_04ECD789	0_2_04ECD789
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 0_2_04EC0040	0_2_04EC0040
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 0_2_04EC001F	0_2_04EC001F
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 0_2_04ECC154	0_2_04ECC154
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 0_2_04ECEC40	0_2_04ECEC40
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_02BF4AC0	2_2_02BF4AC0
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_02BFA8A8	2_2_02BFA8A8
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_02BF3EA8	2_2_02BF3EA8
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_02BFEC18	2_2_02BFEC18
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_02BFAD00	2_2_02BFAD00
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_02BF41F0	2_2_02BF41F0
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_0694C2F8	2_2_0694C2F8
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_0694A854	2_2_0694A854
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_069565C0	2_2_069565C0
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_06955568	2_2_06955568
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_0695B208	2_2_0695B208
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_06952350	2_2_06952350
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_0695C148	2_2_0695C148
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_06957D50	2_2_06957D50
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_06957670	2_2_06957670
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_0695E378	2_2_0695E378
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_06950040	2_2_06950040
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_06955CC8	2_2_06955CC8
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_06950006	2_2_06950006

Source: z81zEuzkJPHHV3KYua.exe, 00000000.00000002.1698165840.0000000003999000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec8656b0c-2aa3-4d56-9386-3f68d83183ee.exe4 vs z81zEuzkJPHHV3KYua.exe
Source: z81zEuzkJPHHV3KYua.exe, 00000000.00000002.1698165840.0000000003999000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs z81zEuzkJPHHV3KYua.exe
Source: z81zEuzkJPHHV3KYua.exe, 00000000.00000002.1709916605.00000000053D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs z81zEuzkJPHHV3KYua.exe
Source: z81zEuzkJPHHV3KYua.exe, 00000000.00000002.1696176273.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs z81zEuzkJPHHV3KYua.exe
Source: z81zEuzkJPHHV3KYua.exe, 00000000.00000002.1709429831.0000000004FB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs z81zEuzkJPHHV3KYua.exe
Source: z81zEuzkJPHHV3KYua.exe, 00000000.00000002.1710849746.0000000005F20000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs z81zEuzkJPHHV3KYua.exe
Source: z81zEuzkJPHHV3KYua.exe, 00000000.00000002.1697345336.0000000002A03000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec8656b0c-2aa3-4d56-9386-3f68d83183ee.exe4 vs z81zEuzkJPHHV3KYua.exe
Source: z81zEuzkJPHHV3KYua.exe, 00000000.00000000.1684187952.000000000064E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamejflX.exe: vs z81zEuzkJPHHV3KYua.exe
Source: z81zEuzkJPHHV3KYua.exe, 00000000.00000002.1697345336.0000000002991000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs z81zEuzkJPHHV3KYua.exe
Source: z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2935688677.000000000043E000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec8656b0c-2aa3-4d56-9386-3f68d83183ee.exe4 vs z81zEuzkJPHHV3KYua.exe
Source: z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936117288.0000000000EF8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs z81zEuzkJPHHV3KYua.exe
Source: z81zEuzkJPHHV3KYua.exe	Binary or memory string: OriginalFilenamejflX.exe: vs z81zEuzkJPHHV3KYua.exe

Source: z81zEuzkJPHHV3KYua.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.z81zEuzkJPHHV3KYua.exe.3be88c0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.z81zEuzkJPHHV3KYua.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3be88c0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: z81zEuzkJPHHV3KYua.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, GyoxbTL0R84sRAmXa1.cs	Security API names: _0020.SetAccessControl
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, GyoxbTL0R84sRAmXa1.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, GyoxbTL0R84sRAmXa1.cs	Security API names: _0020.AddAccessRule
Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, GyoxbTL0R84sRAmXa1.cs	Security API names: _0020.SetAccessControl
Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, GyoxbTL0R84sRAmXa1.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, GyoxbTL0R84sRAmXa1.cs	Security API names: _0020.AddAccessRule
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, PkbD1yF27iOcdZlfR9.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, PkbD1yF27iOcdZlfR9.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, PkbD1yF27iOcdZlfR9.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, PkbD1yF27iOcdZlfR9.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/6@2/2

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\z81zEuzkJPHHV3KYua.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7484:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sgzowy5q.hul.ps1

Jump to behavior

Source: z81zEuzkJPHHV3KYua.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: z81zEuzkJPHHV3KYua.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: z81zEuzkJPHHV3KYua.exe

ReversingLabs: Detection: 42%

Source: unknown	Process created: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe "C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe"
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe"
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process created: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe "C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process created: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe "C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe"	Jump to behavior

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: z81zEuzkJPHHV3KYua.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: z81zEuzkJPHHV3KYua.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: z81zEuzkJPHHV3KYua.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: jflX.pdbSHA256 source: z81zEuzkJPHHV3KYua.exe
Source:	Binary string: jflX.pdb source: z81zEuzkJPHHV3KYua.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, GyoxbTL0R84sRAmXa1.cs	.Net Code: WeNBI59F1e System.Reflection.Assembly.Load(byte[])
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, GyoxbTL0R84sRAmXa1.cs	.Net Code: WeNBI59F1e System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_06945C95 push esp; retf	2_2_06945CB4
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_06945C88 push esp; retf	2_2_06945C94
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_06945C60 push esp; retf	2_2_06945C74
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_06943D70 push ebp; retf	2_2_06943DDD
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_071227CD push dword ptr [ecx+ecx-75h]; iretd	2_2_071227D3
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Code function: 2_2_0712297E push esi; retf	2_2_0712297F

Source: z81zEuzkJPHHV3KYua.exe

Static PE information: section name: .text entropy: 7.836147110785658

Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, EgjJWuawUV8VIQli6e.cs	High entropy of concatenated method names: 'ToString', 'Be1AimkqOZ', 'p9fAhOOqdF', 'JWaAvaXGQY', 'PfFA63IAsf', 'SFmAJbtWDm', 'dANApQRgCl', 'LscAwp0lEu', 'fOHA8kCyuI', 'GeqAmSmD7D'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, TCYKLZmB9cy4gbvfkU.cs	High entropy of concatenated method names: 'KTZgsb7RYg', 'wRlgrBY7ZY', 'abFgIxrLMH', 'iuOg0jQpGJ', 'x6lgc5LeDD', 'is8gGFteFP', 'd4QgOMCKaU', 'CQ5gFa3JFh', 'F2qgYeArKB', 'BrIglrNdvH'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, WHeJVtWHd25a3jo1ZT.cs	High entropy of concatenated method names: 'Dispose', 'mPVPQHFjsZ', 'uvXEhJHj2K', 'x1DcPif94i', 'nK4PMgq3pe', 'QBXPzj9wbP', 'ProcessDialogKey', 'W7AEVaPiR9', 'nyMEPh6cZ7', 'AVyEEcFXeY'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, N2BexxPBx348bC9BET6.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'WqQHfIvClV', 'vW4HSvtZgh', 'u1vHjGh3RX', 'pjsHHGRyTP', 'G18HTbwQq1', 'qO5H4eUbgV', 'JgPH2QdBt3'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, xFMHSNtZposDeqssmL.cs	High entropy of concatenated method names: 'JDTDywNCwV', 'xllDMqN44p', 'irhdVGawiu', 'wUqdPjFDTg', 'AodDi3SOfP', 'BLPDnIFwZQ', 'djkDUSBUSD', 'vlADZh42g6', 'MWFDoZsTNB', 'oHtDaaWvv6'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, PkbD1yF27iOcdZlfR9.cs	High entropy of concatenated method names: 'molWZkwBEg', 'PhNWoUO2l6', 'gaAWaAdCWm', 'hfCWCMRySO', 'r5tWqIiMyR', 'NYBWtf3ePs', 'M7RWNby2QN', 'SKAWyyMIhZ', 'sU9WQOward', 'ANCWMngjM9'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, P2L4oBNXs9PVHFjsZ9.cs	High entropy of concatenated method names: 'BfSf15DM0F', 'tFsfDD0MRu', 'akCffUUH7y', 'txcfjEXQRF', 'DUhfTBrpcb', 'Fhpf2GWb0G', 'Dispose', 'i4ud7ORBy3', 'MTldWHp9NE', 'XqEd3CqstS'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, fO1oFSKTWOXP51qUpW.cs	High entropy of concatenated method names: 'eGxexlYwIh', 'VLTeWYLUv6', 'PQFe5kpt4X', 'CrMegvuXLo', 'hQGeLPE5En', 'qGo5q6vrwF', 'yIj5tpZnjU', 'WPv5NaNSR4', 'w815yRLQKY', 'jW35QT18un'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, JW0klpPPgdnUeqsFK6t.cs	High entropy of concatenated method names: 'gHYSMKW87Q', 'S1ySzKLpkW', 'bPejVEvUnZ', 'o5ojPN85M4', 'KkYjEEnLXB', 'XCajbu6WZV', 'E2mjBXTVQP', 'rkZjxYE6Kq', 'B8Cj7IPaaW', 'BndjWWKayV'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, OgeqsaUZ6PTppij1Gt.cs	High entropy of concatenated method names: 'a92XFW0Zra', 'ViNXY2OGjL', 'mAoXK6USFo', 'jtLXha4JZw', 'maTX6bxNcg', 'XJDXJn33sf', 'uBmXw2pmRW', 'fR2X8JBGDh', 'C6QXR9xVW4', 'QmQXi1rOX3'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, zh22NKzsIUSB6yRCT4.cs	High entropy of concatenated method names: 'lqmSGdGfYG', 'SQsSFldY2B', 'fLBSYxeajx', 'H8LSKtgOQ2', 'nDQSh8AS8g', 'gDdS6LAj57', 'tGlSJBm59i', 'TjhS2PqmEb', 'XlySsBEQTg', 'V5KSr7bT4M'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, fu2cAZE15HapJxOXFl.cs	High entropy of concatenated method names: 'aNaIqht85', 'fYW01PF7n', 'KLwGZCCu0', 'zjGOQiOdu', 'j6EYqDR9I', 'pselhQDH4', 'zDOlGBb6lcbcxJYv03', 'uPW0o1iednuAUgQElc', 'xhMdaQnkc', 'hcdSOlL1p'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, AFXeYmMRES0FjcYCY4.cs	High entropy of concatenated method names: 'Y2KS3FXSHd', 'WfUS5ub68T', 'xEGSeqcNFf', 'f2xSgEtm9w', 'Oo7SfVn7p0', 'QfqSLbDqxJ', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, qn9GZHwXA1UA5E0qFA.cs	High entropy of concatenated method names: 'yqcg7B4Tgw', 'Tlkg3XgsEv', 'f1IgeYS5HX', 'HhMeM7Ii3f', 'jZsezLnD1m', 'NG2gV64BIH', 'stngPcVWiH', 'cPtgE4iwKo', 'zqxgbiqbHd', 'uXhgBgGkK5'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, paPiR9Q9yMh6cZ70Vy.cs	High entropy of concatenated method names: 'nOGfKReCHp', 'PKcfha5wxb', 'pyvfv74qjs', 'gaXf6nIff0', 'cGafJgGRa6', 'zJ7fpZCtam', 'VfnfwKHgRg', 'EXnf8yojQV', 'BHZfmAe5q3', 'rj1fRAJe9k'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, GyoxbTL0R84sRAmXa1.cs	High entropy of concatenated method names: 'I53bxvSS7Y', 'b5Bb74L4eu', 'jGwbWF2SOu', 'NEHb3vPTiZ', 'HiQb5IcCHt', 'zmpbebJV6g', 'V5obgRWT4b', 'beubLk8ZrZ', 'q60buG55cg', 'i6pbkbabcW'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, rqAGhtBXPQH2N5PTAg.cs	High entropy of concatenated method names: 'AKnPgkbD1y', 'x7iPLOcdZl', 'ipUPk9VGVE', 'd62P9YQyfQ', 'tswP1qN7O1', 'SFSPATWOXP', 'UOEEYQE2mCuDv70uls', 'eiyxJfZBxHqLnoH0Ct', 'FgvPPjvGgK', 'tKTPbmJrCL'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.5f20000.5.raw.unpack, pGmfDeYpU9VGVEb62Y.cs	High entropy of concatenated method names: 'AjQ30V7ofl', 'MHY3GUc5vE', 'VvG3FYAagm', 'glo3Y8SPjW', 'PyH31RJUme', 'pgt3A0RRNm', 'hVG3DI8sIU', 'sW13dDykCL', 'xiV3fDAoJ5', 'f7M3SZRT4C'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, EgjJWuawUV8VIQli6e.cs	High entropy of concatenated method names: 'ToString', 'Be1AimkqOZ', 'p9fAhOOqdF', 'JWaAvaXGQY', 'PfFA63IAsf', 'SFmAJbtWDm', 'dANApQRgCl', 'LscAwp0lEu', 'fOHA8kCyuI', 'GeqAmSmD7D'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, TCYKLZmB9cy4gbvfkU.cs	High entropy of concatenated method names: 'KTZgsb7RYg', 'wRlgrBY7ZY', 'abFgIxrLMH', 'iuOg0jQpGJ', 'x6lgc5LeDD', 'is8gGFteFP', 'd4QgOMCKaU', 'CQ5gFa3JFh', 'F2qgYeArKB', 'BrIglrNdvH'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, WHeJVtWHd25a3jo1ZT.cs	High entropy of concatenated method names: 'Dispose', 'mPVPQHFjsZ', 'uvXEhJHj2K', 'x1DcPif94i', 'nK4PMgq3pe', 'QBXPzj9wbP', 'ProcessDialogKey', 'W7AEVaPiR9', 'nyMEPh6cZ7', 'AVyEEcFXeY'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, N2BexxPBx348bC9BET6.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'WqQHfIvClV', 'vW4HSvtZgh', 'u1vHjGh3RX', 'pjsHHGRyTP', 'G18HTbwQq1', 'qO5H4eUbgV', 'JgPH2QdBt3'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, xFMHSNtZposDeqssmL.cs	High entropy of concatenated method names: 'JDTDywNCwV', 'xllDMqN44p', 'irhdVGawiu', 'wUqdPjFDTg', 'AodDi3SOfP', 'BLPDnIFwZQ', 'djkDUSBUSD', 'vlADZh42g6', 'MWFDoZsTNB', 'oHtDaaWvv6'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, PkbD1yF27iOcdZlfR9.cs	High entropy of concatenated method names: 'molWZkwBEg', 'PhNWoUO2l6', 'gaAWaAdCWm', 'hfCWCMRySO', 'r5tWqIiMyR', 'NYBWtf3ePs', 'M7RWNby2QN', 'SKAWyyMIhZ', 'sU9WQOward', 'ANCWMngjM9'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, P2L4oBNXs9PVHFjsZ9.cs	High entropy of concatenated method names: 'BfSf15DM0F', 'tFsfDD0MRu', 'akCffUUH7y', 'txcfjEXQRF', 'DUhfTBrpcb', 'Fhpf2GWb0G', 'Dispose', 'i4ud7ORBy3', 'MTldWHp9NE', 'XqEd3CqstS'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, fO1oFSKTWOXP51qUpW.cs	High entropy of concatenated method names: 'eGxexlYwIh', 'VLTeWYLUv6', 'PQFe5kpt4X', 'CrMegvuXLo', 'hQGeLPE5En', 'qGo5q6vrwF', 'yIj5tpZnjU', 'WPv5NaNSR4', 'w815yRLQKY', 'jW35QT18un'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, JW0klpPPgdnUeqsFK6t.cs	High entropy of concatenated method names: 'gHYSMKW87Q', 'S1ySzKLpkW', 'bPejVEvUnZ', 'o5ojPN85M4', 'KkYjEEnLXB', 'XCajbu6WZV', 'E2mjBXTVQP', 'rkZjxYE6Kq', 'B8Cj7IPaaW', 'BndjWWKayV'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, OgeqsaUZ6PTppij1Gt.cs	High entropy of concatenated method names: 'a92XFW0Zra', 'ViNXY2OGjL', 'mAoXK6USFo', 'jtLXha4JZw', 'maTX6bxNcg', 'XJDXJn33sf', 'uBmXw2pmRW', 'fR2X8JBGDh', 'C6QXR9xVW4', 'QmQXi1rOX3'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, zh22NKzsIUSB6yRCT4.cs	High entropy of concatenated method names: 'lqmSGdGfYG', 'SQsSFldY2B', 'fLBSYxeajx', 'H8LSKtgOQ2', 'nDQSh8AS8g', 'gDdS6LAj57', 'tGlSJBm59i', 'TjhS2PqmEb', 'XlySsBEQTg', 'V5KSr7bT4M'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, fu2cAZE15HapJxOXFl.cs	High entropy of concatenated method names: 'aNaIqht85', 'fYW01PF7n', 'KLwGZCCu0', 'zjGOQiOdu', 'j6EYqDR9I', 'pselhQDH4', 'zDOlGBb6lcbcxJYv03', 'uPW0o1iednuAUgQElc', 'xhMdaQnkc', 'hcdSOlL1p'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, AFXeYmMRES0FjcYCY4.cs	High entropy of concatenated method names: 'Y2KS3FXSHd', 'WfUS5ub68T', 'xEGSeqcNFf', 'f2xSgEtm9w', 'Oo7SfVn7p0', 'QfqSLbDqxJ', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, qn9GZHwXA1UA5E0qFA.cs	High entropy of concatenated method names: 'yqcg7B4Tgw', 'Tlkg3XgsEv', 'f1IgeYS5HX', 'HhMeM7Ii3f', 'jZsezLnD1m', 'NG2gV64BIH', 'stngPcVWiH', 'cPtgE4iwKo', 'zqxgbiqbHd', 'uXhgBgGkK5'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, paPiR9Q9yMh6cZ70Vy.cs	High entropy of concatenated method names: 'nOGfKReCHp', 'PKcfha5wxb', 'pyvfv74qjs', 'gaXf6nIff0', 'cGafJgGRa6', 'zJ7fpZCtam', 'VfnfwKHgRg', 'EXnf8yojQV', 'BHZfmAe5q3', 'rj1fRAJe9k'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, GyoxbTL0R84sRAmXa1.cs	High entropy of concatenated method names: 'I53bxvSS7Y', 'b5Bb74L4eu', 'jGwbWF2SOu', 'NEHb3vPTiZ', 'HiQb5IcCHt', 'zmpbebJV6g', 'V5obgRWT4b', 'beubLk8ZrZ', 'q60buG55cg', 'i6pbkbabcW'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, rqAGhtBXPQH2N5PTAg.cs	High entropy of concatenated method names: 'AKnPgkbD1y', 'x7iPLOcdZl', 'ipUPk9VGVE', 'd62P9YQyfQ', 'tswP1qN7O1', 'SFSPATWOXP', 'UOEEYQE2mCuDv70uls', 'eiyxJfZBxHqLnoH0Ct', 'FgvPPjvGgK', 'tKTPbmJrCL'
Source: 0.2.z81zEuzkJPHHV3KYua.exe.3c2ccc0.1.raw.unpack, pGmfDeYpU9VGVEb62Y.cs	High entropy of concatenated method names: 'AjQ30V7ofl', 'MHY3GUc5vE', 'VvG3FYAagm', 'glo3Y8SPjW', 'PyH31RJUme', 'pgt3A0RRNm', 'hVG3DI8sIU', 'sW13dDykCL', 'xiV3fDAoJ5', 'f7M3SZRT4C'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate

Jump to behavior

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: z81zEuzkJPHHV3KYua.exe PID: 7404, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: z81zEuzkJPHHV3KYua.exe, 00000000.00000002.1698165840.0000000003999000.00000004.00000800.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2938171995.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2935688677.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Memory allocated: C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Memory allocated: 2990000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Memory allocated: 2790000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Memory allocated: 60A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Memory allocated: 70A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Memory allocated: 71E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Memory allocated: 81E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Memory allocated: 2BF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Memory allocated: 2DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Memory allocated: 4DD0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6442	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3244	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Window / User API: threadDelayed 2017	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Window / User API: threadDelayed 7817	Jump to behavior

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7424	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7684	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep count: 42 > 30	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -38738162554790034s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7824	Thread sleep count: 2017 > 30	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -99891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7824	Thread sleep count: 7817 > 30	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -99672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -99560s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -99451s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -99275s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -99164s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -99053s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -98922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -98813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -98703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -98594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -98469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -98360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -98235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -98110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -97985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -97860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -97735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -97610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -97485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -97360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -97235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -97110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -96985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -96860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -96735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -96545s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -96323s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -96210s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -96094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -95984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -95875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -95765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -95641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -95531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -95422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -95313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -95203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -95094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -94984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -94875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -94766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -94656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -94536s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -94406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -94297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -94172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe TID: 7820	Thread sleep time: -94062s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 99891	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 99560	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 99451	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 99275	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 99164	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 99053	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 98922	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 98813	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 98703	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 98594	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 98469	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 98360	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 98235	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 98110	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 97985	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 97860	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 97735	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 97610	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 97485	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 97360	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 97235	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 97110	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 96985	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 96860	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 96735	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 96545	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 96323	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 96210	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 96094	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 95984	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 95875	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 95765	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 95641	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 95531	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 95422	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 95313	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 95203	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 95094	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 94984	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 94875	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 94766	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 94656	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 94536	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 94406	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 94297	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 94172	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Thread delayed: delay time: 94062	Jump to behavior

Source: z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2938171995.0000000002E01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2935688677.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: z81zEuzkJPHHV3KYua.exe, 00000000.00000002.1698165840.0000000003999000.00000004.00000800.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000000.00000002.1710849746.0000000005F20000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: jkQEmuRFhg
Source: z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2935688677.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBox
Source: z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.0000000001060000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe

Code function: 2_2_02BF70A0 CheckRemoteDebuggerPresent,

2_2_02BF70A0

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe"
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe"			Jump to behavior

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe"			Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Process created: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe "C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe"			Jump to behavior

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Queries volume information: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Queries volume information: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.z81zEuzkJPHHV3KYua.exe.3be88c0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.z81zEuzkJPHHV3KYua.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z81zEuzkJPHHV3KYua.exe.3be88c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2938171995.0000000002E2D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2938171995.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2935688677.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2938171995.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1698165840.0000000003999000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z81zEuzkJPHHV3KYua.exe PID: 7404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: z81zEuzkJPHHV3KYua.exe PID: 7476, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.z81zEuzkJPHHV3KYua.exe.3be88c0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.z81zEuzkJPHHV3KYua.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z81zEuzkJPHHV3KYua.exe.3be88c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2935688677.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2938171995.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1698165840.0000000003999000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z81zEuzkJPHHV3KYua.exe PID: 7404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: z81zEuzkJPHHV3KYua.exe PID: 7476, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.z81zEuzkJPHHV3KYua.exe.3be88c0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.z81zEuzkJPHHV3KYua.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z81zEuzkJPHHV3KYua.exe.3be88c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z81zEuzkJPHHV3KYua.exe.3bad2a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2938171995.0000000002E2D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2938171995.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2935688677.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2938171995.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1698165840.0000000003999000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z81zEuzkJPHHV3KYua.exe PID: 7404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: z81zEuzkJPHHV3KYua.exe PID: 7476, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	231 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	34 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	531 Security Software Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	261 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	261 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
z81zEuzkJPHHV3KYua.exe	42%	ReversingLabs	ByteCode-MSIL.Trojan.GenSteal
z81zEuzkJPHHV3KYua.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://mail.apexrnun.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	false		high
mail.apexrnun.com	185.196.9.150	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://account.dyn.com/	z81zEuzkJPHHV3KYua.exe, 00000000.00000002.1698165840.0000000003999000.00000004.00000800.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2935688677.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://mail.apexrnun.com	z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2938171995.0000000002E2D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r11.o.lencr.org0#	z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.000000000101D000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2938171995.0000000002E2D000.00000004.00000800.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2942075233.0000000006468000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.000000000102E000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.0000000001060000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	z81zEuzkJPHHV3KYua.exe, 00000000.00000002.1697345336.0000000002A03000.00000004.00000800.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2938171995.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.000000000101D000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2938171995.0000000002E2D000.00000004.00000800.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2942075233.0000000006468000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.000000000102E000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.0000000001060000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.000000000101D000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2938171995.0000000002E2D000.00000004.00000800.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2942075233.0000000006468000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.000000000102E000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.0000000001060000.00000004.00000020.00020000.00000000.sdmp	false		high
http://r11.i.lencr.org/02	z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.000000000101D000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2938171995.0000000002E2D000.00000004.00000800.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2942075233.0000000006468000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.000000000102E000.00000004.00000020.00020000.00000000.sdmp, z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2936275430.0000000001060000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ip-api.com	z81zEuzkJPHHV3KYua.exe, 00000002.00000002.2938171995.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
185.196.9.150	mail.apexrnun.com	Switzerland		42624	SIMPLECARRIERCH	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560298
Start date and time:	2024-11-21 16:31:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	z81zEuzkJPHHV3KYua.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/6@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 84 Number of non-executed functions: 12
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: z81zEuzkJPHHV3KYua.exe

Simulations

Behavior and APIs

Time	Type	Description
10:31:57	API Interceptor	62x Sleep call for process: z81zEuzkJPHHV3KYua.exe modified
10:31:58	API Interceptor	15x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	Listing_error_15_code_file-002.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	ip-api.com/json/
	Listing_error_15_code_file-002.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	ip-api.com/json/
	NeftPaymentError_details__Emdtd22102024_jpg.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	ip-api.com/json/
	Wire slip account payable.pif.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	HnJdZm51Xl.exe	Get hash	malicious	Amadey, Clipboard Hijacker	Browse	ip-api.com/line/
	file.exe	Get hash	malicious	JasonRAT	Browse	ip-api.com/json/?fields=11827
	Fulloption_V2.1.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	BoostFPS.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	New_Order_Inquiry.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	seethebestthingswithgreatsituationshandletotheprogress.hta	Get hash	malicious	Cobalt Strike, AgentTesla, HTMLPhisher	Browse	ip-api.com/line/?fields=hosting
185.196.9.150	paket teklif.exe	Get hash	malicious	AgentTesla	Browse
	Sipari_.exe	Get hash	malicious	AgentTesla	Browse
	IgTdifcj7HukYrd.exe	Get hash	malicious	AgentTesla	Browse
	202411070105F02558.exe	Get hash	malicious	AgentTesla	Browse
	Dekont.exe	Get hash	malicious	AgentTesla	Browse
	4tuMnSBgXFwIxMP.exe	Get hash	malicious	AgentTesla	Browse
	tfz7ikR76n.exe	Get hash	malicious	AgentTesla	Browse
	sipari_.exe	Get hash	malicious	AgentTesla	Browse
	fEv4R2ahiLCQa5O.exe	Get hash	malicious	AgentTesla	Browse
	PW68YarHboeikgM.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	Listing_error_15_code_file-002.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Listing_error_15_code_file-002.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	NeftPaymentError_details__Emdtd22102024_jpg.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Wire slip account payable.pif.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	http://christians-google-sh-97m2.glide.page/dl/d0a5f4	Get hash	malicious	Unknown	Browse	208.95.112.2
	HnJdZm51Xl.exe	Get hash	malicious	Amadey, Clipboard Hijacker	Browse	208.95.112.1
	file.exe	Get hash	malicious	JasonRAT	Browse	208.95.112.1
	Fulloption_V2.1.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	BoostFPS.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	New_Order_Inquiry.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
mail.apexrnun.com	paket teklif.exe	Get hash	malicious	AgentTesla	Browse	185.196.9.150
	Sipari_.exe	Get hash	malicious	AgentTesla	Browse	185.196.9.150
	IgTdifcj7HukYrd.exe	Get hash	malicious	AgentTesla	Browse	185.196.9.150
	202411070105F02558.exe	Get hash	malicious	AgentTesla	Browse	185.196.9.150
	Dekont.exe	Get hash	malicious	AgentTesla	Browse	185.196.9.150
	4tuMnSBgXFwIxMP.exe	Get hash	malicious	AgentTesla	Browse	185.196.9.150
	tfz7ikR76n.exe	Get hash	malicious	AgentTesla	Browse	185.196.9.150
	sipari_.exe	Get hash	malicious	AgentTesla	Browse	185.196.9.150
	fEv4R2ahiLCQa5O.exe	Get hash	malicious	AgentTesla	Browse	185.196.9.150
	PW68YarHboeikgM.exe	Get hash	malicious	AgentTesla	Browse	185.196.9.150

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TUT-ASUS	Listing_error_15_code_file-002.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Listing_error_15_code_file-002.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	NeftPaymentError_details__Emdtd22102024_jpg.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Wire slip account payable.pif.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	http://christians-google-sh-97m2.glide.page/dl/d0a5f4	Get hash	malicious	Unknown	Browse	208.95.112.2
	HnJdZm51Xl.exe	Get hash	malicious	Amadey, Clipboard Hijacker	Browse	208.95.112.1
	file.exe	Get hash	malicious	JasonRAT	Browse	208.95.112.1
	Fulloption_V2.1.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	BoostFPS.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	New_Order_Inquiry.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
SIMPLECARRIERCH	j4LR4vQhNn.exe	Get hash	malicious	PureCrypter	Browse	185.196.9.94
	j4LR4vQhNn.exe	Get hash	malicious	PureCrypter	Browse	185.196.9.94
	paket teklif.exe	Get hash	malicious	AgentTesla	Browse	185.196.9.150
	0a0#U00a0.js	Get hash	malicious	RHADAMANTHYS	Browse	185.196.11.18
	Sipari_.exe	Get hash	malicious	AgentTesla	Browse	185.196.9.150
	PO9927574.png.lnk	Get hash	malicious	Unknown	Browse	185.196.11.151
	IgTdifcj7HukYrd.exe	Get hash	malicious	AgentTesla	Browse	185.196.9.150
	NizYVB7pgj.lnk	Get hash	malicious	Unknown	Browse	185.196.11.151
	202411070105F02558.exe	Get hash	malicious	AgentTesla	Browse	185.196.9.150
	Dekont.exe	Get hash	malicious	AgentTesla	Browse	185.196.9.150

Process:	C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.378486415808052
Encrypted:	false
SSDEEP:	48:fWSU4xc4RTmaoUeW+gZ9tK8NPZHUxL7u1iMuge//ZSUyus:fLHxcIalLgZ2KRHWLOug0s
MD5:	DF8A61AAA69C509EDF9D6ED37FE5F653
SHA1:	20675930F6DBD3A94FEB0DB772556A6DE71EB810
SHA-256:	41A60C51357812DAE797A2DE8EFA4F2F32BBD7AA3D52C2BE0B1B4DAE5D8FEB04
SHA-512:	A87FE08C009A59F31A86D18E1618B1F4848E153D4110EC1D7522B0E75DBC9F54E72A5355A464680E7D1730289C2CAC2CEAA51025A37FFE64EEB2C0B903427FB4
Malicious:	false
Reputation:	low
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.ConfigurationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.4.................%...K... ...........System.Xml..<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d0dbsulo.u3m.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qsxq2hny.2fm.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sgzowy5q.hul.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y42fq5rc.dbl.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.829230310237872
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	z81zEuzkJPHHV3KYua.exe
File size:	768'000 bytes
MD5:	1b4a6383c2a9b4fd9d1c2ba270800a49
SHA1:	ae5c4b7b0a37b4d1c8b65d13417257b29cd2188e
SHA256:	cd60ea86b574b6b511ce6a6aff1314ce71b1953e169792e3e76a36913e85ea23
SHA512:	7374bff7a913c972156a802096c57b91be8072362dc150dfb0e0e6ad3c0808774a029f1f98f0004c86b0d4b2b76e95fce6811579b67c03cc15f5bee1b004ce6b
SSDEEP:	12288:Wq3wtfRzxWW8wNaTP+/CsM/b63zsWhvb2QlT1u3UqOsOJZUowJ9oIfSF:WqMpzxWnXPWCsM/bCXhvSQ3JZUjwIfS
TLSH:	A5F40111F6682BE2E42747FBEC21F2040B76BB5E986CEA092CB2B5C724717C26551D1F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....>g..............0.................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4bccca
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x673EF5B9 [Thu Nov 21 08:56:25 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbcc78	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xbe000	0x5f4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xbb398	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xbacd0	0xbae00	eccb3c2e7edfdd259ee24e0551ea57ba	False	0.8896242683946488	data	7.836147110785658	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xbe000	0x5f4	0x600	fa33e8dce3faaa152e2b361b1ccc2ea6	False	0.4388020833333333	data	4.179702165309303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc0000	0xc	0x200	fa061bbcc6f118d7e1cbe72603736907	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xbe090	0x364	data			0.4308755760368664
RT_MANIFEST	0xbe404	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 16:32:00.179482937 CET	49730	80	192.168.2.4	208.95.112.1
Nov 21, 2024 16:32:00.299408913 CET	80	49730	208.95.112.1	192.168.2.4
Nov 21, 2024 16:32:00.299532890 CET	49730	80	192.168.2.4	208.95.112.1
Nov 21, 2024 16:32:00.313143969 CET	49730	80	192.168.2.4	208.95.112.1
Nov 21, 2024 16:32:00.432797909 CET	80	49730	208.95.112.1	192.168.2.4
Nov 21, 2024 16:32:01.442471027 CET	80	49730	208.95.112.1	192.168.2.4
Nov 21, 2024 16:32:01.493016958 CET	49730	80	192.168.2.4	208.95.112.1
Nov 21, 2024 16:32:02.456996918 CET	49731	587	192.168.2.4	185.196.9.150
Nov 21, 2024 16:32:02.576649904 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:02.576728106 CET	49731	587	192.168.2.4	185.196.9.150
Nov 21, 2024 16:32:04.345866919 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:04.346059084 CET	49731	587	192.168.2.4	185.196.9.150
Nov 21, 2024 16:32:04.465820074 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:04.764287949 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:04.768018007 CET	49731	587	192.168.2.4	185.196.9.150
Nov 21, 2024 16:32:04.887665033 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:05.200898886 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:05.213627100 CET	49731	587	192.168.2.4	185.196.9.150
Nov 21, 2024 16:32:05.333206892 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:05.660715103 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:05.660761118 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:05.660810947 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:05.660851955 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:05.660851002 CET	49731	587	192.168.2.4	185.196.9.150
Nov 21, 2024 16:32:05.660901070 CET	49731	587	192.168.2.4	185.196.9.150
Nov 21, 2024 16:32:05.873431921 CET	49731	587	192.168.2.4	185.196.9.150
Nov 21, 2024 16:32:05.993218899 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:06.300076962 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:06.319760084 CET	49731	587	192.168.2.4	185.196.9.150
Nov 21, 2024 16:32:06.439683914 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:06.741228104 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:06.747594118 CET	49731	587	192.168.2.4	185.196.9.150
Nov 21, 2024 16:32:06.867398024 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:07.168379068 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:07.168816090 CET	49731	587	192.168.2.4	185.196.9.150
Nov 21, 2024 16:32:07.288722038 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:07.590013981 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:07.590339899 CET	49731	587	192.168.2.4	185.196.9.150
Nov 21, 2024 16:32:07.710128069 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:08.008692026 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:08.009001970 CET	49731	587	192.168.2.4	185.196.9.150
Nov 21, 2024 16:32:08.128716946 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:08.431169033 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:08.432933092 CET	49731	587	192.168.2.4	185.196.9.150
Nov 21, 2024 16:32:08.552661896 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:08.865885973 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:08.866421938 CET	49731	587	192.168.2.4	185.196.9.150
Nov 21, 2024 16:32:08.866502047 CET	49731	587	192.168.2.4	185.196.9.150
Nov 21, 2024 16:32:08.866502047 CET	49731	587	192.168.2.4	185.196.9.150
Nov 21, 2024 16:32:08.866502047 CET	49731	587	192.168.2.4	185.196.9.150
Nov 21, 2024 16:32:08.986164093 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:08.986180067 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:08.986210108 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:08.986274958 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:09.399231911 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:32:09.446223974 CET	49731	587	192.168.2.4	185.196.9.150
Nov 21, 2024 16:32:52.196597099 CET	49730	80	192.168.2.4	208.95.112.1
Nov 21, 2024 16:32:52.318279982 CET	80	49730	208.95.112.1	192.168.2.4
Nov 21, 2024 16:32:52.318356991 CET	49730	80	192.168.2.4	208.95.112.1
Nov 21, 2024 16:33:42.212449074 CET	49731	587	192.168.2.4	185.196.9.150
Nov 21, 2024 16:33:42.333004951 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:33:42.999906063 CET	587	49731	185.196.9.150	192.168.2.4
Nov 21, 2024 16:33:43.004627943 CET	49731	587	192.168.2.4	185.196.9.150

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 16:31:59.982880116 CET	49442	53	192.168.2.4	1.1.1.1
Nov 21, 2024 16:32:00.119865894 CET	53	49442	1.1.1.1	192.168.2.4
Nov 21, 2024 16:32:02.188668966 CET	59863	53	192.168.2.4	1.1.1.1
Nov 21, 2024 16:32:02.456295013 CET	53	59863	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 16:31:59.982880116 CET	192.168.2.4	1.1.1.1	0x4c78	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 16:32:02.188668966 CET	192.168.2.4	1.1.1.1	0x94b2	Standard query (0)	mail.apexrnun.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 16:32:00.119865894 CET	1.1.1.1	192.168.2.4	0x4c78	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Nov 21, 2024 16:32:02.456295013 CET	1.1.1.1	192.168.2.4	0x94b2	No error (0)	mail.apexrnun.com		185.196.9.150	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	208.95.112.1	80	7476	C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 16:32:00.313143969 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Nov 21, 2024 16:32:01.442471027 CET	175	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 15:32:00 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 21, 2024 16:32:04.345866919 CET	587	49731	185.196.9.150	192.168.2.4	220 cp.apexrnun.com
Nov 21, 2024 16:32:04.346059084 CET	49731	587	192.168.2.4	185.196.9.150	EHLO 618321
Nov 21, 2024 16:32:04.764287949 CET	587	49731	185.196.9.150	192.168.2.4	250-cp.apexrnun.com Hello 618321 [8.46.123.75] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-CHUNKING 250-STARTTLS 250 HELP
Nov 21, 2024 16:32:04.768018007 CET	49731	587	192.168.2.4	185.196.9.150	STARTTLS
Nov 21, 2024 16:32:05.200898886 CET	587	49731	185.196.9.150	192.168.2.4	220 TLS go ahead

Target ID:	0
Start time:	10:31:57
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe"
Imagebase:	0x590000
File size:	768'000 bytes
MD5 hash:	1B4A6383C2A9B4FD9D1C2BA270800A49
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1698165840.0000000003999000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1698165840.0000000003999000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:31:58
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe"
Imagebase:	0x210000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:31:58
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe"
Imagebase:	0xa10000
File size:	768'000 bytes
MD5 hash:	1B4A6383C2A9B4FD9D1C2BA270800A49
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2938171995.0000000002E2D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2938171995.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2935688677.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2935688677.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2938171995.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2938171995.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	10:31:58
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:32:00
Start date:	21/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	42
Total number of Limit Nodes:	1

Executed Functions

Function 04EC67E0 Relevance: .7, Instructions: 653COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709291240.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d3a732f28fa52c753db54cdfbab681b5c3edb4e76b9656e0234dd7fadcb77e3
Instruction ID: 22fa157eac9553a732472fc07e540e733bb05cc469307d01220b9bd33ac2cee4
Opcode Fuzzy Hash: 1d3a732f28fa52c753db54cdfbab681b5c3edb4e76b9656e0234dd7fadcb77e3
Instruction Fuzzy Hash: 4962C774A00218CFDB14DF79C984A9EBBB2FF89304F2195A9D409AB365DB30AD85CF51

Function 04EC67D3 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709291240.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac981ac1f2742fe71e6eca6e6a588858142eb66d406cc6a8ed5f4b60c3538558
Instruction ID: 8ffb0c4751b771ed0b0e692547012c0c1b192d3f908d6dcea90eea08695230e6
Opcode Fuzzy Hash: ac981ac1f2742fe71e6eca6e6a588858142eb66d406cc6a8ed5f4b60c3538558
Instruction Fuzzy Hash: 8B52B574A00218CFDB24DF79C994A9EBBB2FF89304F1095A9D409AB365DB30AD85CF41

Function 00C9AD48 Relevance: 1.7, APIs: 1, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C9AF9E

Memory Dump Source

Source File: 00000000.00000002.1696142959.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4fb28cabee308bc5efe92a87e8b38510876d8e482c792673b70a0324aecc375b
Instruction ID: db94681f780f4e055abc2aa8d1db8a3a5bc7fccec276891227be7dd6faebc2c2
Opcode Fuzzy Hash: 4fb28cabee308bc5efe92a87e8b38510876d8e482c792673b70a0324aecc375b
Instruction Fuzzy Hash: AB818870A00B458FDB24DF2AD04975ABBF1FF88304F10892ED09ADBA51D735E949CB91

Function 00C944B0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00C959C9

Memory Dump Source

Source File: 00000000.00000002.1696142959.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 1cedb095c6499c69e4639e2d2aed076e9ac28071b3af6ed0f9113b4aa08830c7
Instruction ID: 2b8fdf37e56b770cb1b6155edbc2ed1620a3633ab5afb8c93ed807b44f026d7d
Opcode Fuzzy Hash: 1cedb095c6499c69e4639e2d2aed076e9ac28071b3af6ed0f9113b4aa08830c7
Instruction Fuzzy Hash: 6041E2B0C0065DCBDF24DFAAC885B9DBBF5BF89304F20816AD409AB251DB756945CF90

Function 00C9590C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00C959C9

Memory Dump Source

Source File: 00000000.00000002.1696142959.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 392ce7d9540d326f121931761699f510211073deca21b14596633549d3a9a31b
Instruction ID: c7aceba4574ecc83bc746d4f26068dfe2d0515928b4d5c31aa369d6d7e6369b5
Opcode Fuzzy Hash: 392ce7d9540d326f121931761699f510211073deca21b14596633549d3a9a31b
Instruction Fuzzy Hash: 3941F3B0C00619CBDF24DFAAC884BDDBBB1BF88314F20816AD419AB251DB756945CF50

Function 04EC4040 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04EC4101

Memory Dump Source

Source File: 00000000.00000002.1709291240.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: daa48ef31ab3927c7649c34375de5f100fd0db3761d3ef1c75e96ae07a35e48e
Instruction ID: 9a993334f0c378f5d6226da7eb26780504851f74d678c3677e7791ab84864118
Opcode Fuzzy Hash: daa48ef31ab3927c7649c34375de5f100fd0db3761d3ef1c75e96ae07a35e48e
Instruction Fuzzy Hash: C14157B4A00309DFDB14CF89C949AAABBF5FF88314F24855CD519AB361D334A841CFA1

Function 00C9D628 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00C9D5F6,?,?,?,?,?), ref: 00C9D6B7

Memory Dump Source

Source File: 00000000.00000002.1696142959.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1f4ed72f4a42f8d621814b793550c32a48191dabf07fa3ef3353cb28776f4495
Instruction ID: 7f2e936f411ed507c9b96595708890e4899dc70703d099fe57456d9d7359a1d6
Opcode Fuzzy Hash: 1f4ed72f4a42f8d621814b793550c32a48191dabf07fa3ef3353cb28776f4495
Instruction Fuzzy Hash: 102157B58002499FDB10CFAAD944ADEFFF4EB49320F14851AE959A7250C378A940CFA0

Function 00C9D21C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00C9D5F6,?,?,?,?,?), ref: 00C9D6B7

Memory Dump Source

Source File: 00000000.00000002.1696142959.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5d0c85abb4c572dd57ea9c02a78f6d5596c885b2bd5360deb11e9b8bc4d8b189
Instruction ID: 8cc15db7c67c92a785d8a07590db46b5b01b92da1016c0cf9373395d10ae66b4
Opcode Fuzzy Hash: 5d0c85abb4c572dd57ea9c02a78f6d5596c885b2bd5360deb11e9b8bc4d8b189
Instruction Fuzzy Hash: BB2105B5900248DFDB10CF9AD984AEEFBF4EB48320F14841AE919B7310D374A940CFA4

Function 00C9AF38 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C9AF9E

Memory Dump Source

Source File: 00000000.00000002.1696142959.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e2ee08af7cd6af329933975661c7d8d918dca438e450fd3ad6eaad6361404f80
Instruction ID: 78348be8a8bfed38f725296feeb503d93aa82905935f30bf276ade3bc182a5c2
Opcode Fuzzy Hash: e2ee08af7cd6af329933975661c7d8d918dca438e450fd3ad6eaad6361404f80
Instruction Fuzzy Hash: DD11E0B6C006498FDB10CF9AD944ADEFBF4EF88324F14845AD829A7210D379A545CFA1

Function 00BED3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695702061.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bed000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4c315dc579dbac1243fd8a174cb861289beb42a6236edf5823c72e007ed5ff8
Instruction ID: a2e00a5d847812ffbffef8702873a6f71d301d0217b3b7380e505f22f65b3f50
Opcode Fuzzy Hash: c4c315dc579dbac1243fd8a174cb861289beb42a6236edf5823c72e007ed5ff8
Instruction Fuzzy Hash: 822136B1500284DFDB01DF05C9C0B16BFF5FBA8314F24C6A8E9090B396C376E806C6A2

Function 00BED110 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695702061.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bed000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225ac8680ea9d22038ab2aa7370f3ee1a7198e4fa00a60de84feee316da13f77
Instruction ID: 9411d247a65b9f297febccf77e1f700e8d7f734662c3d8d365ade3e907f603a3
Opcode Fuzzy Hash: 225ac8680ea9d22038ab2aa7370f3ee1a7198e4fa00a60de84feee316da13f77
Instruction Fuzzy Hash: 85212571504280DFDB05DF15D9C0B26BFA6FB98310F2485ADE9091B256C376D816C6A2

Function 00BFD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695769010.0000000000BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bfd000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94e188d2daafe2876d291f21b7141faf0ede03da5e7dadc505ac2d433229684c
Instruction ID: 933e5bad3e405fb6e22fff9f56896c325f5bfeed4c9a9b3e5b432ee5ad8152d6
Opcode Fuzzy Hash: 94e188d2daafe2876d291f21b7141faf0ede03da5e7dadc505ac2d433229684c
Instruction Fuzzy Hash: 53210771504248DFDB14DF24D5D0B26BBE6FB88314F24C5ADEA094B256CB36D80BCA61

Function 00BFD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695769010.0000000000BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bfd000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53c1ef54d9623ee2bf74317c554c7fbbfbd4f5e7e4c36261eae05a4d691be910
Instruction ID: 17e406f3236f3b5bbe21a68067a0857ece2e527c4431a04724ad536d10333411
Opcode Fuzzy Hash: 53c1ef54d9623ee2bf74317c554c7fbbfbd4f5e7e4c36261eae05a4d691be910
Instruction Fuzzy Hash: C9212971604208DFDB05DF14D5C0B36BBE6FB88314F24C9ADEA094B255C336D80ACAA1

Function 00BFD006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695769010.0000000000BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bfd000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c8b3e3e2158356c8b6cc89bea4056bad1333851170a289c5ab15570cbd2eec9
Instruction ID: 8fe24c5ee6d1dfdc95ea9cfc884dbf382bfecf5cb6ec5be8c96c547f3b436203
Opcode Fuzzy Hash: 6c8b3e3e2158356c8b6cc89bea4056bad1333851170a289c5ab15570cbd2eec9
Instruction Fuzzy Hash: 3D21C675509384CFDB16CF20D590B15BFB2EB45314F28C5EAD9498B297C33AD80ACB62

Function 00BED3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695702061.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bed000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction ID: c552d5902361cdc45bfb43761d31dd253942fa1adb8168ac0e760c590e6df632
Opcode Fuzzy Hash: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction Fuzzy Hash: 25110376504280CFDB12CF00D5C0B16BFB1FBA4324F24C2A9D9090B356C33AE85ACBA1

Function 00BED10B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695702061.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bed000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction ID: 7af6ffd0c04015fcda62fb2c75a6c711f85ccb8012293ae0a0f6ed49af65d45d
Opcode Fuzzy Hash: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction Fuzzy Hash: 4D11D376504280CFDB16CF10D9C4B16BFB2FB94314F24C6A9DD094B256C37AD85ACBA2

Function 00BFD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695769010.0000000000BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bfd000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bad08bc3297c4791243414a9a82218353e3075920b51f23bb46501d1989d77c
Instruction ID: 2f2071383be799c768400c3d0e53fb4ec7fe7fc90d2d5c7ff07a404862873e71
Opcode Fuzzy Hash: 8bad08bc3297c4791243414a9a82218353e3075920b51f23bb46501d1989d77c
Instruction Fuzzy Hash: A211DD75504284DFDB12CF10C5C0B25FBB2FB84314F24C6AED9494B296C33AD80ACBA1

Function 00BED759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695702061.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bed000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c5f2f2fea78d314ce857ca599d2ce301c4446e84b067de398b3db7abbea1710
Instruction ID: fcc6bde87d3064c4eaeff5e1ec9ca4f0053754b3264a9948ca001accb920a3a7
Opcode Fuzzy Hash: 9c5f2f2fea78d314ce857ca599d2ce301c4446e84b067de398b3db7abbea1710
Instruction Fuzzy Hash: 9501DB715043809AE7209B17DCC4B67FFE8DF55720F18C99AED094E286C3B99C40C671

Function 00BED758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695702061.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bed000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 394d23e30356f8ce141fa5c2574319ab23eb75cbb5bc8f56e4ca4bc40225330e
Instruction ID: 96589e9bdd0c5ed16a981662dcc0b8aaad9c75e94af17e6114ddf2c1d4b1c44b
Opcode Fuzzy Hash: 394d23e30356f8ce141fa5c2574319ab23eb75cbb5bc8f56e4ca4bc40225330e
Instruction Fuzzy Hash: 7EF06272404384AEE7208B16DD84B66FFE8EF51734F18C55AED084F286C379AC44CAB1

Non-executed Functions

Function 04ECEC40 Relevance: 6.7, Strings: 5, Instructions: 453COMMON

Download Yara Rule

Strings

(otq, xrefs: 04ECF0E1
Hxq, xrefs: 04ECF158
(otq, xrefs: 04ECF0EB
,xq, xrefs: 04ECEE7F
,xq, xrefs: 04ECEE6F

Memory Dump Source

Source File: 00000000.00000002.1709291240.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID: (otq$(otq$,xq$,xq$Hxq
API String ID: 0-2200704163
Opcode ID: 99175b2c6dc12f7bcccd301fe48216731b3142a64328d50abaff118cd735aa15
Instruction ID: 611f40f515c7e5a509e7cf257559074f91c9a58561a66a3cbfa53f5518ea8dca
Opcode Fuzzy Hash: 99175b2c6dc12f7bcccd301fe48216731b3142a64328d50abaff118cd735aa15
Instruction Fuzzy Hash: AF025974A00114CFDB58CF69C689AADBBB2BF88754B159169E8169B3B1DB31FC02CB50

Function 04EC0040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709291240.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d505044cf24a9a9b18008dcc18dbdb46ffce37a4b48888edd9a99ab08a481379
Instruction ID: 4a38ec2a5a49c31cdab4331152fb7c25d82c715c4668fd758876c5b610998790
Opcode Fuzzy Hash: d505044cf24a9a9b18008dcc18dbdb46ffce37a4b48888edd9a99ab08a481379
Instruction Fuzzy Hash: D11285F0481785AAE710CF66E84D18A7BB1F7C531AF904649D2612F2F9DBBC198ACF44

Function 00C9D55C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1696142959.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 280f02ed3cc4ae1319b7513ca951cb8519d9fa5110a401f90233593509e36cae
Instruction ID: e32d58eac7d602eecdd307f457faaa3fca84cb8abf1c69f72ce18e103c4779bb
Opcode Fuzzy Hash: 280f02ed3cc4ae1319b7513ca951cb8519d9fa5110a401f90233593509e36cae
Instruction Fuzzy Hash: 7AA13C32A00205CFCF05DFA5C84499EB7B2FF85301B25857EE816EB265DB75EA56CB80

Function 04EC001F Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709291240.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8eb9f1a1ff7925d0563861d153fc883bdd5ffcef706e1c05d26fc46c535af2
Instruction ID: 51af30f1ba832062ce845a6238febb53da4e9d51d65de8b2ab234327591914d0
Opcode Fuzzy Hash: 2a8eb9f1a1ff7925d0563861d153fc883bdd5ffcef706e1c05d26fc46c535af2
Instruction Fuzzy Hash: FBC1F8F0880785ABD714CF66E84818A7BB1FBC5316F614649D1616F2F9DBBC188ACF44

Function 04ECC154 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709291240.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4c308c9d87d1127a326b8a435d33a5863abea584d84cedfd913d56f0904198b
Instruction ID: 8b4e61f3768f552c1173a88dc582b464cfd19105952d186a4fc3948a9342bdb5
Opcode Fuzzy Hash: a4c308c9d87d1127a326b8a435d33a5863abea584d84cedfd913d56f0904198b
Instruction Fuzzy Hash: 0D51DAB5E002099FDB04DFADC980AAEBBF2FF88310F14D569E518E7254D734A941CB60

Function 04ECD789 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709291240.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35737348fa2e0fe9d337e5069ceb04921e76376566f4a306383099d233657438
Instruction ID: 256989892c2799b195576338b3a6927fee644de8a1807d63a89d922d659e6b69
Opcode Fuzzy Hash: 35737348fa2e0fe9d337e5069ceb04921e76376566f4a306383099d233657438
Instruction Fuzzy Hash: 0F51ECB5E006499FDB04DFA9C980AAEBBF2FF88300F14D569D414E7255D734EA42CB60

Analysis Process: z81zEuzkJPHHV3KYua.exePID: 7476, Parent PID: 7404COMMON

Execution Graph

Execution Coverage:	11.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.6%
Total number of Nodes:	191
Total number of Limit Nodes:	12

Executed Functions

Function 06952350 Relevance: 9.0, Strings: 6, Instructions: 1479COMMON

Download Yara Rule

Strings

$tq, xrefs: 06953733
$tq, xrefs: 06953780
$tq, xrefs: 06953750
$tq, xrefs: 0695375C
$tq, xrefs: 06953774
$tq, xrefs: 06953727

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq$$tq$$tq
API String ID: 0-2574395493
Opcode ID: a2fdbb873855fbab4692d287fc65420a78ce1dfd545b14efdd541153a87d27c6
Instruction ID: b59abc762515bb56f624af25f08b3e91023f0c31547820349e56b8015bfdddf6
Opcode Fuzzy Hash: a2fdbb873855fbab4692d287fc65420a78ce1dfd545b14efdd541153a87d27c6
Instruction Fuzzy Hash: 48D23B30E002098FCB64DF64C594A9DB7B6FF89310F65C96AD809AB755EB30ED85CB80

Function 0695B208 Relevance: 8.3, Strings: 6, Instructions: 762COMMON

Download Yara Rule

Strings

$tq, xrefs: 0695BBC9
$tq, xrefs: 0695BB95
$tq, xrefs: 0695BB6D
$tq, xrefs: 0695BBD5
$tq, xrefs: 0695BB61
$tq, xrefs: 0695BBA1

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq$$tq$$tq
API String ID: 0-2574395493
Opcode ID: 58df2e60e6c0c355fc54d9a680ac23a386f2c49a96e3d6301a58a3be4bf8f88f
Instruction ID: 431cb264a891abff75b5a9dfaf1701ca79cf4e82cefd7c378543040acee9a23e
Opcode Fuzzy Hash: 58df2e60e6c0c355fc54d9a680ac23a386f2c49a96e3d6301a58a3be4bf8f88f
Instruction Fuzzy Hash: A4527170E102098FDFA4DF69D4A07ADB7B6EB85310F21852AE805EB759DB34DC81CB91

Function 06957D50 Relevance: 3.0, Strings: 2, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$tq, xrefs: 06958099
$tq, xrefs: 0695808D

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID: $tq$$tq
API String ID: 0-1837209516
Opcode ID: 1ded0d3b1bb7c18cdb3f6c017ae53ab9b5f27fff505f4f3347aa351de5041ca1
Instruction ID: adb6ad742ff277740f5a765d523889cc8d6520352ed1581b28ec1740598c1325
Opcode Fuzzy Hash: 1ded0d3b1bb7c18cdb3f6c017ae53ab9b5f27fff505f4f3347aa351de5041ca1
Instruction Fuzzy Hash: 0C02BF30B102159FDF54DB75D9446AEB7A6FF84310F218929E806DB755EB31ED42CB80

Function 06955568 Relevance: 1.8, Strings: 1, Instructions: 589
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 069558B3

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: a2980aa20fcf3d45e0915e96f3496ab3ee1f4f2bf4b052c2fd9c297c03499f59
Instruction ID: bbc2d8174c42b65a0802d95ae6d87441a20d3fbdbe3be052ddbefa2f1745a359
Opcode Fuzzy Hash: a2980aa20fcf3d45e0915e96f3496ab3ee1f4f2bf4b052c2fd9c297c03499f59
Instruction Fuzzy Hash: 3222DF71E002158FDF64DBA4C4806AEBBB6FF88310F26846AD806EB756DB31DC45CB90

Function 02BF70A0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 02BF7117

Memory Dump Source

Source File: 00000002.00000002.2937514401.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2bf0000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: b5b740576f6639d7f8971a0d894e769af6bc4e6ac98f8f503cca8370c8a173e1
Instruction ID: aded309db1c83f251ff39fe01472d6f5ba5c2edc1514bde3f1d62951f915d085
Opcode Fuzzy Hash: b5b740576f6639d7f8971a0d894e769af6bc4e6ac98f8f503cca8370c8a173e1
Instruction Fuzzy Hash: F02139B1800259CFDB10CF9AD884BEEFBF8EF49324F14846AE455A7250D778A944CF61

Function 069565C0 Relevance: .8, Instructions: 813COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9362c741389556ad25f8fd0c7c2232cf9f805ca0818ab8feb7174d78759246ef
Instruction ID: 145aae6358a31e6cec6d0a5028c5d2fd184827a5a10a91825049c68764be604f
Opcode Fuzzy Hash: 9362c741389556ad25f8fd0c7c2232cf9f805ca0818ab8feb7174d78759246ef
Instruction Fuzzy Hash: B562AB34B002058FCF54DB68D594AADB7F6EF88310F658869E806EB765DB31ED42CB80

Function 0695C148 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a26e091d287c35fde4f22fcc1fd64d63bb3936bf16c006b681b88b3c65b01fc2
Instruction ID: 57bc450f836ab5bb1f46202368bea4e987446b63ccc17636bd9c62f47a57b03b
Opcode Fuzzy Hash: a26e091d287c35fde4f22fcc1fd64d63bb3936bf16c006b681b88b3c65b01fc2
Instruction Fuzzy Hash: 19327D75B10209CFDF54DB68D890BADB7B6EB88310F218529E806EB755DB35EC42CB90

Function 0695ACA0 Relevance: 10.4, Strings: 8, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$tq, xrefs: 0695ADCD
$tq, xrefs: 0695AE4F
$tq, xrefs: 0695ADC1
$tq, xrefs: 0695AE78
$tq, xrefs: 0695AE20
$tq, xrefs: 0695AE6C
$tq, xrefs: 0695AE43
$tq, xrefs: 0695AE14

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq$$tq$$tq$$tq$$tq
API String ID: 0-3970889292
Opcode ID: b682bb2ba4e196bbb72dc5220a2165d38b9fd6ca73a0480ffaad1d6094ee871b
Instruction ID: 2973ac9c4b1f32ad576212b402756e0b7d111815b2d32fc97abefa1e8e491bbf
Opcode Fuzzy Hash: b682bb2ba4e196bbb72dc5220a2165d38b9fd6ca73a0480ffaad1d6094ee871b
Instruction Fuzzy Hash: 48E18170E1020A8FCF55DB69D4946AEB7B6FF88310F218A29D805AB755DB30DC46CB91

Function 06959120 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$tq, xrefs: 06959173
$tq, xrefs: 069591AE
$tq, xrefs: 069591A2
$tq, xrefs: 06959167

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq
API String ID: 0-173548568
Opcode ID: 86de6a1c9d36632d702f4d1675c671627624ed2f7a8af7db7d4ac8d982b832f7
Instruction ID: 4bf0dc3f38db5c94537078cea32255d5e877cd0c31fa0e58a23674a7fbe75616
Opcode Fuzzy Hash: 86de6a1c9d36632d702f4d1675c671627624ed2f7a8af7db7d4ac8d982b832f7
Instruction Fuzzy Hash: 3A913070F1021E8FDF94DF65D9507AEB7F6AB88640F608569D80AAB344EA30DD428B91

Function 0695CF18 Relevance: 4.5, Strings: 3, Instructions: 799
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$tq, xrefs: 0695D317
$tq, xrefs: 0695D323
$tq, xrefs: 0695D30F

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq
API String ID: 0-2863945821
Opcode ID: 8de5f9aa234f247e26f6653f5c2de9433fb80d46f9fb1915c960f465ebe6e698
Instruction ID: efc2c1df1bd6f48022fa42c51da1f8ec3673978b12304a2e327b2e440639b5c7
Opcode Fuzzy Hash: 8de5f9aa234f247e26f6653f5c2de9433fb80d46f9fb1915c960f465ebe6e698
Instruction Fuzzy Hash: 65628270B0020A8FCB55EF79D590A5EB7B2FF85304B218A28D4069F759EB31ED46CB81

Function 06959112 Relevance: 2.7, Strings: 2, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$tq, xrefs: 069591A2
$tq, xrefs: 06959167

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID: $tq$$tq
API String ID: 0-1837209516
Opcode ID: 42e79a3ff6e4a59fc0e7b39ef9cceae9d3a34cdf859968f11258c7477d5c3b78
Instruction ID: 1364884a4c95628ab131fb3c6f2c4fcd944a20307fee68c51cf17748eedfc80d
Opcode Fuzzy Hash: 42e79a3ff6e4a59fc0e7b39ef9cceae9d3a34cdf859968f11258c7477d5c3b78
Instruction Fuzzy Hash: D6514270F0011A9FDF54DB75D950B6EB7FAEB88650F208569D80AEB758EA30DC028B91

Function 0694B9C8 Relevance: 1.7, APIs: 1, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2942573556.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6940000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: eb38a25ea7f75f707a924a8891c1de8fa28ec339dc1fd9f616be9c0d3eccf44d
Instruction ID: cb085a36eca366e416ac872f68bc98ed719ab8c7277cff22cb591ba1c5b26d98
Opcode Fuzzy Hash: eb38a25ea7f75f707a924a8891c1de8fa28ec339dc1fd9f616be9c0d3eccf44d
Instruction Fuzzy Hash: 59814570A10B458FDBA4EF2AD440B5ABBF5FF88314F108A2DD48AD7A44D775E845CB90

Function 02BFF0B0 Relevance: 1.6, APIs: 1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2937514401.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2bf0000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a808b3fcdbc7ad052d2ac741fd0960b57b76c3bad47795a6bc4cea203b0811c
Instruction ID: 197e528d870a9e3e50a6a1278b3621c63b01fee5384d5c1d4d56797b6611317a
Opcode Fuzzy Hash: 2a808b3fcdbc7ad052d2ac741fd0960b57b76c3bad47795a6bc4cea203b0811c
Instruction Fuzzy Hash: BF412872E143998FCB00CFB9D8146EEBBF5EF89310F18866AD504E7681DB749944CB91

Function 0694DBA4 Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0694DCC2

Memory Dump Source

Source File: 00000002.00000002.2942573556.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6940000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 28e3cfeffe6ade7c9788ee732e26382176fc51f34d38a5f6b628097dcd345e4d
Instruction ID: c824070a1a3bff8ca8344b08bbce0d24dcf49099921396463952a79586a3fc71
Opcode Fuzzy Hash: 28e3cfeffe6ade7c9788ee732e26382176fc51f34d38a5f6b628097dcd345e4d
Instruction Fuzzy Hash: 8C51B0B5D10349DFDF14DFA9C884ADEBBB5BF88310F24852AE819AB210D7759845CF90

Function 0694DBB0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0694DCC2

Memory Dump Source

Source File: 00000002.00000002.2942573556.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6940000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b26385c205bba0a3f083c378d2fbed8716463bca54e685c47b0a83eb26e40cb0
Instruction ID: 8b5e4f156ba3e4267092f9da8d0487015d3f67df9bf81cbed0cefdf493d37204
Opcode Fuzzy Hash: b26385c205bba0a3f083c378d2fbed8716463bca54e685c47b0a83eb26e40cb0
Instruction Fuzzy Hash: 9E41B0B5D10349DFDF14DF99C884ADEBBB5BF88310F24852AE819AB210D7759845CF90

Function 07120C70 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 07120D31

Memory Dump Source

Source File: 00000002.00000002.2943083536.0000000007120000.00000040.00000800.00020000.00000000.sdmp, Offset: 07120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7120000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: d63c3c298ca2f8b4ee29dc419c123d67a3ad97d99c2fab37fbb6e77ef0d661ae
Instruction ID: a55f76b655139bcd3c4c8da1e69359897443b6c54789b1ba8f77c69fcf4c4150
Opcode Fuzzy Hash: d63c3c298ca2f8b4ee29dc419c123d67a3ad97d99c2fab37fbb6e77ef0d661ae
Instruction Fuzzy Hash: C14138B4900259CFCB14CF99C448A9ABBF5FF8C314F248959D419AB361C734E841CFA0

Function 02BF7099 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 02BF7117

Memory Dump Source

Source File: 00000002.00000002.2937514401.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2bf0000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 481938d699cc3b719fedd68c50701bad1af079bd57aec3bfc13d40c5456909af
Instruction ID: d0f1f3773731cf89739bf4a7984509fffba8cfafdf4799a267cafd88a9f97e94
Opcode Fuzzy Hash: 481938d699cc3b719fedd68c50701bad1af079bd57aec3bfc13d40c5456909af
Instruction Fuzzy Hash: 542125B18002598FCB10CF9AD884BEEBBF8EF49320F14846AE454A7250C778A944CF61

Function 069436D0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0694375F

Memory Dump Source

Source File: 00000002.00000002.2942573556.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6940000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 221442b6a0afa9f5f36cc411350db6ec3b22f95a62df73f51cc393ed2fe002af
Instruction ID: 15b5214a33b16c84084925a4bef3861bb344a65995f43d7c585cad00e6600af0
Opcode Fuzzy Hash: 221442b6a0afa9f5f36cc411350db6ec3b22f95a62df73f51cc393ed2fe002af
Instruction Fuzzy Hash: D72114B5C00258DFDB10DFAAD884AEEBBF4FB48320F24801AE914A3310D374A940CF61

Function 069436D8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0694375F

Memory Dump Source

Source File: 00000002.00000002.2942573556.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6940000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8a0fdb136bd2e32b995f55023580144b05912bc5e63653c5f57cecf3a200a3ea
Instruction ID: 6880a0a97a682b6dae00e8e5ba4e2e5aa93f153ce63b9c3ab82bf925db1f740a
Opcode Fuzzy Hash: 8a0fdb136bd2e32b995f55023580144b05912bc5e63653c5f57cecf3a200a3ea
Instruction Fuzzy Hash: 2C21C4B5D00248DFDB10CFAAD984ADEBBF8EB48320F14841AE954A7350D375A944CF65

Function 02BFF181 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 02BFF1EF

Memory Dump Source

Source File: 00000002.00000002.2937514401.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2bf0000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 669a96515b590bf22581665be50bd70489c0cfda61c43e516eda38b69e0cb64b
Instruction ID: c5d09687c908844b0ee4b83e900c264f99fc89c96fe4e9f4c0e3085457c8bce6
Opcode Fuzzy Hash: 669a96515b590bf22581665be50bd70489c0cfda61c43e516eda38b69e0cb64b
Instruction Fuzzy Hash: 681142B6C002598BCB10CF9AC544BEEFBF4FF48320F15816AD818B7240D378A9448FA1

Function 0694A968 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,0694B9E4), ref: 0694BC1E

Memory Dump Source

Source File: 00000002.00000002.2942573556.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6940000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: dc20d3a5d0c604edf92703573bf30185dbdd602a61927587c6d4a36e9a29da36
Instruction ID: be838c1fc6e09cab3251a3e158143f1bd39a374ee15a1c932b62b6e29f0b61a7
Opcode Fuzzy Hash: dc20d3a5d0c604edf92703573bf30185dbdd602a61927587c6d4a36e9a29da36
Instruction Fuzzy Hash: 141102B5C006498FCB10DF9AC884ADEFBF8EF88224F14846AD819A7614C379A545CFA1

Function 071232E0 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0712333D

Memory Dump Source

Source File: 00000002.00000002.2943083536.0000000007120000.00000040.00000800.00020000.00000000.sdmp, Offset: 07120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7120000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 29761b175717f9169e893c48a6efb098c65cbabac2a029c495f174e2c4e835c5
Instruction ID: eaa982b56df24799f9773163ae6efc4ba0cb55d2b0401afa5951ea0847d9f015
Opcode Fuzzy Hash: 29761b175717f9169e893c48a6efb098c65cbabac2a029c495f174e2c4e835c5
Instruction Fuzzy Hash: 671145B58042598FDB10DF9AD444BDEBBF8EB48320F148419D518A7240C779A544CFA5

Function 07122400 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0712333D

Memory Dump Source

Source File: 00000002.00000002.2943083536.0000000007120000.00000040.00000800.00020000.00000000.sdmp, Offset: 07120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7120000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 1592df1aed7680d22d36d60647d18045195606d137a34c2df204746c607ca07e
Instruction ID: 9edda96e6ccc91dca3f9a17fbb5fe3ff69b8f5da60f29b1e93c60ddc266350d6
Opcode Fuzzy Hash: 1592df1aed7680d22d36d60647d18045195606d137a34c2df204746c607ca07e
Instruction Fuzzy Hash: 6C1100B18042588FCB20DF9AD444B9EBBF8EB48320F24845AD529A7240C779AA44CFA5

Function 0695DAA0 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PHtq, xrefs: 0695DBE9

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID: PHtq
API String ID: 0-4170314142
Opcode ID: d0cdbd23692843b5b88c0303c6820b6b911353e29dbe44c5fc99e3776ae82b1f
Instruction ID: f41ee2ab89827f17486e65556ffdcc93146126f6d4e382c3f5da4ff4fd652e0a
Opcode Fuzzy Hash: d0cdbd23692843b5b88c0303c6820b6b911353e29dbe44c5fc99e3776ae82b1f
Instruction Fuzzy Hash: BE418E70E1420ADFDB64EF65D4546AEBBB7FF85300F214929E801EB640EB70D949CB85

Function 0695DA8D Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

PHtq, xrefs: 0695DBE9

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID: PHtq
API String ID: 0-4170314142
Opcode ID: bfdf4c303b3345a3758bc1bbafce056afadd04a59c3a5612e4ea0ba875249cd4
Instruction ID: 2b94094795fade2d1e900adec599c5a10e256fe542b0314286fd8b72cd875cb0
Opcode Fuzzy Hash: bfdf4c303b3345a3758bc1bbafce056afadd04a59c3a5612e4ea0ba875249cd4
Instruction Fuzzy Hash: 40418F70E042098FDB25EF65C4446AEBBB7FF85300F21492AE801EB640EB70D94ACB85

Function 069521B5 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

PHtq, xrefs: 06952303

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID: PHtq
API String ID: 0-4170314142
Opcode ID: f3e088aef184317e88f1feabda218c3a5bce60135ac5a231c60f07bf5b37fe0e
Instruction ID: 8b29ed7e223000c9bda4eb8b5d2a84a0890ed8e7e4b14880faf37b037fc2d5d4
Opcode Fuzzy Hash: f3e088aef184317e88f1feabda218c3a5bce60135ac5a231c60f07bf5b37fe0e
Instruction Fuzzy Hash: 38312275B002058FDF58DB74D55826E3BA6EF88200F254928D806EB385EF30CD46CB95

Function 069521C8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHtq, xrefs: 06952303

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID: PHtq
API String ID: 0-4170314142
Opcode ID: f57d41daaceca16f93f5a7b3a9f99cefa0c5d4f868516520652c89f0d8775cda
Instruction ID: 2b0a2dfbe428f6ba38b42f12dcf825a269aefa4ae9c5cfb5a95858991d0c13ab
Opcode Fuzzy Hash: f57d41daaceca16f93f5a7b3a9f99cefa0c5d4f868516520652c89f0d8775cda
Instruction Fuzzy Hash: 99310170B002058FDF58EB74D45466F7BE7AB88200F258928D806DB385EF31CD46CBA5

Function 0695FEA3 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

|, xrefs: 0695FF10

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 28ed3ec3759298466ac0f1f8692d6fe7623c76511cfe85a8a22cd464b087c959
Instruction ID: 1c91244a3d82479640b27386af2e288b2af11edb273c7cfc9d3e578934494c39
Opcode Fuzzy Hash: 28ed3ec3759298466ac0f1f8692d6fe7623c76511cfe85a8a22cd464b087c959
Instruction Fuzzy Hash: 7D21AE71B042108FDB55DF78880876DBBF1AF48710F0588AAE94ADB3A2DB349D04CB80

Function 0695FEC0 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

|, xrefs: 0695FF10

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: b835994d9d7500b14813c38db39605e423a8dca6815e1f89884f1624ad2c191c
Instruction ID: 454f759a9a87178b49b2f6048a2974f0ccf072987d5a89fc798a45736302c386
Opcode Fuzzy Hash: b835994d9d7500b14813c38db39605e423a8dca6815e1f89884f1624ad2c191c
Instruction Fuzzy Hash: 12115B71B002149FDB44EB789804B6EBBF5AF4C710F108869EA0AE77A1DB359D00DB94

Function 06954619 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Oyq, xrefs: 06954625

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID: \Oyq
API String ID: 0-44443374
Opcode ID: 0c610c15a2c25658a4fa7540abca7fd85edf9118426201a41bf7882959d1959d
Instruction ID: a01e4a4cd56d0ff250316ea426b938bd7c8e3e549bb7016abbf159e638b63b5d
Opcode Fuzzy Hash: 0c610c15a2c25658a4fa7540abca7fd85edf9118426201a41bf7882959d1959d
Instruction Fuzzy Hash: 06F0FE70A21219DFDB54DF90E859BAEBBB2FF84700F210519E402A7694CB701D85CB80

Function 0695B1FA Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d088525d297470522113bab7bb7fcbc064cc666dab90f7686679a3c1654ad911
Instruction ID: 35cac24909148133b72ba119fa7863bc04adad636c8d661132c0b28dbb2b2bcf
Opcode Fuzzy Hash: d088525d297470522113bab7bb7fcbc064cc666dab90f7686679a3c1654ad911
Instruction Fuzzy Hash: 7CA1B870F101098BDFA4DBADD4A07BEB7BAEB89310F714425E909EB799CA34DC818751

Function 069561C0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca464324454deb504717f302b8a8497f9217f5331f3229713f156b7f88e8ec94
Instruction ID: b41af05308c08e4e111657f43fd19b6166dcd8954b30f3bbaaa2409a14e87202
Opcode Fuzzy Hash: ca464324454deb504717f302b8a8497f9217f5331f3229713f156b7f88e8ec94
Instruction Fuzzy Hash: 3961B3B1F001214BCF549A7EC88066EBADBAFC4620B654439E80ADB374DE65EC4287D1

Function 06953E61 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df9a689447720f6229f0fca23465d7aecab89f891ecffeb2403533598badc624
Instruction ID: 1e153a09686856625276ea8827270c1b31fd0476cf7fc7da0d93bf71bd1ad023
Opcode Fuzzy Hash: df9a689447720f6229f0fca23465d7aecab89f891ecffeb2403533598badc624
Instruction Fuzzy Hash: 66815271B1020A8FDF98DF75D5547AEBBF6AF89300F218525E80AEB355EA30DC428B51

Function 06953E70 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab7f4347af6c4d89439a0a6b5776d432ca3f7d8fb0044bd3fe112c94bd9fd550
Instruction ID: 88a2acccb27572a0fe33cc32534c76d33ba83f9f613db6d2eaa6560a80d8e4b1
Opcode Fuzzy Hash: ab7f4347af6c4d89439a0a6b5776d432ca3f7d8fb0044bd3fe112c94bd9fd550
Instruction Fuzzy Hash: BD814371B1020A8FDF98DF75D5547AEBBF6AB89300F218525E80AEB355EB30DC418B51

Function 06954184 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d23fa0a88fbb07739b13007a6704244c2370c886c0ac18a61d9cf575d2e615bb
Instruction ID: 44eb501f1a826e7facb0468ba0440b5c63f31893165b5a2e04ef025716825061
Opcode Fuzzy Hash: d23fa0a88fbb07739b13007a6704244c2370c886c0ac18a61d9cf575d2e615bb
Instruction Fuzzy Hash: 1D915D70E102198BDF60CF69C880B9DB7B1FF89310F208699D549AB355EB70AD85CF91

Function 06954198 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c78fccd555900dd562d7f12a90a494af8981b17196650f2490f35708b781ef
Instruction ID: 974f856c7fa59d78aa8c94516d2e31bf9af13cd7c997cbe0a73564a069a5a03f
Opcode Fuzzy Hash: a3c78fccd555900dd562d7f12a90a494af8981b17196650f2490f35708b781ef
Instruction Fuzzy Hash: D2915D70E102198BDF64DFA5C880B9DB7B1FF89310F208699D509AB355DB70AD85CF90

Function 0695EAE0 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d13b933a08ea44942dbf751dc8cf18c40abdf95c88ecf215b3e8540fa6179a4
Instruction ID: a4fdcedae314de826410fed2298f2b98035e6be7e5ca6d46e5617061cb053c7b
Opcode Fuzzy Hash: 9d13b933a08ea44942dbf751dc8cf18c40abdf95c88ecf215b3e8540fa6179a4
Instruction Fuzzy Hash: C1713C71A002098FCB54DFA9D980AADBBF6FF88300F258469D406EB755DB31ED46CB40

Function 0695EAF0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d94d1fa757a6915be996b40cb33f97e0f3e186786521d4684aa8dc761c5ce1e8
Instruction ID: eb3677a89398c38252de4ae8163b33ae350b16f138b454c9a87f2abd56c9b018
Opcode Fuzzy Hash: d94d1fa757a6915be996b40cb33f97e0f3e186786521d4684aa8dc761c5ce1e8
Instruction Fuzzy Hash: A3713F71A002099FDB54EFA9D980AADBBF6FF88300F258429E406EB755DB31ED45CB50

Function 0695FC60 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 658212f7d880fe71dbde0a2e3c31ca85eadac109d3aae3c6c914c5a9f1c6ae78
Instruction ID: e07b82d94f5f363614d5a935284a41acf37814a1584ccaa9c09be69232d876be
Opcode Fuzzy Hash: 658212f7d880fe71dbde0a2e3c31ca85eadac109d3aae3c6c914c5a9f1c6ae78
Instruction Fuzzy Hash: 9951C231E00109DFCF64EB78E4586ADBBB6FB84321F21887AE906D7651DB319959CB80

Function 0695FA10 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3c49e46c8193a9a06b7c43050daf10a45e0c9edbc3aef78033fba3b87c406f8
Instruction ID: d1826f1965e2238f076bcc8752a79a6ee5fbcb8e55b46aa8b98b6c199e7e93fa
Opcode Fuzzy Hash: e3c49e46c8193a9a06b7c43050daf10a45e0c9edbc3aef78033fba3b87c406f8
Instruction Fuzzy Hash: 4C51E8B0B201049BEFA4A67CD86476F365ED788320F314426E90EC77D9DB79CC414B92

Function 0695FA0F Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8008d19d7367b424a76f3925514bfa590abe0761458e810ca913a505dedc62d2
Instruction ID: c0e59d9fa54c721a78db3aacd2752088d8cc9efbfce95b929cc3499477c88cc6
Opcode Fuzzy Hash: 8008d19d7367b424a76f3925514bfa590abe0761458e810ca913a505dedc62d2
Instruction Fuzzy Hash: F451E8B0B201049BEFA4A67CD8A476F365ED788320F31442AE90EC77D9CB79CC414B92

Function 0695FC50 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c913e015d88d675bac06177a2b1345aa56722e858a47dd2c990759265a0de860
Instruction ID: ccd3906ce9c359e5385dcc98843dd53d9e6c5696ed1ea88a800042fa31cdf7d8
Opcode Fuzzy Hash: c913e015d88d675bac06177a2b1345aa56722e858a47dd2c990759265a0de860
Instruction Fuzzy Hash: 2031F032A002059FCF19EB78E4481AEBBB6FF84311F618879E506D7651DF329859CB90

Function 0695D940 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8093137a85439a0a491f765d6a38db538f8002ea6d11d8b5cce735f289d3182
Instruction ID: 0c0b7138fc1a77e4977b36a616f757a6757ac9246624b12af03c83ee2187ef5a
Opcode Fuzzy Hash: b8093137a85439a0a491f765d6a38db538f8002ea6d11d8b5cce735f289d3182
Instruction Fuzzy Hash: 8331A971E1060A8BCF55DF69C4506DEBBB5FF85300F208919E845EB700EB71E946C781

Function 06952078 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eaaab890e7c99d343c6af1d6f08d1ef0fe02d5b69fb4db50dd6a21090618ff1
Instruction ID: 966743a6311bafcaf133146d3be604d0de97f23181cb48fee0da36e9fb5fd1db
Opcode Fuzzy Hash: 5eaaab890e7c99d343c6af1d6f08d1ef0fe02d5b69fb4db50dd6a21090618ff1
Instruction Fuzzy Hash: 4F315C71E106069BCB09CFA5D894A9EFBB6EF89340F108929E806E7744DB71E942CB50

Function 06952088 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f7b09bdf1e5d7bee4bb644e5df3c68496cb19e3cb62fbbc470a27763d033880
Instruction ID: 72e1ebc2ee8957bebb80693e3cc230cf98bbcae78b203eb47f7c80088b7dd47d
Opcode Fuzzy Hash: 9f7b09bdf1e5d7bee4bb644e5df3c68496cb19e3cb62fbbc470a27763d033880
Instruction Fuzzy Hash: 76316B71E106069BCB09CF65D89469FF7B6AF89340F208929E806EB744DB71A942CB40

Function 0695A378 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b2c7ec0fb2c5f04ea7b92ddad649c7eb31989cc7163959595068a92a118433c
Instruction ID: 67e28cd8378e8ffd4c1e74ca6a9b4d1101e01b72218bcc71493d9a7db5610def
Opcode Fuzzy Hash: 3b2c7ec0fb2c5f04ea7b92ddad649c7eb31989cc7163959595068a92a118433c
Instruction Fuzzy Hash: 2521F371F101184BDF94DABDD89079FB7AAE789714F20853AE50AE7740EA31DC028784

Function 06953A78 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a89e59907f79418ac6ee9e4f1e8f1312553baaa43f3f6cc5082aa599e4958849
Instruction ID: 9d83ba5992320c472aeaeba6ccb7470599f7f70c60c50575b7884172b3c8c37b
Opcode Fuzzy Hash: a89e59907f79418ac6ee9e4f1e8f1312553baaa43f3f6cc5082aa599e4958849
Instruction Fuzzy Hash: A2218E75F002299FDF54DFA9D880AAEBBF5EB48360F208129E905E7340E730D840CB90

Function 06953A69 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb6f78ca64dc07a5ffb45776cb561d02e8f05b2aa002b1587d1faa60d63b1b47
Instruction ID: f3cdfb3bf8e7915a470f1e72178da1ce276bfae73be82aafcf84b7bf8024e030
Opcode Fuzzy Hash: bb6f78ca64dc07a5ffb45776cb561d02e8f05b2aa002b1587d1faa60d63b1b47
Instruction Fuzzy Hash: 2A218EB6F102299FDF44DFA9E884ABEB7F5EB48220F218125E905E7345E734D8018B90

Function 06956CD8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acd80c395536afb3ea3b3ccc7262f6f8c5d119874be5237c2e4efa0fc2e23164
Instruction ID: ac1f8e1d3a8418df212f95dc46a48d21ba9a6f67882d4bfde9428fded2bcce38
Opcode Fuzzy Hash: acd80c395536afb3ea3b3ccc7262f6f8c5d119874be5237c2e4efa0fc2e23164
Instruction Fuzzy Hash: 90210731B000194BCF44DB69EC4079EB7F6EB84310F65882AD805EB754EB31DD418B80

Function 012BD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2937062027.00000000012BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12bd000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33f61fce190973e63dcbab1bb1f815a931fcbbd997f6cbfdf66b4cd3f0dc7de4
Instruction ID: 0fdf19da0fb5f7395012c3deca16dd095bf49f9fbd5cb339b2d7b62b4049f527
Opcode Fuzzy Hash: 33f61fce190973e63dcbab1bb1f815a931fcbbd997f6cbfdf66b4cd3f0dc7de4
Instruction Fuzzy Hash: 55214971514208DFDB11DF58D9C0BA6BBA5FB88398F24C96DD9094B242C377D407CB61

Function 0695AEF0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81b06c10956abd2b07dfa1421e9d241f5d0429e4f9f238b61d476f3a5c0de87d
Instruction ID: d56b9120dea46528051ed4f68ff3b21265a377cde2c70921f13773f5972a0443
Opcode Fuzzy Hash: 81b06c10956abd2b07dfa1421e9d241f5d0429e4f9f238b61d476f3a5c0de87d
Instruction Fuzzy Hash: 44216271D1071A8BDF64CFA9C85069EBBB9FF85310F218A2AEC05EB644D770A945CB80

Function 06953B88 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25875e08bf70cf716641049601829efd2c708a8498b5f5ade137ebe37bd0faf3
Instruction ID: c29f235cd7addebd2c51d6994f16b8710a3866aa037bd27af6375ddd76042dca
Opcode Fuzzy Hash: 25875e08bf70cf716641049601829efd2c708a8498b5f5ade137ebe37bd0faf3
Instruction Fuzzy Hash: 2A11AD32B2052C8BDF98E679C8146BE77EAEBC8350F114539D806E7344EE34DC028B91

Function 06953DBF Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04ca82887ab7663b5a47eddfb69f779ab5a11156d76eb2b1bb2ad126135e0325
Instruction ID: 337f5015252b7ecb270d16ec70d61b2677a5cfc2dfee255769f31afd25240a4f
Opcode Fuzzy Hash: 04ca82887ab7663b5a47eddfb69f779ab5a11156d76eb2b1bb2ad126135e0325
Instruction Fuzzy Hash: BC01B131B101101BDB64DA7D985476BBBEADBC9710F25843AF80ECB742EA65DC068791

Function 012BD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2937062027.00000000012BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12bd000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bad08bc3297c4791243414a9a82218353e3075920b51f23bb46501d1989d77c
Instruction ID: 4e5f17d2a2f7998a2eb565716dc6e039221d2eff057ad335ba88f465cd59fa88
Opcode Fuzzy Hash: 8bad08bc3297c4791243414a9a82218353e3075920b51f23bb46501d1989d77c
Instruction Fuzzy Hash: 6D11BB75504284CFDB12CF58D5C0B55BBA1FB84318F28CAAAD9494B656C33AD44ACB62

Function 06953848 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac297b76f2b1926008972cbe520f16e913eb397b0cae4fb0c17d9433839008c5
Instruction ID: d1489f9ce979a9fc0c394ae85cc44f88548702561f33fba07e428df8f9fc188e
Opcode Fuzzy Hash: ac297b76f2b1926008972cbe520f16e913eb397b0cae4fb0c17d9433839008c5
Instruction Fuzzy Hash: AD11D3B1D012599FCB00CF9AD884ACEFBF8FB48320F10852AE918A7640D375A554CFA5

Function 0695ED61 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad8edb5420ce05a2f4fddb3db3513e20d260beacad1e3d27a1b37afa9040d7b8
Instruction ID: 29df524194236a4ce4db19109a010f89246d0eb99d611c3e5541334c11736ed2
Opcode Fuzzy Hash: ad8edb5420ce05a2f4fddb3db3513e20d260beacad1e3d27a1b37afa9040d7b8
Instruction Fuzzy Hash: A6017136B105114BCBA4DB3C989476A77EAEBC9710F25882AF40BC7341DE22DD028745

Function 06953B79 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c43a9f10896d375e1d8d2246e09ec3174e6bfdf5a45e92245d74e1c875c3ad
Instruction ID: 6f53dba76f3139290f6003a54ab9f7968762f310fe159231026bd57b5c35da32
Opcode Fuzzy Hash: 10c43a9f10896d375e1d8d2246e09ec3174e6bfdf5a45e92245d74e1c875c3ad
Instruction Fuzzy Hash: 56018F32B205294BDF98E669DC147FE77AA9BC8350F15453AD906E7784EE24CC024791

Function 06953841 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dd39050e6a0ced554b7e170812f9c85a9fea5a5523bf0bc68618e16dbd172ce
Instruction ID: d2d2f93de01bc6478ccfad6add1d06c8e315851486794f577159aab82606d4fb
Opcode Fuzzy Hash: 6dd39050e6a0ced554b7e170812f9c85a9fea5a5523bf0bc68618e16dbd172ce
Instruction Fuzzy Hash: 1621EEB5D002199FCB00CF9AD984A8EFBB8FB48320F10862AE918A7640D374A554CFA5

Function 06953DD0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ac0ed886f4e68e9b09d876cd3c77a94fcdf8dec551b65d8f80484765923cad
Instruction ID: eb417c62b1310c559f1125d8e8fd6c6ddda27fb467ac866a2d2885caad92992e
Opcode Fuzzy Hash: 72ac0ed886f4e68e9b09d876cd3c77a94fcdf8dec551b65d8f80484765923cad
Instruction Fuzzy Hash: D401D171B101100BDB64DA7D984072BB7DECBC9B20F20883AF90EC7741ED65DC064391

Function 0695A2D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a74580528d93d61190873e778ec865ba00836191b8fa4cf505986b8d80a965
Instruction ID: 43c3266183611d9b9905804e4278ee7f0c662bdac767e6fd97f1b61804a94575
Opcode Fuzzy Hash: d0a74580528d93d61190873e778ec865ba00836191b8fa4cf505986b8d80a965
Instruction Fuzzy Hash: 4A01D471B182145FCB55DA7DD85572F77E9DB49710F24852AF80ACB341EE21DC018785

Function 0695ED70 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 027789baa9756e270dc16cb7ef98e8d6a2f478148e76a182d96c7e35eb61961d
Instruction ID: 012fe40f5c0ee4d2e02e307e43231e76a1978039102e1366388977b9ef20686d
Opcode Fuzzy Hash: 027789baa9756e270dc16cb7ef98e8d6a2f478148e76a182d96c7e35eb61961d
Instruction Fuzzy Hash: B3018136B105154BCBA4D67D989476FB7EADBC9720F25882AF90FC7340EE22ED024785

Function 0695A2E8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9ca2f68f545f11500881ee3781d9106317f7caee3993e446be080a7c3e450cd
Instruction ID: 34630c368e5c6b173667cdbb535ee2ef05fd994ccd27ef913e885fd806973de0
Opcode Fuzzy Hash: b9ca2f68f545f11500881ee3781d9106317f7caee3993e446be080a7c3e450cd
Instruction Fuzzy Hash: 9A01F431B101240FCB54EA7DE85072F73DAE78D714F208929F90AD7340EE21DC028784

Function 0695C7A8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bf814b6d5bac465bbd651916fac7f50cd9be4d98395f89372b8f7739becb23b
Instruction ID: ed4b66d7666c0b3c73a2aec5f213e8dcf63a7c32c8fd4b01202afddb8d409fb4
Opcode Fuzzy Hash: 8bf814b6d5bac465bbd651916fac7f50cd9be4d98395f89372b8f7739becb23b
Instruction Fuzzy Hash: B4F02736E2122497CB54A965EC0059AB33AE780314F104439ED00B7744DB316C1087C0

Function 06956441 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42641444e313e461d342a51760c86a90b94bb85122c74267c054401fb733851
Instruction ID: e8ba85045212539cf95663b571ffaf31662dcf0461739929b222ebb1150270da
Opcode Fuzzy Hash: b42641444e313e461d342a51760c86a90b94bb85122c74267c054401fb733851
Instruction Fuzzy Hash: 74E026B1E2014CABDF90CFB0CE553AA36A8EB52308F7149A6C809CB651E136CA064740

Function 06956450 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a09e4ac86f6dabbd3939ea16ebbd6618dc96c32b88f0b4e1e883662f68e0dce5
Instruction ID: bc3553099a7930e8d2df7d65867555fa9c009ccf24e71e7aabf3c71073c9de27
Opcode Fuzzy Hash: a09e4ac86f6dabbd3939ea16ebbd6618dc96c32b88f0b4e1e883662f68e0dce5
Instruction Fuzzy Hash: 39E0C270E1010CABDF90CEB0C95575A77ADD702308F7184A4DC08CB601E572CA024380

Non-executed Functions

Function 06957670 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$tq, xrefs: 0695777B
$tq, xrefs: 06957BED
$tq, xrefs: 06957B38
$tq, xrefs: 069577B8
$tq, xrefs: 06957BD7
$tq, xrefs: 06957B44
$tq, xrefs: 06957787
$tq, xrefs: 069577AC
$tq, xrefs: 06957BF9
$tq, xrefs: 06957BE3

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq$$tq$$tq$$tq$$tq$$tq$$tq
API String ID: 0-173664734
Opcode ID: 8e9aaa37c5f038612b570e6978c79fb605ec560f381b2b670857e951e0f09294
Instruction ID: 12323e36e034c6ea41f543f1ba9c8af9e3b204cd4c12d19bec11369d65785d17
Opcode Fuzzy Hash: 8e9aaa37c5f038612b570e6978c79fb605ec560f381b2b670857e951e0f09294
Instruction Fuzzy Hash: 9C123F70E002198FDF64DFA9D884A9DB7B6FF88300F2185A9D905AB754DB309E85CF50

Function 0695A908 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$tq, xrefs: 0695AA65
$tq, xrefs: 0695A9FE
$tq, xrefs: 0695AA84
$tq, xrefs: 0695AA90
$tq, xrefs: 0695AAC6
$tq, xrefs: 0695AA0A
$tq, xrefs: 0695AA59
$tq, xrefs: 0695AABA

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq$$tq$$tq$$tq$$tq
API String ID: 0-3970889292
Opcode ID: f3ba9c061043424a48c9550b45b14bf225bac61dab5c9e52a70145a579c04867
Instruction ID: 45e26ecc1d76a4618972bce222772db6ba91304b52379133d69b9e1bfb6ecc33
Opcode Fuzzy Hash: f3ba9c061043424a48c9550b45b14bf225bac61dab5c9e52a70145a579c04867
Instruction Fuzzy Hash: E8918170A00209DFDFA4EF69D5547AEB7B7FF84310F218629E802AB694DB359C41CB94

Function 06957070 Relevance: 7.9, Strings: 6, Instructions: 405COMMON

Download Yara Rule

Strings

$tq, xrefs: 069573AC
$tq, xrefs: 0695750C
$tq, xrefs: 06957352
$tq, xrefs: 06957578
$tq, xrefs: 069573B8
$tq, xrefs: 06957584

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq$$tq$$tq
API String ID: 0-2574395493
Opcode ID: 4a25f6c71b7a2fdf30d400ec3f10cd4248876190c40d7bca6a96aa82b4b3f29a
Instruction ID: 9f2003bdd3dc38c396236b58786028142ca2e8452a479a3aa43a181768908020
Opcode Fuzzy Hash: 4a25f6c71b7a2fdf30d400ec3f10cd4248876190c40d7bca6a96aa82b4b3f29a
Instruction Fuzzy Hash: 8CF15D30B01209DFDB98EFA9D454A6EB7B3BF84300F218568D8069B759DB31ED46CB90

Function 069583A0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$tq, xrefs: 06958606
$tq, xrefs: 069585FA
$tq, xrefs: 0695865F
$tq, xrefs: 0695866B

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq
API String ID: 0-173548568
Opcode ID: 2149129debf03c074e84f6667889eaf9bd72e0eb60b429a623e10f6ef3671530
Instruction ID: 16ddc569eeacf2289a5d704056599c8b6900ca20d64ff17eba46e96ddd050812
Opcode Fuzzy Hash: 2149129debf03c074e84f6667889eaf9bd72e0eb60b429a623e10f6ef3671530
Instruction Fuzzy Hash: D5B14C70B102198FDB94EFA9C5846AEB7B6FF84300F258969D806DB755DB35DC82CB80

Function 069587B8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LRtq, xrefs: 069588FA
LRtq, xrefs: 069588AB
$tq, xrefs: 06958843
$tq, xrefs: 06958837

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID: LRtq$LRtq$$tq$$tq
API String ID: 0-1602856738
Opcode ID: 8cae31ccfb204941b6376a36c6f92b8c7cb9455ea2f1661aa29c4623daa8105a
Instruction ID: 752323fe03c2fa454ad6e201080f14a0a0c975739c4d823c2b81f34303ce5448
Opcode Fuzzy Hash: 8cae31ccfb204941b6376a36c6f92b8c7cb9455ea2f1661aa29c4623daa8105a
Instruction Fuzzy Hash: F051E531B002159FCB54EB79D944A6AB7F6FF88300F218969E8029B7A5DB30EC45CB91

Function 0695AC9B Relevance: 5.2, Strings: 4, Instructions: 157COMMON

Download Yara Rule

Strings

$tq, xrefs: 0695ADC1
$tq, xrefs: 0695AE6C
$tq, xrefs: 0695AE43
$tq, xrefs: 0695AE14

Memory Dump Source

Source File: 00000002.00000002.2942616229.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_z81zEuzkJPHHV3KYua.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq
API String ID: 0-173548568
Opcode ID: 521ba01fba2f0262c67521af67be037ed1efd243039246636e3e6897aeedde50
Instruction ID: 2e160ef238799803efd48bccb0d75bec15e720958b34097dc04be4bbcf7a5063
Opcode Fuzzy Hash: 521ba01fba2f0262c67521af67be037ed1efd243039246636e3e6897aeedde50
Instruction Fuzzy Hash: D351B530E102099FCFA4EB68E4846BEB3B6EB88310F218A6ADC05D7755DB30DC45CB95

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report z81zEuzkJPHHV3KYua.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\z81zEuzkJPHHV3KYua.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d0dbsulo.u3m.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qsxq2hny.2fm.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sgzowy5q.hul.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y42fq5rc.dbl.psm1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
z81zEuzkJPHHV3KYua.exe

Function 00C9AD48 Relevance: 1.7, APIs: 1, Instructions: 209
COMMON

Function 00C944B0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 00C9590C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 04EC4040 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Function 00C9D628 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Function 00C9D21C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 00C9AF38 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre