Edit tour

Windows Analysis Report
Db5aU9VNyz.dll

Overview

General Information

Sample name:	Db5aU9VNyz.dll (renamed file extension from exe to dll, renamed because original name is a hash value)
Original sample name:	ceea2771acee3957189b502f5e1b607d.dll.exe
Analysis ID:	1561762
MD5:	ceea2771acee3957189b502f5e1b607d
SHA1:	ac79d2f79f00dcbf0116ab8b7268069927258549
SHA256:	85dccf69b7fc24cf39f6d3821e963905005993a5036cbfbf6412dde5558df2bd
Tags:	dllexeStrelaStealeruser-abuse_ch
Infos:

Detection

Strela Stealer

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Strela Stealer

AI detected suspicious sample

Machine Learning detection for sample

Contains functionality to query locales information (e.g. system language)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

PE file does not import any functions

Program does not show much activity (idle)

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 7520 cmdline: loaddll64.exe "C:\Users\user\Desktop\Db5aU9VNyz.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 7528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7572 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Db5aU9VNyz.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 7596 cmdline: rundll32.exe "C:\Users\user\Desktop\Db5aU9VNyz.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

regsvr32.exe (PID: 7580 cmdline: regsvr32.exe /s C:\Users\user\Desktop\Db5aU9VNyz.dll MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

rundll32.exe (PID: 7604 cmdline: rundll32.exe C:\Users\user\Desktop\Db5aU9VNyz.dll,DllRegisterServer MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.1398313298.000001A4D6831000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
00000004.00000002.1398710559.00007FF8E83B6000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
00000005.00000002.1397725168.00000256F1681000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
00000000.00000002.1428573354.00007FF8E83B6000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
00000003.00000002.1398922334.0000000000C21000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
00000005.00000002.1397944483.00007FF8E83B6000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
00000003.00000002.1399133207.00007FF8E83B6000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
00000000.00000002.1428165184.0000022A4F571000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
Process Memory Space: loaddll64.exe PID: 7520	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
Process Memory Space: regsvr32.exe PID: 7580	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
Process Memory Space: rundll32.exe PID: 7596	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
Process Memory Space: rundll32.exe PID: 7604	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
5.2.rundll32.exe.7ff8e83b6404.1.raw.unpack	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
4.2.rundll32.exe.7ff8e83b6404.1.unpack	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
0.2.loaddll64.exe.7ff8e83b6404.1.unpack	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
0.2.loaddll64.exe.7ff8e83b6404.1.raw.unpack	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
3.2.regsvr32.exe.7ff8e83b6404.1.unpack	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
5.2.rundll32.exe.7ff8e83b6404.1.unpack	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
3.2.regsvr32.exe.7ff8e83b0000.0.unpack	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
4.2.rundll32.exe.7ff8e83b0000.0.unpack	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
4.2.rundll32.exe.7ff8e83b6404.1.raw.unpack	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
0.2.loaddll64.exe.7ff8e83b0000.0.unpack	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
5.2.rundll32.exe.7ff8e83b0000.0.unpack	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
3.2.regsvr32.exe.7ff8e83b6404.1.raw.unpack	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
Click to see the 7 entries

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Db5aU9VNyz.dll	ReversingLabs: Detection: 50%
Source: Db5aU9VNyz.dll	Virustotal: Detection: 47%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 87.5% probability

Machine Learning detection for sample

Source: Db5aU9VNyz.dll

Joe Sandbox ML: detected

Source: Db5aU9VNyz.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF8E83B11B0	0_2_00007FF8E83B11B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF8E83B1000	0_2_00007FF8E83B1000
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000022A4F57F4E8	0_2_0000022A4F57F4E8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000022A4F571090	0_2_0000022A4F571090
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000022A4F5772BC	0_2_0000022A4F5772BC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000022A4F571A90	0_2_0000022A4F571A90
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000022A4F5715A0	0_2_0000022A4F5715A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C21090	3_2_00C21090
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C21A90	3_2_00C21A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C272BC	3_2_00C272BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C2F4E8	3_2_00C2F4E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C215A0	3_2_00C215A0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001A4D683F4E8	4_2_000001A4D683F4E8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001A4D6831090	4_2_000001A4D6831090
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001A4D68315A0	4_2_000001A4D68315A0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001A4D68372BC	4_2_000001A4D68372BC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001A4D6831A90	4_2_000001A4D6831A90
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000256F168F4E8	5_2_00000256F168F4E8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000256F1681090	5_2_00000256F1681090
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000256F16872BC	5_2_00000256F16872BC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000256F16815A0	5_2_00000256F16815A0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000256F1681A90	5_2_00000256F1681A90

Source: Db5aU9VNyz.dll

Static PE information: No import functions for PE file found

Source: classification engine

Classification label: mal64.troj.winDLL@10/0@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7528:120:WilError_03

Source: Db5aU9VNyz.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Db5aU9VNyz.dll",#1

Source: Db5aU9VNyz.dll	ReversingLabs: Detection: 50%
Source: Db5aU9VNyz.dll	Virustotal: Detection: 47%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\Db5aU9VNyz.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Db5aU9VNyz.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\Db5aU9VNyz.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Db5aU9VNyz.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\Db5aU9VNyz.dll,DllRegisterServer
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Db5aU9VNyz.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\Db5aU9VNyz.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\Db5aU9VNyz.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Db5aU9VNyz.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Db5aU9VNyz.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: Db5aU9VNyz.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\Db5aU9VNyz.dll

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000022A4F57CC35 push cs; retf 0000h	0_2_0000022A4F57CC59
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000022A4F57CC6C push esi; retf 0000h	0_2_0000022A4F57CC6D
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000022A4F57CCA8 push 6F0000CBh; retf	0_2_0000022A4F57CCAD
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000022A4F57CC9C push ebx; retf	0_2_0000022A4F57CC9D
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000022A4F57BBA2 push esp; ret	0_2_0000022A4F57BBA5
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C348D1 push esp; ret	3_2_00C348DA
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C348E1 push ebp; ret	3_2_00C348EA
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C348F0 push ebp; ret	3_2_00C348FA
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C34840 push esp; ret	3_2_00C3484A
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C34850 push ebp; ret	3_2_00C3492A
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C34861 push esp; ret	3_2_00C348AA
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C34800 push esp; ret	3_2_00C3480A
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C34810 push esp; ret	3_2_00C3481A
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C34828 push esp; ret	3_2_00C3482A
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C34838 push esp; ret	3_2_00C3483A
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C349C9 push ebp; ret	3_2_00C349CA
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C349D0 push ebp; ret	3_2_00C349DA
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C361D8 push esi; ret	3_2_00C361F2
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C349E0 push esi; ret	3_2_00C34A1A
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C34981 push ebp; ret	3_2_00C349BA
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C34968 push ebp; ret	3_2_00C3497A
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C34908 push ebp; ret	3_2_00C3491A
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C31928 push ds; ret	3_2_00C31962
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C31938 push ds; ret	3_2_00C31962
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C2BBA2 push esp; ret	3_2_00C2BBA5
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C32B48 push eax; ret	3_2_00C32B49
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C32B58 pushad ; ret	3_2_00C32B59
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C324E9 push edx; retn 0000h	3_2_00C324EA
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C344F0 push eax; ret	3_2_00C344FA
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C34490 push eax; ret	3_2_00C344AA
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00C2CC9C push ebx; retf	3_2_00C2CC9D

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Db5aU9VNyz.dll",#1

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Code function: GetConsoleWindow,CreateThread,GetLocaleInfoA,	0_2_0000022A4F5720E0
Source: C:\Windows\System32\regsvr32.exe	Code function: CreateThread,GetLocaleInfoA,	3_2_00C220E0
Source: C:\Windows\System32\rundll32.exe	Code function: CreateThread,GetLocaleInfoA,	4_2_000001A4D68320E0
Source: C:\Windows\System32\rundll32.exe	Code function: CreateThread,GetLocaleInfoA,	5_2_00000256F16820E0

Stealing of Sensitive Information

Yara detected Strela Stealer

Source: Yara match	File source: 5.2.rundll32.exe.7ff8e83b6404.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.7ff8e83b6404.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll64.exe.7ff8e83b6404.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll64.exe.7ff8e83b6404.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.7ff8e83b6404.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.7ff8e83b6404.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.7ff8e83b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.7ff8e83b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.7ff8e83b6404.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll64.exe.7ff8e83b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.7ff8e83b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.7ff8e83b6404.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1398313298.000001A4D6831000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1398710559.00007FF8E83B6000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1397725168.00000256F1681000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1428573354.00007FF8E83B6000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1398922334.0000000000C21000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1397944483.00007FF8E83B6000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1399133207.00007FF8E83B6000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1428165184.0000022A4F571000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll64.exe PID: 7520, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 7580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7604, type: MEMORYSTR

Remote Access Functionality

Yara detected Strela Stealer

Source: Yara match	File source: 5.2.rundll32.exe.7ff8e83b6404.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.7ff8e83b6404.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll64.exe.7ff8e83b6404.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll64.exe.7ff8e83b6404.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.7ff8e83b6404.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.7ff8e83b6404.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.7ff8e83b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.7ff8e83b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.7ff8e83b6404.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll64.exe.7ff8e83b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.7ff8e83b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.7ff8e83b6404.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1398313298.000001A4D6831000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1398710559.00007FF8E83B6000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1397725168.00000256F1681000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1428573354.00007FF8E83B6000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1398922334.0000000000C21000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1397944483.00007FF8E83B6000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1399133207.00007FF8E83B6000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1428165184.0000022A4F571000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll64.exe PID: 7520, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 7580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7604, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Regsvr32	OS Credential Dumping	11 System Information Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Rundll32	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Db5aU9VNyz.dll	50%	ReversingLabs	Win64.Trojan.StrelaStealer
Db5aU9VNyz.dll	47%	Virustotal		Browse
Db5aU9VNyz.dll	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561762
Start date and time:	2024-11-24 08:42:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Db5aU9VNyz.dll (renamed file extension from exe to dll, renamed because original name is a hash value)
Original Sample Name:	ceea2771acee3957189b502f5e1b607d.dll.exe
Detection:	MAL
Classification:	mal64.troj.winDLL@10/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 20 Number of non-executed functions: 21
Cookbook Comments:	Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net
Not all processes where analyzed, report is missing behavior information

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	fACYdCvub8.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	Payment Transfer Request Form.bat.exe	Get hash	malicious	Remcos	Browse	13.107.246.63
	Marine Energy Sdn Bhd Request for Quotation.exe	Get hash	malicious	FormBook	Browse	13.107.246.63
	purchase Order.exe	Get hash	malicious	FormBook	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.63
	4yOuoT4GFy.exe	Get hash	malicious	AsyncRAT	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.63

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	7.722707346854152
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	Db5aU9VNyz.dll
File size:	137'728 bytes
MD5:	ceea2771acee3957189b502f5e1b607d
SHA1:	ac79d2f79f00dcbf0116ab8b7268069927258549
SHA256:	85dccf69b7fc24cf39f6d3821e963905005993a5036cbfbf6412dde5558df2bd
SHA512:	e33754db175b5367d74937ce634ea8ec043f469fdf53d2c7721605486f1ddf826633d8c7fdb1ba127b83adeed308b4f64493d584ca295c3f0cf206a83c8deea1
SSDEEP:	3072:+aFwDl+lMbh3Gm8CsqMRV9t5P7GpQuBMSlFhpvTPIaGWiME2MKK+HfK2u1Ep0xtO:+a2l+EGm8TTP7utJhIaR5ERjfb
TLSH:	E6D3F22AA09EDE25E9FBD0B3AF1EF39094415107133E35C3C150B466697BAF4787AC92
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....T1g.........." .....8..........@........................................`............`........................................

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x180001140
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x67315488 [Mon Nov 11 00:49:12 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
mov eax, dword ptr [00022312h]
inc esp
mov eax, dword ptr [0002230Fh]
lea edx, dword ptr [eax-01h]
imul edx, eax
mov eax, edx
not eax
mov ecx, eax
and ecx, FFFFFFFEh
and edx, 01h
or edx, ecx
xor eax, edx
test eax, edx
inc ecx
setne cl
inc ecx
cmp eax, 09h
setnle al
inc ecx
cmp eax, 0Ah
setl cl
inc esp
xor cl, cl
xor cl, 00000001h
mov edx, eax
inc esp
and dl, cl
inc esp
xor al, cl
or al, dl
xor al, 01h
test cl, al
jne 00007FB090EFF907h
xor cl, al
jne 00007FB090EFF903h
nop word ptr [eax+eax+00000000h]
nop dword ptr [eax+eax+00h]
jmp 00007FB090EFF8F0h
mov eax, 00000001h
ret
int3
int3
int3
int3
int3
int3
int3
int3
inc ecx
push edi
inc ecx
push esi
inc ecx
push ebp
inc ecx
push esp
push esi
push edi
push ebp
push ebx
dec eax
sub esp, 00000168h
inc sp
movq qword ptr [esp+00000150h], mm7
inc sp
movq qword ptr [esp+00000140h], mm6
inc sp
movq qword ptr [esp+00000130h], mm5
inc sp
movq qword ptr [esp+00000120h], mm4
inc sp
movq qword ptr [esp+00000110h], mm3
inc sp
movq qword ptr [esp+00000100h], mm2
inc sp
movq qword ptr [esp+000000F0h], mm1

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x5190	0x51	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x25000	0x1a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x24000	0x18	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x377b	0x3800	9cb4fa437e5714f9c5a0883dcf7e576a	False	0.6565290178571429	data	6.739143547521826	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x5000	0x22c	0x400	151ff0785ef7ca891f60c4faaab1bbab	False	0.2060546875	data	3.6901601485112017	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x6000	0x1d498	0x1d600	b0e96fe640488746868e2c9bc52b4f19	False	0.8685837765957447	data	7.7372965211458675	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x24000	0x18	0x200	c8be788ac23de7429f3bcb0881f569e4	False	0.064453125	data	0.2162069074398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x25000	0x1a8	0x200	dc8a7a3ba49348b04c8bceefe511f730	False	0.482421875	data	4.1813331407993175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x25060	0x143	XML 1.0 document, ASCII text	English	United States	0.628482972136223

Exports

Name	Ordinal	Address
DllRegisterServer	1	0x180001000

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 24, 2024 08:42:54.827896118 CET	1.1.1.1	192.168.2.9	0x76b7	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 08:42:54.827896118 CET	1.1.1.1	192.168.2.9	0x76b7	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	02:42:57
Start date:	24/11/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\Db5aU9VNyz.dll"
Imagebase:	0x7ff62be80000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_StrelaStealer, Description: Yara detected Strela Stealer, Source: 00000000.00000002.1428573354.00007FF8E83B6000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_StrelaStealer, Description: Yara detected Strela Stealer, Source: 00000000.00000002.1428165184.0000022A4F571000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:42:57
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:42:57
Start date:	24/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Db5aU9VNyz.dll",#1
Imagebase:	0x7ff7581d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:42:57
Start date:	24/11/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\Db5aU9VNyz.dll
Imagebase:	0x7ff61d720000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_StrelaStealer, Description: Yara detected Strela Stealer, Source: 00000003.00000002.1398922334.0000000000C21000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StrelaStealer, Description: Yara detected Strela Stealer, Source: 00000003.00000002.1399133207.00007FF8E83B6000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:42:57
Start date:	24/11/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\Db5aU9VNyz.dll",#1
Imagebase:	0x7ff6ceee0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_StrelaStealer, Description: Yara detected Strela Stealer, Source: 00000004.00000002.1398313298.000001A4D6831000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StrelaStealer, Description: Yara detected Strela Stealer, Source: 00000004.00000002.1398710559.00007FF8E83B6000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:42:57
Start date:	24/11/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\Db5aU9VNyz.dll,DllRegisterServer
Imagebase:	0x7ff6ceee0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_StrelaStealer, Description: Yara detected Strela Stealer, Source: 00000005.00000002.1397725168.00000256F1681000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StrelaStealer, Description: Yara detected Strela Stealer, Source: 00000005.00000002.1397944483.00007FF8E83B6000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	75%
Signature Coverage:	37.5%
Total number of Nodes:	40
Total number of Limit Nodes:	6

Executed Functions

Function 00007FF8E83B11B0 Relevance: 10.6, APIs: 2, Strings: 2, Instructions: 3573COMMON

Download Yara Rule

Strings

VVlyjRSzFLmyrtahDwbFCWKFpmipmmhPoixaHfnPShaHPmTikLFaGRRaRwSJkGioOZEjauXgEoVWGTzlnoYCRHXLRHkcLUwtRLscGPXWipGllUEtDhAiCOyhKZXuXonRjlTtvAbzJruFwnzhSWetPSDcTFmsAsgrYOIzXiIDKCqQOgRteJATfscdvKJLkYJYDOTwQBCozHbjOwrsEfDahwtnRWrwUHtjMEWqiJcClQAKEWCldPXlFgTDWBnBzOOQehoy, xrefs: 00007FF8E83B163F
kY-8h, xrefs: 00007FF8E83B300A

Memory Dump Source

Source File: 00000000.00000002.1428459801.00007FF8E83B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8E83B0000, based on PE: true

Associated: 00000000.00000002.1428445245.00007FF8E83B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428475513.00007FF8E83B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428573354.00007FF8E83B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428598925.00007FF8E83D5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8e83b0000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: kY-8h$VVlyjRSzFLmyrtahDwbFCWKFpmipmmhPoixaHfnPShaHPmTikLFaGRRaRwSJkGioOZEjauXgEoVWGTzlnoYCRHXLRHkcLUwtRLscGPXWipGllUEtDhAiCOyhKZXuXonRjlTtvAbzJruFwnzhSWetPSDcTFmsAsgrYOIzXiIDKCqQOgRteJATfscdvKJLkYJYDOTwQBCozHbjOwrsEfDahwtnRWrwUHtjMEWqiJcClQAKEWCldPXlFgTDWBnBzOOQehoy
API String ID: 0-1072908350
Opcode ID: 10b11ed2a2304671b516d60a121280c5060e799b5db61ee90563b79f09f6fa95
Instruction ID: 77b6c870bf90a0bf1340979f39c824775911cdfa3568491ae559b3e70d236831
Opcode Fuzzy Hash: 10b11ed2a2304671b516d60a121280c5060e799b5db61ee90563b79f09f6fa95
Instruction Fuzzy Hash: 3243B7ABF296414AEB048B7598513FEA792ABA63E4F0CA331DE1D477D5DB3CD8058304

Function 0000022A4F5720E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 0000022A4F5720ED
CreateThread.KERNELBASE ref: 0000022A4F57211D
GetLocaleInfoA.KERNELBASE ref: 0000022A4F5721E5

Strings

5, xrefs: 0000022A4F57225D

Memory Dump Source

Source File: 00000000.00000002.1428165184.0000022A4F571000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022A4F571000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a4f571000_loaddll64.jbxd

Yara matches

Similarity

API ID: ConsoleCreateInfoLocaleThreadWindow
String ID: 5
API String ID: 1307802651-2226203566
Opcode ID: 53e6023148aec332c40765bce66317f8f0d3847e40e453e3a9759d4f43b705e2
Instruction ID: bfbe4c00601275ad08f00fb4e5d63d53b927466702235e95b3dfb4306c284694
Opcode Fuzzy Hash: 53e6023148aec332c40765bce66317f8f0d3847e40e453e3a9759d4f43b705e2
Instruction Fuzzy Hash: 79419B30218A488BE729FFA4D99D7AA77E2FBD4305F40952DE147C25A6DE78C409CB43

Function 00007FF8E83B1000 Relevance: .1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1428459801.00007FF8E83B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8E83B0000, based on PE: true

Associated: 00000000.00000002.1428445245.00007FF8E83B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428475513.00007FF8E83B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428573354.00007FF8E83B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428598925.00007FF8E83D5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8e83b0000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dfbe4637367382060e290bfafd52b1d6e20a2d28bb1cf39a7ae6ff589a5b6e1
Instruction ID: 79c4b74d7f3aa0b6cf545b1f6d1fbb4bcb3d4116f7e1f53703c921d0fd6ede89
Opcode Fuzzy Hash: 8dfbe4637367382060e290bfafd52b1d6e20a2d28bb1cf39a7ae6ff589a5b6e1
Instruction Fuzzy Hash: 2731D53BF655124FFB0887B599523FF27D29BB1394F29A434C109C32D6DE3E68464604

Function 0000022A4F57A87C Relevance: 1.6, APIs: 1, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE ref: 0000022A4F57A90B

Memory Dump Source

Source File: 00000000.00000002.1428165184.0000022A4F571000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022A4F571000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a4f571000_loaddll64.jbxd

Yara matches

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 96bd17cdbec1199f7060c8e4f9a6f8fd574a155b9e298efd3bd16726f0fb32a2
Instruction ID: 0e43f891fef54fa49a8d10f9a4054c5497708d3dbdb099330c1d1e826c72ec25
Opcode Fuzzy Hash: 96bd17cdbec1199f7060c8e4f9a6f8fd574a155b9e298efd3bd16726f0fb32a2
Instruction Fuzzy Hash: CD31D430508E1AAFE7B5EF6C8588760B6D0F70A360F661749E45AC75F5CA74D8A1C383

Function 0000022A4F571000 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeNameForVolumeMountPointA.KERNEL32 ref: 0000022A4F57104B

Memory Dump Source

Source File: 00000000.00000002.1428165184.0000022A4F571000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022A4F571000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a4f571000_loaddll64.jbxd

Yara matches

Similarity

API ID: Volume$MountNamePoint
String ID:
API String ID: 1269602640-0
Opcode ID: 790c3e5c04854700e94b4d90c23288a0a6dd65ca27d7b0edd1071683d7a5972d
Instruction ID: e9eb52202b6985ee66a0673e16d8a43802bfcd834c0969caff0cd16535c36ab4
Opcode Fuzzy Hash: 790c3e5c04854700e94b4d90c23288a0a6dd65ca27d7b0edd1071683d7a5972d
Instruction Fuzzy Hash: 530167305085448FFB06EB68D8987D677E1F769305F008569E0CAC72A6DEBCC558C742

Function 0000022A4F576F68 Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,?,?,?,?,?,0000022A4F576F64), ref: 0000022A4F576F93

Memory Dump Source

Source File: 00000000.00000002.1428165184.0000022A4F571000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022A4F571000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a4f571000_loaddll64.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 05666283937c1f08677c7088b7fd24b6f81cfbeb3c6d91aeb7e4e1034e6939b2
Instruction ID: e2901d0284b1ff83d0292c35994997cca54112fa042e29cbd837e73517964d1a
Opcode Fuzzy Hash: 05666283937c1f08677c7088b7fd24b6f81cfbeb3c6d91aeb7e4e1034e6939b2
Instruction Fuzzy Hash: 36D062343007495BEA687BF55A9D26D26959745205F0028386502C6A9BDD7AD845C743

Function 0000022A4F5720B0 Relevance: 1.5, APIs: 1, Instructions: 14
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32 ref: 0000022A4F5720CA

Memory Dump Source

Source File: 00000000.00000002.1428165184.0000022A4F571000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022A4F571000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a4f571000_loaddll64.jbxd

Yara matches

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: b1c7642022b5e6b88316a0d0a9cd98790ccd3d47a32ec667f729e349532e1fef
Instruction ID: f0c8c8b179c2aaeca1855f2f357fd550bc39611e5f4a8834ea67c0cbc9ad4e3c
Opcode Fuzzy Hash: b1c7642022b5e6b88316a0d0a9cd98790ccd3d47a32ec667f729e349532e1fef
Instruction Fuzzy Hash: 1DC0123016180847E708BB34EC595D136E4FB5C304FD089399407C5450E96D82844A82

Non-executed Functions

Function 0000022A4F57F4E8 Relevance: 1.8, APIs: 1, Instructions: 321COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 0000022A4F57F737

Memory Dump Source

Source File: 00000000.00000002.1428165184.0000022A4F571000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022A4F571000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a4f571000_loaddll64.jbxd

Yara matches

Similarity

API ID: _clrfp
String ID:
API String ID: 3618594692-0
Opcode ID: 2045596ada029767b90017b957664b0b71c7a256b325aa916a96e60a40104743
Instruction ID: e5616e623f74021e54678726c7c0328a4fa9db219706b94d4e38e145385d4fd4
Opcode Fuzzy Hash: 2045596ada029767b90017b957664b0b71c7a256b325aa916a96e60a40104743
Instruction Fuzzy Hash: 34C19D30120A4DCFEBA8DF1CC98AB6677E0FF49304F198599E859CB6A1C775D852CB42

Function 0000022A4F5715A0 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1428165184.0000022A4F571000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022A4F571000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a4f571000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4f9392618ee0be8b2838eee92702fec4626de7f7bd0dc604c65336cad8c2563
Instruction ID: 730eb3a8c66bab684c1a5d1d214bb08d106af2949965580d09f63e9c9927e903
Opcode Fuzzy Hash: e4f9392618ee0be8b2838eee92702fec4626de7f7bd0dc604c65336cad8c2563
Instruction Fuzzy Hash: DEE13C70518B488FEB75EF58D8897EA77E1FB98305F00462EA48AC3560DF749A45CB83

Function 0000022A4F571A90 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1428165184.0000022A4F571000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022A4F571000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a4f571000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f301177accb7d0ce1b8505d76f0598128b48e2f6fca66abbe616489d302d7cc2
Instruction ID: a50d50df4651f07b135352870d616b98b5f31bc349067e1f0540dc5645d76584
Opcode Fuzzy Hash: f301177accb7d0ce1b8505d76f0598128b48e2f6fca66abbe616489d302d7cc2
Instruction Fuzzy Hash: 15B15D31208A498FEB79FF68D8596EA73E1FB98311F00422AA45BC3591DF74D905CB82

Function 0000022A4F571090 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1428165184.0000022A4F571000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022A4F571000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a4f571000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 004e5bc4f416d9accfca0753fc8d67adee0aa063ac23580ea370914e8b763bcf
Instruction ID: 1df964e8a1ff07e20ab8a7b19530b6d40b068e8457e55b174bbc9b14b7670548
Opcode Fuzzy Hash: 004e5bc4f416d9accfca0753fc8d67adee0aa063ac23580ea370914e8b763bcf
Instruction Fuzzy Hash: 4271A13061CB484BE768EF28984D3BA77E1FB89710F00956ED88BC3251EE74D946C782

Function 0000022A4F5772BC Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1428165184.0000022A4F571000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022A4F571000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a4f571000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30f0a361053a8720fb197dd7f2de9fba19a6b2a280636273193b063dd5433016
Instruction ID: cd8dd15f45c52fada5e8434c1d6788a600f048968599c2cb9d510dd6848bc7a4
Opcode Fuzzy Hash: 30f0a361053a8720fb197dd7f2de9fba19a6b2a280636273193b063dd5433016
Instruction Fuzzy Hash: F151F632318E0C4FDB5CEF6CE49967573D2E7AC311B15822EE40AD72A5DEB1D8468782

Function 0000022A4F5740B0 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 463
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000022A4F57410C

Part of subcall function 0000022A4F575054: __GetUnwindTryBlock.LIBCMT ref: 0000022A4F575097
Part of subcall function 0000022A4F575054: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000022A4F5750BC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000022A4F5741E4
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000022A4F574433
std::bad_alloc::bad_alloc.LIBCMT ref: 0000022A4F57453F

Strings

csm, xrefs: 0000022A4F574207
csm, xrefs: 0000022A4F574126
csm, xrefs: 0000022A4F57418D

Memory Dump Source

Source File: 00000000.00000002.1428165184.0000022A4F571000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022A4F571000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a4f571000_loaddll64.jbxd

Yara matches

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 3ccd74b83f4e218917afb10b63cd26341559b906269fc65534a34942f520602e
Instruction ID: 9c3dd0e45b213fa2b31c0e3e9e8e7621825ffc251b8536ce2d4cac9a3165cad7
Opcode Fuzzy Hash: 3ccd74b83f4e218917afb10b63cd26341559b906269fc65534a34942f520602e
Instruction Fuzzy Hash: E1F16F30518B489BEB64FFA885897AA77E0FB59310F50165DE489C3696DF70D882CB83

Function 0000022A4F574930 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000022A4F574958
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000022A4F574A40

Strings

csm, xrefs: 0000022A4F574A92
csm, xrefs: 0000022A4F57497A

Memory Dump Source

Source File: 00000000.00000002.1428165184.0000022A4F571000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022A4F571000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a4f571000_loaddll64.jbxd

Yara matches

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: e27bbef9eb5f28e076bf3649e7203d2c4342c914ee4d718e56e88106427699c6
Instruction ID: 8587e5c60d7abffd470ea5663984c17744cdf597731c0088df89e798da08087e
Opcode Fuzzy Hash: e27bbef9eb5f28e076bf3649e7203d2c4342c914ee4d718e56e88106427699c6
Instruction Fuzzy Hash: D4718F30114A48EFEBB8AF58818D76AB7D1FB94311F64665A948DC7A92DFB0DC80C743

Function 0000022A4F572CF0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 233
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000022A4F572D1B
_IsNonwritableInCurrentImage.LIBCMT ref: 0000022A4F572DB2

Strings

csm, xrefs: 0000022A4F572D99

Memory Dump Source

Source File: 00000000.00000002.1428165184.0000022A4F571000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022A4F571000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a4f571000_loaddll64.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: 43c5b6145a0bc1a6e7f1a4078bb18beee855f0c15013e264a2f6e222c992594d
Instruction ID: d9661826bdef111d29aca3a8bdc38f39d69ba13611a655a64317eff5246c40d3
Opcode Fuzzy Hash: 43c5b6145a0bc1a6e7f1a4078bb18beee855f0c15013e264a2f6e222c992594d
Instruction Fuzzy Hash: 6771A130218A049BEF78FA9CE58977473D1FB54350F10556EEC86C7696EA60EC51CA83

Function 0000022A4F574580 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 233
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_CallSETranslator.LIBVCRUNTIME ref: 0000022A4F57462B

Strings

MOC, xrefs: 0000022A4F5745F3
RCC, xrefs: 0000022A4F5745FB

Memory Dump Source

Source File: 00000000.00000002.1428165184.0000022A4F571000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022A4F571000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22a4f571000_loaddll64.jbxd

Yara matches

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 9263fe20008c7eccda2d837675211652d6c96f36503d8c2c93f65cb69d80355e
Instruction ID: 91dc6c8820dc2fab247ff170a95012282c823bbfcb7df96b77c02f453c53e651
Opcode Fuzzy Hash: 9263fe20008c7eccda2d837675211652d6c96f36503d8c2c93f65cb69d80355e
Instruction Fuzzy Hash: FB71CF30518B489FE774EF58C54ABAAB7E0FB99310F041A5EE489C3552DBB4E481CB83

Analysis Process: regsvr32.exePID: 7580, Parent PID: 7520COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	23
Total number of Limit Nodes:	2

Executed Functions

Function 00C220E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00C2211D
GetLocaleInfoA.KERNELBASE ref: 00C221E5

Strings

5, xrefs: 00C2225D

Memory Dump Source

Source File: 00000003.00000002.1398922334.0000000000C21000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c21000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateInfoLocaleThread
String ID: 5
API String ID: 899703944-2226203566
Opcode ID: 53e6023148aec332c40765bce66317f8f0d3847e40e453e3a9759d4f43b705e2
Instruction ID: efaf2a98251720b824725e517d467c58327be51a43da97a20f891b84b8fdd102
Opcode Fuzzy Hash: 53e6023148aec332c40765bce66317f8f0d3847e40e453e3a9759d4f43b705e2
Instruction Fuzzy Hash: C2411330218A48CBE719EF64EC896BB73E2FBD8301F44853DE147C25A5DE388509CB42

Function 00C21000 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeNameForVolumeMountPointA.KERNEL32 ref: 00C2104B

Memory Dump Source

Source File: 00000003.00000002.1398922334.0000000000C21000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c21000_regsvr32.jbxd

Yara matches

Similarity

API ID: Volume$MountNamePoint
String ID:
API String ID: 1269602640-0
Opcode ID: 790c3e5c04854700e94b4d90c23288a0a6dd65ca27d7b0edd1071683d7a5972d
Instruction ID: cf10c49bbc0c5e18365bf51681048fda2ea57452e4e6cab05e5d41f84c2c763f
Opcode Fuzzy Hash: 790c3e5c04854700e94b4d90c23288a0a6dd65ca27d7b0edd1071683d7a5972d
Instruction Fuzzy Hash: 1F0162305086488FFB06EB68D898BE677E1F769305F008569E0CAC72A5DEBC8658C751

Function 00C26F68 Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,?,?,?,?,?,00C26F64), ref: 00C26F93

Memory Dump Source

Source File: 00000003.00000002.1398922334.0000000000C21000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c21000_regsvr32.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 05666283937c1f08677c7088b7fd24b6f81cfbeb3c6d91aeb7e4e1034e6939b2
Instruction ID: f54295a1c19e35ac4967810fc126f89294d494d3bb623a14a47cd908928b6f06
Opcode Fuzzy Hash: 05666283937c1f08677c7088b7fd24b6f81cfbeb3c6d91aeb7e4e1034e6939b2
Instruction Fuzzy Hash: 15D09E343007195FEF18BBF97A9932D2665DB45205F0018386913CBEA6CD3A98498752

Function 00C220B0 Relevance: 1.5, APIs: 1, Instructions: 14
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32 ref: 00C220CA

Memory Dump Source

Source File: 00000003.00000002.1398922334.0000000000C21000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c21000_regsvr32.jbxd

Yara matches

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: b1c7642022b5e6b88316a0d0a9cd98790ccd3d47a32ec667f729e349532e1fef
Instruction ID: f0c8c8b179c2aaeca1855f2f357fd550bc39611e5f4a8834ea67c0cbc9ad4e3c
Opcode Fuzzy Hash: b1c7642022b5e6b88316a0d0a9cd98790ccd3d47a32ec667f729e349532e1fef
Instruction Fuzzy Hash: 1DC0123016180847E708BB34EC595D136E4FB5C304FD089399407C5450E96D82844A82

Non-executed Functions

Function 00C240B0 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 463
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00C2410C

Part of subcall function 00C25054: __GetUnwindTryBlock.LIBCMT ref: 00C25097
Part of subcall function 00C25054: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00C250BC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00C241E4
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00C24433
std::bad_alloc::bad_alloc.LIBCMT ref: 00C2453F

Strings

csm, xrefs: 00C2418D
csm, xrefs: 00C24126
csm, xrefs: 00C24207

Memory Dump Source

Source File: 00000003.00000002.1398922334.0000000000C21000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c21000_regsvr32.jbxd

Yara matches

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 3ccd74b83f4e218917afb10b63cd26341559b906269fc65534a34942f520602e
Instruction ID: 958918db846b1a3c3427b50af05c1a6e0884d5aa7d7506b5dd5be6cad7ff4d51
Opcode Fuzzy Hash: 3ccd74b83f4e218917afb10b63cd26341559b906269fc65534a34942f520602e
Instruction Fuzzy Hash: 0CE1D630918B588FDB18EF6CE485AAD77E0FF59310F50065EE499C7A16DB34E981CB82

Function 00C24930 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00C24958
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00C24A40

Strings

csm, xrefs: 00C2497A
csm, xrefs: 00C24A92

Memory Dump Source

Source File: 00000003.00000002.1398922334.0000000000C21000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c21000_regsvr32.jbxd

Yara matches

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: e27bbef9eb5f28e076bf3649e7203d2c4342c914ee4d718e56e88106427699c6
Instruction ID: 05bac4a87143fee95b0ebbe5e57957ce69f911305faf1ef765d44fdd1e931966
Opcode Fuzzy Hash: e27bbef9eb5f28e076bf3649e7203d2c4342c914ee4d718e56e88106427699c6
Instruction Fuzzy Hash: C961D030614B688FCB6CDF28A089329B7E1FB98311F64465EE499C7A91CB74DD80C786

Function 00C22CF0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 233
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00C22D1B
_IsNonwritableInCurrentImage.LIBCMT ref: 00C22DB2

Strings

csm, xrefs: 00C22D99

Memory Dump Source

Source File: 00000003.00000002.1398922334.0000000000C21000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c21000_regsvr32.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: 43c5b6145a0bc1a6e7f1a4078bb18beee855f0c15013e264a2f6e222c992594d
Instruction ID: 0ceb3603224da18b8f9d403c6236cdcbe07a2dd95f0ffac442b07042c1305b39
Opcode Fuzzy Hash: 43c5b6145a0bc1a6e7f1a4078bb18beee855f0c15013e264a2f6e222c992594d
Instruction Fuzzy Hash: 8561D430208E289BCF28EE5CF485A7873D1FB54351F11456EE88AC3656EB34ED92DB85

Function 00C24580 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 233
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00C2462B

Strings

RCC, xrefs: 00C245FB
MOC, xrefs: 00C245F3

Memory Dump Source

Source File: 00000003.00000002.1398922334.0000000000C21000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c21000_regsvr32.jbxd

Yara matches

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 9263fe20008c7eccda2d837675211652d6c96f36503d8c2c93f65cb69d80355e
Instruction ID: a0f311a800c72a468d37b79d553543ac9191221d3a9a83f218b5f31b1016c71f
Opcode Fuzzy Hash: 9263fe20008c7eccda2d837675211652d6c96f36503d8c2c93f65cb69d80355e
Instruction Fuzzy Hash: 5971C430518B988FD768EF18E446BAAB7E0FB99700F144A5EE49DC3611DB74E581CB83

Analysis Process: rundll32.exePID: 7596, Parent PID: 7572COMMON

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	30
Total number of Limit Nodes:	4

Executed Functions

Function 000001A4D68320E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 000001A4D683211D
GetLocaleInfoA.KERNELBASE ref: 000001A4D68321E5

Strings

5, xrefs: 000001A4D683225D

Memory Dump Source

Source File: 00000004.00000002.1398313298.000001A4D6831000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A4D6831000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1a4d6831000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateInfoLocaleThread
String ID: 5
API String ID: 899703944-2226203566
Opcode ID: 53e6023148aec332c40765bce66317f8f0d3847e40e453e3a9759d4f43b705e2
Instruction ID: a5f16750a9e9fc9f9f7a3eaf286d85c742d6eeab3b047e7b3e207d5e0c5cb214
Opcode Fuzzy Hash: 53e6023148aec332c40765bce66317f8f0d3847e40e453e3a9759d4f43b705e2
Instruction Fuzzy Hash: 6441F3303266448BEB19EFA8D8987EBB3E1FBE5301F40952DF187D21A5DF789405C642

Function 000001A4D683A87C Relevance: 1.6, APIs: 1, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE ref: 000001A4D683A90B

Memory Dump Source

Source File: 00000004.00000002.1398313298.000001A4D6831000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A4D6831000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1a4d6831000_rundll32.jbxd

Yara matches

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 96bd17cdbec1199f7060c8e4f9a6f8fd574a155b9e298efd3bd16726f0fb32a2
Instruction ID: 23261c0cd748f03db4831ab1a700d061e99fc1bc15b403a17d02e139bcbbabed
Opcode Fuzzy Hash: 96bd17cdbec1199f7060c8e4f9a6f8fd574a155b9e298efd3bd16726f0fb32a2
Instruction Fuzzy Hash: 4731053061AE5A4FDBA5EF6C84846B0B7D0F76A320F251309F46AE71E0C771D8A1C382

Function 000001A4D6831000 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeNameForVolumeMountPointA.KERNEL32 ref: 000001A4D683104B

Memory Dump Source

Source File: 00000004.00000002.1398313298.000001A4D6831000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A4D6831000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1a4d6831000_rundll32.jbxd

Yara matches

Similarity

API ID: Volume$MountNamePoint
String ID:
API String ID: 1269602640-0
Opcode ID: 790c3e5c04854700e94b4d90c23288a0a6dd65ca27d7b0edd1071683d7a5972d
Instruction ID: 131554bf4b83254fbbe966492331522e344d6e21e317e4a9541586a809bcc982
Opcode Fuzzy Hash: 790c3e5c04854700e94b4d90c23288a0a6dd65ca27d7b0edd1071683d7a5972d
Instruction Fuzzy Hash: 9301A7306095448FFB06EB68D8987D677E1F7A9301F008169E0CAD72A6DEBC8548C741

Function 000001A4D6836F68 Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,?,?,?,?,?,000001A4D6836F64), ref: 000001A4D6836F93

Memory Dump Source

Source File: 00000004.00000002.1398313298.000001A4D6831000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A4D6831000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1a4d6831000_rundll32.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 05666283937c1f08677c7088b7fd24b6f81cfbeb3c6d91aeb7e4e1034e6939b2
Instruction ID: 01730e56d1a8e7736312aa78cfdf3457d9c4a986c1407a91dab1d54fbef7c90f
Opcode Fuzzy Hash: 05666283937c1f08677c7088b7fd24b6f81cfbeb3c6d91aeb7e4e1034e6939b2
Instruction Fuzzy Hash: 29D017303522084BEE187BFC59882AD26618B96305F0028387903DA6A7CEBA88898703

Function 000001A4D68320B0 Relevance: 1.5, APIs: 1, Instructions: 14
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32 ref: 000001A4D68320CA

Memory Dump Source

Source File: 00000004.00000002.1398313298.000001A4D6831000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A4D6831000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1a4d6831000_rundll32.jbxd

Yara matches

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: b1c7642022b5e6b88316a0d0a9cd98790ccd3d47a32ec667f729e349532e1fef
Instruction ID: f0c8c8b179c2aaeca1855f2f357fd550bc39611e5f4a8834ea67c0cbc9ad4e3c
Opcode Fuzzy Hash: b1c7642022b5e6b88316a0d0a9cd98790ccd3d47a32ec667f729e349532e1fef
Instruction Fuzzy Hash: 1DC0123016180847E708BB34EC595D136E4FB5C304FD089399407C5450E96D82844A82

Non-executed Functions

Function 000001A4D68340B0 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 463
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001A4D683410C

Part of subcall function 000001A4D6835054: __GetUnwindTryBlock.LIBCMT ref: 000001A4D6835097
Part of subcall function 000001A4D6835054: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001A4D68350BC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001A4D68341E4
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001A4D6834433
std::bad_alloc::bad_alloc.LIBCMT ref: 000001A4D683453F

Strings

csm, xrefs: 000001A4D6834126
csm, xrefs: 000001A4D683418D
csm, xrefs: 000001A4D6834207

Memory Dump Source

Source File: 00000004.00000002.1398313298.000001A4D6831000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A4D6831000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1a4d6831000_rundll32.jbxd

Yara matches

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 3ccd74b83f4e218917afb10b63cd26341559b906269fc65534a34942f520602e
Instruction ID: e8eb49f13a7e970506c8c7dc90cc66f5d498067f3f50763f99da6667166c39c2
Opcode Fuzzy Hash: 3ccd74b83f4e218917afb10b63cd26341559b906269fc65534a34942f520602e
Instruction Fuzzy Hash: E9F15130A26A488BEF54EF9CC4457E9B7E0FBAA310F50165DF449E7296DB70D881C782

Function 000001A4D6834930 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001A4D6834958
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001A4D6834A40

Strings

csm, xrefs: 000001A4D6834A92
csm, xrefs: 000001A4D683497A

Memory Dump Source

Source File: 00000004.00000002.1398313298.000001A4D6831000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A4D6831000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1a4d6831000_rundll32.jbxd

Yara matches

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: e27bbef9eb5f28e076bf3649e7203d2c4342c914ee4d718e56e88106427699c6
Instruction ID: 919c08c927ca7448f18671597605992a73b968bd6ba0c102b61d9be77edbd554
Opcode Fuzzy Hash: e27bbef9eb5f28e076bf3649e7203d2c4342c914ee4d718e56e88106427699c6
Instruction Fuzzy Hash: 03718330327A448BEFA49F9C80493A8F3D1FBE5311F546559A489E76A2CBB4D880C743

Function 000001A4D6832CF0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 233
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001A4D6832D1B
_IsNonwritableInCurrentImage.LIBCMT ref: 000001A4D6832DB2

Strings

csm, xrefs: 000001A4D6832D99

Memory Dump Source

Source File: 00000004.00000002.1398313298.000001A4D6831000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A4D6831000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1a4d6831000_rundll32.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: 43c5b6145a0bc1a6e7f1a4078bb18beee855f0c15013e264a2f6e222c992594d
Instruction ID: 33afbb498a14f84dd03a3e479683bc940dc537b28b03f8df01b605496ce78dd5
Opcode Fuzzy Hash: 43c5b6145a0bc1a6e7f1a4078bb18beee855f0c15013e264a2f6e222c992594d
Instruction Fuzzy Hash: FE71C63032AB048BDF68EEACD4967B4F3D0FBA5350F10556DF886D3197E764E8518682

Function 000001A4D6834580 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 233
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001A4D683462B

Strings

RCC, xrefs: 000001A4D68345FB
MOC, xrefs: 000001A4D68345F3

Memory Dump Source

Source File: 00000004.00000002.1398313298.000001A4D6831000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A4D6831000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1a4d6831000_rundll32.jbxd

Yara matches

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 9263fe20008c7eccda2d837675211652d6c96f36503d8c2c93f65cb69d80355e
Instruction ID: af51304011cd7c1b6a2c9470b4bea969e20eed39acb2c560ef655363157daf05
Opcode Fuzzy Hash: 9263fe20008c7eccda2d837675211652d6c96f36503d8c2c93f65cb69d80355e
Instruction Fuzzy Hash: 7B71713062AB488FEB649F5CD446BEAB7E0FBEA300F04565DE489D3251D7B4A581C783

Analysis Process: rundll32.exePID: 7604, Parent PID: 7520COMMON

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	23
Total number of Limit Nodes:	2

Executed Functions

Function 00000256F16820E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00000256F168211D
GetLocaleInfoA.KERNELBASE ref: 00000256F16821E5

Strings

5, xrefs: 00000256F168225D

Memory Dump Source

Source File: 00000005.00000002.1397725168.00000256F1681000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000256F1681000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_256f1681000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateInfoLocaleThread
String ID: 5
API String ID: 899703944-2226203566
Opcode ID: 53e6023148aec332c40765bce66317f8f0d3847e40e453e3a9759d4f43b705e2
Instruction ID: 2064c82a523a92eaa310cb5f767335aac641ce8aa79d4a792e18bd63364c5d6b
Opcode Fuzzy Hash: 53e6023148aec332c40765bce66317f8f0d3847e40e453e3a9759d4f43b705e2
Instruction Fuzzy Hash: 5E41E030618A488BE718EB24EC9C7AA73E1FFC5356F84852DE147C35A5DE388485CA42

Function 00000256F1681000 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeNameForVolumeMountPointA.KERNEL32 ref: 00000256F168104B

Memory Dump Source

Source File: 00000005.00000002.1397725168.00000256F1681000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000256F1681000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_256f1681000_rundll32.jbxd

Yara matches

Similarity

API ID: Volume$MountNamePoint
String ID:
API String ID: 1269602640-0
Opcode ID: 790c3e5c04854700e94b4d90c23288a0a6dd65ca27d7b0edd1071683d7a5972d
Instruction ID: 298586c9a6518ae8f27d551410110a653ae590960d51f6ddbf6f1f81eeb42c58
Opcode Fuzzy Hash: 790c3e5c04854700e94b4d90c23288a0a6dd65ca27d7b0edd1071683d7a5972d
Instruction Fuzzy Hash: 4001443050C9448FFB06AB28DC9C7D677A1FB69305F008569E0CAC72A6DEBC8558C741

Function 00000256F1686F68 Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,?,?,?,?,?,00000256F1686F64), ref: 00000256F1686F93

Memory Dump Source

Source File: 00000005.00000002.1397725168.00000256F1681000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000256F1681000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_256f1681000_rundll32.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 05666283937c1f08677c7088b7fd24b6f81cfbeb3c6d91aeb7e4e1034e6939b2
Instruction ID: 8d00a4cf073707d8f916e81507c7ac66a974beb0fc161415a07d012f58d79eef
Opcode Fuzzy Hash: 05666283937c1f08677c7088b7fd24b6f81cfbeb3c6d91aeb7e4e1034e6939b2
Instruction Fuzzy Hash: 09D05B207047040FFB187BBDED8C32D2652CF46256F4018386903C7AE7CD3AC8858706

Function 00000256F16820B0 Relevance: 1.5, APIs: 1, Instructions: 14
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32 ref: 00000256F16820CA

Memory Dump Source

Source File: 00000005.00000002.1397725168.00000256F1681000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000256F1681000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_256f1681000_rundll32.jbxd

Yara matches

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: b1c7642022b5e6b88316a0d0a9cd98790ccd3d47a32ec667f729e349532e1fef
Instruction ID: f0c8c8b179c2aaeca1855f2f357fd550bc39611e5f4a8834ea67c0cbc9ad4e3c
Opcode Fuzzy Hash: b1c7642022b5e6b88316a0d0a9cd98790ccd3d47a32ec667f729e349532e1fef
Instruction Fuzzy Hash: 1DC0123016180847E708BB34EC595D136E4FB5C304FD089399407C5450E96D82844A82

Non-executed Functions

Function 00000256F16840B0 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 463
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000256F168410C

Part of subcall function 00000256F1685054: __GetUnwindTryBlock.LIBCMT ref: 00000256F1685097
Part of subcall function 00000256F1685054: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000256F16850BC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000256F16841E4
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000256F1684433
std::bad_alloc::bad_alloc.LIBCMT ref: 00000256F168453F

Strings

csm, xrefs: 00000256F168418D
csm, xrefs: 00000256F1684126
csm, xrefs: 00000256F1684207

Memory Dump Source

Source File: 00000005.00000002.1397725168.00000256F1681000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000256F1681000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_256f1681000_rundll32.jbxd

Yara matches

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 3ccd74b83f4e218917afb10b63cd26341559b906269fc65534a34942f520602e
Instruction ID: 1036e3c4edf0542babd7cbda5c5379607e0844dc5bf13773b147de1d09d24d22
Opcode Fuzzy Hash: 3ccd74b83f4e218917afb10b63cd26341559b906269fc65534a34942f520602e
Instruction Fuzzy Hash: EEF15230918F488BEB54EF58D84D7A977E0FF6A362F94065DD48AC3A52DB30D881C786

Function 00000256F1684930 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000256F1684958
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000256F1684A40

Strings

csm, xrefs: 00000256F168497A
csm, xrefs: 00000256F1684A92

Memory Dump Source

Source File: 00000005.00000002.1397725168.00000256F1681000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000256F1681000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_256f1681000_rundll32.jbxd

Yara matches

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: e27bbef9eb5f28e076bf3649e7203d2c4342c914ee4d718e56e88106427699c6
Instruction ID: 960fcf7b07b167074c14c109c38458511a3d680759cdad7954196b825fbc26b7
Opcode Fuzzy Hash: e27bbef9eb5f28e076bf3649e7203d2c4342c914ee4d718e56e88106427699c6
Instruction Fuzzy Hash: B5718230918E048FEBB49B18D88D364B7D1FF65362F94465E948AC7AD6DB30D8C0C74A

Function 00000256F1682CF0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 233
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000256F1682D1B
_IsNonwritableInCurrentImage.LIBCMT ref: 00000256F1682DB2

Strings

csm, xrefs: 00000256F1682D99

Memory Dump Source

Source File: 00000005.00000002.1397725168.00000256F1681000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000256F1681000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_256f1681000_rundll32.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: 43c5b6145a0bc1a6e7f1a4078bb18beee855f0c15013e264a2f6e222c992594d
Instruction ID: bf06d5b11f17532113324fba1e47f7106e255149bb1e48a34d0c456853930dbb
Opcode Fuzzy Hash: 43c5b6145a0bc1a6e7f1a4078bb18beee855f0c15013e264a2f6e222c992594d
Instruction Fuzzy Hash: C371A230A0CE048BDB28EE5CE88D77477D1FB553A6F50456EE887C36D6E630E891C689

Function 00000256F1684580 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 233
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000256F168462B

Strings

RCC, xrefs: 00000256F16845FB
MOC, xrefs: 00000256F16845F3

Memory Dump Source

Source File: 00000005.00000002.1397725168.00000256F1681000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000256F1681000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_256f1681000_rundll32.jbxd

Yara matches

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 9263fe20008c7eccda2d837675211652d6c96f36503d8c2c93f65cb69d80355e
Instruction ID: eb18e89e7fe324dd593fc75f5023e27facc1d2f2fa38d5649df3da4a2de5abb7
Opcode Fuzzy Hash: 9263fe20008c7eccda2d837675211652d6c96f36503d8c2c93f65cb69d80355e
Instruction Fuzzy Hash: 2C71A13091CB488FE764EF18D84ABA6B7E0FFAA351F44065DE48AC3151D774E4C18786

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Db5aU9VNyz.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Exports

Possible Origin

Network Behavior

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: loaddll64.exePID: 7520, Parent PID: 3504

General

Chronological Activities

Analysis Process: conhost.exePID: 7528, Parent PID: 7520

Windows Analysis Report
Db5aU9VNyz.dll

Function 0000022A4F5720E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 134
threadCOMMON

Function 00007FF8E83B1000 Relevance: .1, Instructions: 103
COMMON

Function 0000022A4F57A87C Relevance: 1.6, APIs: 1, Instructions: 104
COMMON

Function 0000022A4F571000 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Function 0000022A4F576F68 Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Function 0000022A4F5720B0 Relevance: 1.5, APIs: 1, Instructions: 14
windowCOMMON

Function 0000022A4F5740B0 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 463
COMMON

Function 0000022A4F574930 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 201
COMMON

Function 0000022A4F572CF0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 233
COMMON

Function 0000022A4F574580 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 233
COMMON

Function 00C220E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134
threadCOMMON

Function 00C21000 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Function 00C26F68 Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Function 00C220B0 Relevance: 1.5, APIs: 1, Instructions: 14
windowCOMMON

Function 00C240B0 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 463
COMMON

Function 00C24930 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 201
COMMON

Function 00C22CF0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 233
COMMON

Function 00C24580 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 233
COMMON