Edit tour

Windows Analysis Report
GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Overview

General Information

Sample name:	GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe
Analysis ID:	1562196
MD5:	f1ea1b78865f0eea18a4821f45f10948
SHA1:	4a5650f660f478df65cde9a2caebbc1dbe8c8d74
SHA256:	31280f11bf64367779cdf2d9e04b62fd7ad53c28fd44bdf70e7793583793aca3
Tags:	AgentTeslaexeuser-threatcat_ch
Infos:

Detection

AgentTesla, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected PureLog Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe (PID: 6644 cmdline: "C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe" MD5: F1EA1B78865F0EEA18A4821F45F10948)

powershell.exe (PID: 2680 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 6508 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe (PID: 3448 cmdline: "C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe" MD5: F1EA1B78865F0EEA18A4821F45F10948)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "zqamcx.com", "Username": "sender@zqamcx.com", "Password": "Methodman991"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.4485380510.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.4485380510.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.4486703238.0000000002F98000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2057678679.0000000006820000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000005.00000002.4486703238.0000000002F6E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.4486703238.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.4486703238.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2050350308.00000000035B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2050350308.00000000035B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2050350308.00000000035B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe PID: 6644	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe PID: 6644	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe PID: 6644	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe PID: 3448	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe PID: 3448	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.6820000.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.6820000.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.35ce790.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.3837a90.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.3837a90.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.3837a90.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33205:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33277:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33301:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33393:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x333fd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3346f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33505:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33595:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33205:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33277:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33301:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33393:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x333fd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3346f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33505:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33595:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35005:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35077:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35101:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35193:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x351fd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3526f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35305:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35395:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35005:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x71825:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35077:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x71897:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35101:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x71921:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35193:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x719b3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x351fd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x71a1d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3526f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x71a8f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35305:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x71b25:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35395:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x71bb5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.3837a90.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.3837a90.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.3837a90.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.3837a90.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35005:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35077:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35101:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35193:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x351fd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3526f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35305:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35395:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.35ce790.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.35ce790.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.35ce790.1.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.35ce790.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.35ce790.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.35ce790.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0xd4845:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x261ae5:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x29e305:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xd48b7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x261b57:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x29e377:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xd4941:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x261be1:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x29e401:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xd49d3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x261c73:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x29e493:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xd4a3d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x261cdd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x29e4fd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xd4aaf:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x261d4f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x29e56f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xd4b45:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x261de5:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x29e605:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.35ce790.1.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x10e89:$s1: file:/// 0x10de5:$s2: {11111-22222-10009-11112} 0x10e19:$s3: {11111-22222-50001-00000} 0xf1b3:$s4: get_Module 0xd1536:$s5: Reverse 0x25e7d6:$s5: Reverse 0x29aff6:$s5: Reverse 0xd400d:$s6: BlockCopy 0x2612ad:$s6: BlockCopy 0x29dacd:$s6: BlockCopy 0x2dec54:$s6: BlockCopy 0xd17db:$s7: ReadByte 0x25ea7b:$s7: ReadByte 0x29b29b:$s7: ReadByte 0x2deacc:$s7: ReadByte 0x10e9b:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
Click to see the 22 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe", ParentImage: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, ParentProcessId: 6644, ParentProcessName: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe", ProcessId: 2680, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 78.110.166.82, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, Initiated: true, ProcessId: 3448, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49709

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe", ParentImage: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, ParentProcessId: 6644, ParentProcessName: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe", ProcessId: 2680, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 5.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "zqamcx.com", "Username": "sender@zqamcx.com", "Password": "Methodman991"}

Multi AV Scanner detection for submitted file

Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Joe Sandbox ML: detected

Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: aYmp.pdb source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe
Source:	Binary string: aYmp.pdbSHA256 source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.3837a90.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.35ce790.1.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.5:49709 -> 78.110.166.82:587

Source: Joe Sandbox View

IP Address: 78.110.166.82 78.110.166.82

Source: global traffic

TCP traffic: 192.168.2.5:49709 -> 78.110.166.82:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: zqamcx.com

Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4495402281.000000000667E000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486074525.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486074525.0000000001311000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486703238.0000000003112000.00000004.00000800.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486703238.0000000002F76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/0#
Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4495402281.000000000667E000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486074525.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486074525.0000000001311000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486703238.0000000003112000.00000004.00000800.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486703238.0000000002F76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000000.00000002.2041030544.00000000025F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4495402281.000000000667E000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486074525.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486074525.0000000001311000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486703238.0000000003112000.00000004.00000800.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486703238.0000000002F76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4495402281.000000000667E000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486074525.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486074525.0000000001311000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486703238.0000000003112000.00000004.00000800.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486703238.0000000002F76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486703238.0000000003112000.00000004.00000800.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486703238.0000000002F76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://zqamcx.com
Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000000.00000002.2050350308.00000000035B1000.00000004.00000800.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4485380510.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.raw.unpack, O9KGcRw9bkp.cs	.Net Code: KAZ
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.3837a90.0.raw.unpack, O9KGcRw9bkp.cs	.Net Code: KAZ

Installs a global keyboard hook

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.3837a90.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.3837a90.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.35ce790.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.35ce790.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 0_2_00BFD344	0_2_00BFD344
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 0_2_069CF2F8	0_2_069CF2F8
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 0_2_069C9658	0_2_069C9658
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 0_2_069C0559	0_2_069C0559
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 0_2_069C0560	0_2_069C0560
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 0_2_069C9200	0_2_069C9200
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 0_2_069C9220	0_2_069C9220
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 0_2_069CB168	0_2_069CB168
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 0_2_069CAD30	0_2_069CAD30
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 0_2_069C9A90	0_2_069C9A90
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 5_2_01579B40	5_2_01579B40
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 5_2_01574A88	5_2_01574A88
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 5_2_0157CDC0	5_2_0157CDC0
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 5_2_01573E70	5_2_01573E70
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 5_2_015741B8	5_2_015741B8
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 5_2_0157F4A8	5_2_0157F4A8
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 5_2_0642C900	5_2_0642C900
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 5_2_064213D8	5_2_064213D8
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 5_2_06445760	5_2_06445760
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 5_2_06442F08	5_2_06442F08
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 5_2_06448C0A	5_2_06448C0A
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 5_2_0644DD90	5_2_0644DD90
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 5_2_06440040	5_2_06440040
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 5_2_06443637	5_2_06443637
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 5_2_0644BD90	5_2_0644BD90
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 5_2_06445068	5_2_06445068
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 5_2_064449E8	5_2_064449E8

Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Static PE information: invalid certificate

Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000000.00000000.2024165682.0000000000264000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameaYmp.exe@ vs GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe
Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000000.00000002.2050350308.00000000035B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe
Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000000.00000002.2050350308.00000000035B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb9cb78e8-c1d3-4ab9-8530-a3a5b5ca79e5.exe4 vs GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe
Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000000.00000002.2050350308.00000000035B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe
Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000000.00000002.2057678679.0000000006820000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe
Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000000.00000002.2060477649.0000000007310000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe
Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000000.00000002.2041030544.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe
Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000000.00000002.2041030544.00000000025F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb9cb78e8-c1d3-4ab9-8530-a3a5b5ca79e5.exe4 vs GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe
Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000000.00000002.2060193650.0000000007280000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe
Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000000.00000002.2038171858.000000000070E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe
Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4485380510.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb9cb78e8-c1d3-4ab9-8530-a3a5b5ca79e5.exe4 vs GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe
Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4485553488.0000000000D99000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe
Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Binary or memory string: OriginalFilenameaYmp.exe@ vs GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.3837a90.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.3837a90.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.35ce790.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.35ce790.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.raw.unpack, CMa60k.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.raw.unpack, CMa60k.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.raw.unpack, CMa60k.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.raw.unpack, CMa60k.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.raw.unpack, EgTglEucnUn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.raw.unpack, EgTglEucnUn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.raw.unpack, MmVR.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.raw.unpack, MmVR.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, ywV4egyJHNBKnEJKLL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, AN9xAWVwQAXkleQq7U.cs	Security API names: _0020.SetAccessControl
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, AN9xAWVwQAXkleQq7U.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, AN9xAWVwQAXkleQq7U.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/6@1/1

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5708:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4i05ubpq.vs3.ps1

Jump to behavior

Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

ReversingLabs: Detection: 36%

Source: unknown	Process created: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe "C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe"
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process created: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe "C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe"	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process created: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe "C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe"	Jump to behavior

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: aYmp.pdb source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe
Source:	Binary string: aYmp.pdbSHA256 source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.35ce790.1.raw.unpack, id.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.6820000.3.raw.unpack, id.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, LogInGUI.cs	.Net Code: InitializeComponent contains xor as well as GetObject
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, AN9xAWVwQAXkleQq7U.cs	.Net Code: qgj9Le1Dfd System.Reflection.Assembly.Load(byte[])

Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Static PE information: 0xFD42D076 [Sun Aug 24 09:46:30 2104 UTC]

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 0_2_069CC5DD push eax; retf	0_2_069CC5DE
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 0_2_069C8AC8 push eax; retf	0_2_069C8AC9
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Code function: 0_2_069C8BA6 push esp; retf	0_2_069C8BA7

Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Static PE information: section name: .text entropy: 7.937984443380174

Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, vg0BmkzqcWbhSpc1ro.cs	High entropy of concatenated method names: 'lN0Bv31nek', 'lFlBybj76p', 'PmKBYRom6C', 'sQRB5IIN66', 'xcQBFC0sY6', 'Bc3Bs9FpaF', 'vT4BH8lx6N', 'XJ8BtAQjA8', 'kAjBxjCutA', 'VhlBSHu2tC'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, cNOZyfd9Zyk5qd2cCba.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'BfxXJ8A9fs', 'x2yXBrN8DY', 'NMOXfWRsZw', 'wnTXX8OSOZ', 'AFbXKIZRxa', 'FPBX4mtl3i', 'oR3XtyYKB7'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, yt3w9b7VrGIPcSbgeU.cs	High entropy of concatenated method names: 'R6cJgRxRwa', 'ugAJQysdcr', 'FQIJJ4Z0qT', 'PWUJf5d0XB', 'xFxJKs0f6h', 'eI4JtUvyTs', 'Dispose', 'VfTNEPkXZq', 'l6RNkEL7UX', 'yiqNeMBb8b'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, ywV4egyJHNBKnEJKLL.cs	High entropy of concatenated method names: 'RQokCEXHEV', 'kotkcxkjv7', 'jSck1WRdJL', 'fNdkUxI2py', 'rC3kOKWPIn', 'CqWkZbQH9f', 'WmHk7uHHcd', 'VKOk0MNUUR', 'bH8klAs6FO', 'G7vknxgRc4'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, fwI8gDYiykCFtX5xeu.cs	High entropy of concatenated method names: 'CZGe83hq2r', 'dNZevMRuD1', 'vAdeyLUU0R', 'R1neYKI1la', 'PnRegTM4p4', 'LNJeIq6a80', 'oOAeQamvjo', 'oHReN1hRM5', 'TSpeJdp5IZ', 'N38eBFbdty'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, bLwa3fmySUOnIfcfm9.cs	High entropy of concatenated method names: 'Yc8r6t8QVU', 'JHbraueCpV', 'MXbeqPV6u8', 'Opfes0Vs8N', 'SDmeHROBJQ', 'lYsepBOouq', 'gZNeDnA2rx', 'sMHeotB8G7', 'PnKeMuPyF1', 'A5peT6w58K'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, X1T086dwhacPHLM5JCJ.cs	High entropy of concatenated method names: 'ToString', 'qAnfypUlA0', 'KWifYrSwvv', 'VUifmV35fF', 'g0lf54qCqw', 'opwfFtVh2C', 'GyPfqCN2Jb', 'IYwfsiOXlc', 'liEjFi3Ho7wK872YC5j', 'Gbagrl3QwlSRDsbyKrN'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, jG0vMSDvHgE1Vbyiut.cs	High entropy of concatenated method names: 'Cp2PEdRStV', 'PcfPekssrF', 'kNkPALGyih', 'VYuAnclLXg', 'PU1Az1OmUB', 'edtPiHYfBc', 'u5OPdGNMP2', 'Ab4PwPFrp3', 'cLlP2rKkrq', 'MATP9Zfdna'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, cbrct8dd6OL0fdNecXH.cs	High entropy of concatenated method names: 'i0EBn4oBH4', 'FevBzYIYtZ', 'V8qfiWQGpp', 'vdWfdxVvNa', 'G5Wfw6DXb0', 'KGmf2FZv30', 'R95f9mnNQS', 'wTMfGZSNwW', 'XOffENX6K1', 'zZCfkAYeaE'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, AF6pDCZjpdWXnI4jIn.cs	High entropy of concatenated method names: 'BfjQ0CRby1', 'GL9QnNl1Li', 'g4jNi3RUjC', 'L0nNd0XU6N', 'MwLQb7b1jo', 'F5VQRHGxTn', 'W9aQW8vh3a', 'jYXQCjA9ae', 'xsVQcHPCRL', 'xl0Q1BqoqK'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, vu1SxwMQH0MeNCUMnU.cs	High entropy of concatenated method names: 'hO1PxWyEAQ', 'JafPSASD81', 'NXdPLIbP5C', 'agZP8ZmPgL', 'ftyP6Z8pSk', 'V1FPvB95nQ', 'yCZPaMl6Sj', 'V1lPyfRKUN', 'PhxPYF4uES', 'hJnPmmc9wZ'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, QjaLTc5DtZKrZVTjP0.cs	High entropy of concatenated method names: 'tQCAGXNnNq', 'qKUAkw36Rt', 'aHcArnT0DZ', 'MrJAP8DvgX', 'g5xAV8knV1', 'iGwrOZQXLT', 'w52rZh9Cif', 'ceVr7m1Z6X', 'XgPr0FCLDN', 'i4xrljOQSP'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, utXEBdky5Mri52Acxm.cs	High entropy of concatenated method names: 'Dispose', 'eIPdlcSbge', 'xVqwFdnA7D', 'zpGXOXqqjb', 'T70dnf6mV7', 'tpxdzsGpVk', 'ProcessDialogKey', 'IT6wiKYc43', 'HGIwdnHQCP', 'nv9wwYaI3V'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, Jss8H1Cp940khZn6tv.cs	High entropy of concatenated method names: 'kWZgTSm5Lx', 'chlgRBqbnF', 'QkngCq7Jcw', 'uRQgceWmuK', 'Q7VgFryImU', 'SRIgq0Lenw', 'IndgsLyeRF', 'MWtgHZ3Q91', 'DVFgpOGtRg', 'nrGgD4Af5G'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, h2gG4ydi2JpI5jL5rVT.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Ek3BbfMsky', 'w4FBRlA6WC', 'RRHBW8ZI3U', 'Pn5BCG7VmC', 'PWbBcGTYv9', 'QGqB1ofyoO', 'Yk5BUaq9W4'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, BKYc43lqGInHQCP3v9.cs	High entropy of concatenated method names: 'zl3J5oCo38', 'mskJFZ7MVx', 'SYCJqOhPUx', 'MX1Jsn1mJl', 'StwJHRQkrH', 'dxuJpKdR9r', 'iaFJDR0B4t', 'Mg3Jos7DQI', 'K1jJM21B97', 'xl7JTpv748'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, QS3LV81MsGOHg4YjUg.cs	High entropy of concatenated method names: 'ToString', 'qnSIbKUo3T', 'CafIFENlFY', 'V7WIqyc0XR', 'rFdIsqhxFW', 'Rq3IHLOiRM', 'hUAIpg57B1', 'S95ID2vqhG', 'v69Iof7Yf4', 'g7FIM1cWhn'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, AN9xAWVwQAXkleQq7U.cs	High entropy of concatenated method names: 'dEd2Gtgapj', 'SV62Evh5Fr', 'Puc2kRZc1Z', 'kZT2euIIcj', 'ttM2rFoZSI', 'Pu02AxgMbC', 'RAt2PugPZ1', 'hpJ2VBB3O4', 'XSd2jBnC1I', 'n802uBmn0l'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, yyYeAx9TJ5i7gmjhfP.cs	High entropy of concatenated method names: 'jGSdPwV4eg', 'sHNdVBKnEJ', 'LiydukCFtX', 'GxedhudLwa', 'tcfdgm9Wja', 'zTcdIDtZKr', 'XxMaCa5xiEeZCanSPJ', 'XtdOMqbMEDG2TRQP8b', 'ewFddN4Ge7', 'gKbd2uxBZI'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, EaI3VUnSAXRAnXnvDa.cs	High entropy of concatenated method names: 'VaTBeOkePn', 'XhuBrOsL33', 'BOaBAPeqDr', 'FbsBP3YawF', 'tEeBJulgQO', 'aq8BVPWe5D', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, CqSGQNUBRGJ0RKaRX6.cs	High entropy of concatenated method names: 'icbQu1fAcm', 'yr7Qhxu218', 'ToString', 'UXtQEQJJWL', 'luRQkycFDo', 'dmIQetpI5q', 'qhlQr4jtIu', 'hXdQAwsFnF', 'vSPQPoVRFY', 'hc6QVU70g3'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, DMvN7lWWbvuYFgyi7N.cs	High entropy of concatenated method names: 'S683yHk05c', 'eQr3YKMcjp', 'TqF35Y1sQw', 'S3H3FKOviE', 'aYN3scAg5M', 'hdO3HYfnqZ', 'Y0A3D03mQh', 'M9R3oh2Y5R', 'XXM3Tlhoxb', 'DAW3bVkC5t'
Source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.7280000.4.raw.unpack, yfX8EJwHvQdkXft9Ly.cs	High entropy of concatenated method names: 'iJ1LQ75lb', 'uMO83cjLb', 'ENlv9CSEH', 'ri7aShieu', 'kEHYlWmH3', 'pxvmBxQ4f', 'sBlNFS6dceBjoQLPLl', 'DAb4Zn7DYGwjbMiRaQ', 'W23NQ72pT', 'UmqBdgDyi'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate

Jump to behavior

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe PID: 6644, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Memory allocated: BD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Memory allocated: 25B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Memory allocated: 24F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Memory allocated: 7510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Memory allocated: 8510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Memory allocated: 86C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Memory allocated: 96C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Memory allocated: 1570000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Memory allocated: 2F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Memory allocated: 2E40000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6402	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3297	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Window / User API: threadDelayed 2815	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Window / User API: threadDelayed 6978	Jump to behavior

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 6464	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1680	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 4912	Thread sleep count: 2815 > 30	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -99860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 4912	Thread sleep count: 6978 > 30	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -99735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -99625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -99516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -99405s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -99281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -99172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -99047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -98893s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -98752s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -98610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -98484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -98371s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -98259s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -98141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -98016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -97891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -97782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -97657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -97532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -97422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -97313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -97188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -97075s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -96954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -96842s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -96719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -96610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -96500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -96375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -96266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -96156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -96047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -95938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -95813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -95703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -95594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -95469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -95360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -95235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -95110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -94996s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -94875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -94766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -94641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -94532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -94407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -94282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -94159s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -94032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -93907s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -93782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe TID: 5652	Thread sleep time: -93657s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 99860	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 99735	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 99625	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 99516	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 99405	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 99281	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 99172	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 99047	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 98893	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 98752	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 98610	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 98484	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 98371	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 98259	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 98141	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 98016	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 97891	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 97782	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 97657	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 97532	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 97422	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 97313	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 97188	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 97075	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 96954	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 96842	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 96719	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 96610	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 96500	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 96375	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 96266	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 96156	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 96047	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 95938	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 95813	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 95703	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 95594	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 95469	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 95360	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 95235	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 95110	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 94996	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 94875	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 94766	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 94641	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 94532	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 94407	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 94282	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 94159	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 94032	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 93907	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 93782	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Thread delayed: delay time: 93657	Jump to behavior

Source: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486074525.0000000001311000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe"
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Memory written: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe"			Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Process created: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe "C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe"			Jump to behavior

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Queries volume information: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Queries volume information: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.3837a90.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.3837a90.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.35ce790.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4485380510.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4486703238.0000000002F98000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4486703238.0000000002F6E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4486703238.0000000002F21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2050350308.00000000035B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe PID: 6644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe PID: 3448, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.6820000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.6820000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.35ce790.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.35ce790.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2057678679.0000000006820000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2050350308.00000000035B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match

File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.35ce790.1.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.3837a90.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.3837a90.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.35ce790.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4485380510.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4486703238.0000000002F21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2050350308.00000000035B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe PID: 6644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe PID: 3448, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.3837a90.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.37fb270.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.3837a90.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.35ce790.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4485380510.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4486703238.0000000002F98000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4486703238.0000000002F6E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4486703238.0000000002F21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2050350308.00000000035B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe PID: 6644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe PID: 3448, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.6820000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.6820000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.35ce790.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.35ce790.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2057678679.0000000006820000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2050350308.00000000035B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match

File source: 0.2.GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.35ce790.1.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	22 Software Packing	NTDS	111 Security Software Discovery	Distributed Component Object Model	21 Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	37%	ReversingLabs
GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
zqamcx.com	78.110.166.82	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://zqamcx.com	GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486703238.0000000003112000.00000004.00000800.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486703238.0000000002F76000.00000004.00000800.00020000.00000000.sdmp	false	high
https://account.dyn.com/	GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000000.00000002.2050350308.00000000035B1000.00000004.00000800.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4485380510.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
http://r11.o.lencr.org0#	GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4495402281.000000000667E000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486074525.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486074525.0000000001311000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486703238.0000000003112000.00000004.00000800.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486703238.0000000002F76000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000000.00000002.2041030544.00000000025F6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	false	high
http://r11.i.lencr.org/0#	GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4495402281.000000000667E000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486074525.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486074525.0000000001311000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486703238.0000000003112000.00000004.00000800.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486703238.0000000002F76000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.c.lencr.org/0	GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4495402281.000000000667E000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486074525.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486074525.0000000001311000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486703238.0000000003112000.00000004.00000800.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486703238.0000000002F76000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/0	GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4495402281.000000000667E000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486074525.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486074525.0000000001311000.00000004.00000020.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486703238.0000000003112000.00000004.00000800.00020000.00000000.sdmp, GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe, 00000005.00000002.4486703238.0000000002F76000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/DataSet1.xsd	GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
78.110.166.82	zqamcx.com	United Kingdom		42831	UKSERVERS-ASUKDedicatedServersHostingandCo-Location	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562196
Start date and time:	2024-11-25 10:33:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/6@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 87 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Simulations

Behavior and APIs

Time	Type	Description
04:33:56	API Interceptor	9300054x Sleep call for process: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe modified
04:33:58	API Interceptor	12x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
78.110.166.82	COB756883.vbs	Get hash	malicious	CobaltStrike	Browse	windowsupdatesolutions.com/ServerCOB.txt
	Ingreso_SII_Abril_2021.cmd	Get hash	malicious	Unknown	Browse	www.emolcl.com/namaste/puma.php
	Ingreso_SII_Abril_2021.cmd	Get hash	malicious	Unknown	Browse	www.emolcl.com/namaste/puma.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
zqamcx.com	EKSTRE_1022.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	Halkbank_Ekstre_20241118_081142_787116.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	PO NO170300999.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UKSERVERS-ASUKDedicatedServersHostingandCo-Location	Quote GVSE24-00815.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	EKSTRE_1022.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	New_Order_Inquiry.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	Halkbank_Ekstre_20241118_081142_787116.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	(#U0130TOSAM) 11 KASIM 2024 HAFTALIK EKONOM#U0130 B#U00dcLTEN#U0130.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	PO NO170300999.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	sora.mips.elf	Get hash	malicious	Mirai	Browse	78.157.201.124
	RKsVnThLLP.exe	Get hash	malicious	Njrat	Browse	94.46.207.10

Process:	C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379460230152629
Encrypted:	false
SSDEEP:	48:fWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//MPUyus:fLHyIFKL3IZ2KRH9Ougss
MD5:	47AE6B38874AA66FC6688784E5F2EF18
SHA1:	AF71A58235AE5D80BDDA79DE907697354E5553F6
SHA-256:	F271AAB7854518D80F39793CBA35D7BFDABBFBCAC9DBD8F5E79EAE393BDC4C98
SHA-512:	D8FD735141FBF25FE4EFB88E973F4416A50EC0E065A297BC8B398FF96AD77EE852EA2E66BD3CAFED7C4C9EE9D24742C3D95F03DD13DBC6C1B57BFDB2F40EF1A3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4i05ubpq.vs3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b2zn5tjr.ay5.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b35f5gue.kwz.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pej3cim4.311.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.929601750867954
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe
File size:	740'360 bytes
MD5:	f1ea1b78865f0eea18a4821f45f10948
SHA1:	4a5650f660f478df65cde9a2caebbc1dbe8c8d74
SHA256:	31280f11bf64367779cdf2d9e04b62fd7ad53c28fd44bdf70e7793583793aca3
SHA512:	8cc7ff357c77376f53e51488fba5e36eae315b802992e80c66632378ede67cd83f0a2a6dfac960eccb41e674530998c2d0711d2d6adc7d6a6079991a4f0ffb8c
SSDEEP:	12288:6A0iJ3RbeXN4sa4qHqZa6f4FSL1dzYKiURhZHtrFJVbkR:6HiJ35eXNO4qif4giURhfZX+
TLSH:	C5F4128173B4DF92E2B95FF95815E34147F1E1162571E2088ECBA0DF2EC3B528A52B1B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v.B...............0..............)... ...@....@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4b291e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xFD42D076 [Sun Aug 24 09:46:30 2104 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	12/11/2018 19:00:00 08/11/2021 18:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb28ca	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb4000	0x628	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xb1600	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xafe78	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb0924	0xb0a00	1d3ba62c37e65f9f751d93f968c0034f	False	0.9481364450636943	data	7.937984443380174	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb4000	0x628	0x800	721fb21ebf9a640bd699ff833422233f	False	0.337890625	data	3.461386674263737	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb6000	0xc	0x200	1586dc2e121eb5309e4f79627e21fff3	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xb4090	0x398	OpenPGP Public Key			0.4206521739130435
RT_MANIFEST	0xb4438	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 10:34:00.999331951 CET	49709	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:01.120397091 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:01.120487928 CET	49709	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:02.541858912 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:02.542685032 CET	49709	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:02.662800074 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:02.939534903 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:02.939749956 CET	49709	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:03.060064077 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:03.335614920 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:03.342375994 CET	49709	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:03.463068962 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:03.748866081 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:03.748883009 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:03.748893976 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:03.749129057 CET	49709	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:03.775146008 CET	49709	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:03.894800901 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:04.186345100 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:04.199269056 CET	49709	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:04.321544886 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:04.597507954 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:04.598659992 CET	49709	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:04.718307972 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:04.993607998 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:04.994726896 CET	49709	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:05.114460945 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:05.403065920 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:05.403820038 CET	49709	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:05.524454117 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:05.798528910 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:05.805370092 CET	49709	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:05.924927950 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:06.211427927 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:06.215430021 CET	49709	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:06.335045099 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:06.610089064 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:06.611049891 CET	49709	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:06.611093044 CET	49709	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:06.611150026 CET	49709	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:06.611150026 CET	49709	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:06.732919931 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:06.732954979 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:06.734961987 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:06.734972000 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:07.117882967 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:07.168376923 CET	49709	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:07.169411898 CET	49709	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:07.289055109 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:07.616560936 CET	587	49709	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:07.620421886 CET	49709	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:07.620843887 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:07.741547108 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:07.741717100 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:08.982822895 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:08.983068943 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:09.102534056 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:09.378376961 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:09.378562927 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:09.498308897 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:09.774930000 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:09.775697947 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:09.895267010 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:10.199266911 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:10.199304104 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:10.199348927 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:10.199359894 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:10.199439049 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:10.201114893 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:10.320620060 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:10.596188068 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:10.597451925 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:10.717370033 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:10.992487907 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:10.992748022 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:11.113115072 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:11.388457060 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:11.388828993 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:11.508522034 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:11.795433044 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:11.795981884 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:11.915874004 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:12.191025019 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:12.191277981 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:12.310904980 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:12.597403049 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:12.597706079 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:12.717367887 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:12.992881060 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:12.994335890 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:12.994379044 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:12.994436026 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:12.994436026 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:12.994493008 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:12.994555950 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:12.994597912 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:12.994597912 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:12.994635105 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:12.994635105 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:13.293363094 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:13.518867970 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:13.518965960 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:34:13.519021034 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:13.519031048 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:13.519047022 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:13.519104004 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:13.519113064 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:13.519304991 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:13.519320011 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:13.519329071 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:13.519340038 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:13.519356966 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:13.519383907 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:13.834937096 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:34:13.887079000 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:35:40.340440035 CET	49712	587	192.168.2.5	78.110.166.82
Nov 25, 2024 10:35:40.459935904 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:35:40.736727953 CET	587	49712	78.110.166.82	192.168.2.5
Nov 25, 2024 10:35:40.740854025 CET	49712	587	192.168.2.5	78.110.166.82

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 10:34:00.334506989 CET	51598	53	192.168.2.5	1.1.1.1
Nov 25, 2024 10:34:00.986502886 CET	53	51598	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 10:34:00.334506989 CET	192.168.2.5	1.1.1.1	0x2347	Standard query (0)	zqamcx.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 10:34:00.986502886 CET	1.1.1.1	192.168.2.5	0x2347	No error (0)	zqamcx.com		78.110.166.82	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 25, 2024 10:34:02.541858912 CET	587	49709	78.110.166.82	192.168.2.5	220-cphost14.qhoster.net ESMTP Exim 4.96.2 #2 Mon, 25 Nov 2024 09:34:02 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 25, 2024 10:34:02.542685032 CET	49709	587	192.168.2.5	78.110.166.82	EHLO 618321
Nov 25, 2024 10:34:02.939534903 CET	587	49709	78.110.166.82	192.168.2.5	250-cphost14.qhoster.net Hello 618321 [8.46.123.75] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 25, 2024 10:34:02.939749956 CET	49709	587	192.168.2.5	78.110.166.82	STARTTLS
Nov 25, 2024 10:34:03.335614920 CET	587	49709	78.110.166.82	192.168.2.5	220 TLS go ahead
Nov 25, 2024 10:34:08.982822895 CET	587	49712	78.110.166.82	192.168.2.5	220-cphost14.qhoster.net ESMTP Exim 4.96.2 #2 Mon, 25 Nov 2024 09:34:08 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 25, 2024 10:34:08.983068943 CET	49712	587	192.168.2.5	78.110.166.82	EHLO 618321
Nov 25, 2024 10:34:09.378376961 CET	587	49712	78.110.166.82	192.168.2.5	250-cphost14.qhoster.net Hello 618321 [8.46.123.75] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 25, 2024 10:34:09.378562927 CET	49712	587	192.168.2.5	78.110.166.82	STARTTLS
Nov 25, 2024 10:34:09.774930000 CET	587	49712	78.110.166.82	192.168.2.5	220 TLS go ahead

Target ID:	0
Start time:	04:33:55
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe"
Imagebase:	0x1b0000
File size:	740'360 bytes
MD5 hash:	F1EA1B78865F0EEA18A4821F45F10948
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2057678679.0000000006820000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2050350308.00000000035B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2050350308.00000000035B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2050350308.00000000035B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:33:56
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe"
Imagebase:	0xbb0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:33:56
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:33:56
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe"
Imagebase:	0xb50000
File size:	740'360 bytes
MD5 hash:	F1EA1B78865F0EEA18A4821F45F10948
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.4485380510.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.4485380510.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.4486703238.0000000002F98000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.4486703238.0000000002F6E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.4486703238.0000000002F21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.4486703238.0000000002F21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	04:34:00
Start date:	25/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	177
Total number of Limit Nodes:	8

Executed Functions

Function 069CF2F8 Relevance: .6, Instructions: 641COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059478043.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 471e5741156c9ff531c85886e9afc437c6c8b4005d02bc630849c5b2d3fd8e8b
Instruction ID: 45b135c1e4db9426f470d2c683d0181de94b2b89d4f38d7e695e2e1102d5b162
Opcode Fuzzy Hash: 471e5741156c9ff531c85886e9afc437c6c8b4005d02bc630849c5b2d3fd8e8b
Instruction Fuzzy Hash: 2C32AC70B016089FDB59DB69C550BAEB7FBAF88710F2444ADE1069B7A1CB30ED05CB52

Function 069CBE55 Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 069CC096

Memory Dump Source

Source File: 00000000.00000002.2059478043.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1e7e50594565cb0896fc8a06514c753c3f56b6d13483df3dd2480fa6b3d6c71d
Instruction ID: ae4a497bd7bdb26fc94b569d1287c223e0cf1d2a8d12bf421c4f07757dd2cf20
Opcode Fuzzy Hash: 1e7e50594565cb0896fc8a06514c753c3f56b6d13483df3dd2480fa6b3d6c71d
Instruction Fuzzy Hash: 87A1AD71D00219DFEB60DF69C841BEDBBB6BF48310F1485AAE808A7244DB749985CF92

Function 069CBE60 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 069CC096

Memory Dump Source

Source File: 00000000.00000002.2059478043.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: be703a306e542162d2900afb2a80bdde405d97ce5ff7f5b46cb6c7a6261b3dfd
Instruction ID: b72a807202afcc484b45b444dac772cbb49c9ee02235457274a3a17396d64e5c
Opcode Fuzzy Hash: be703a306e542162d2900afb2a80bdde405d97ce5ff7f5b46cb6c7a6261b3dfd
Instruction Fuzzy Hash: D391AD71D00219DFEF60DF69C841BEDBBB2BF48310F14856AE808A7244DB749985CF92

Function 00BFAD88 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00BFAFDE

Memory Dump Source

Source File: 00000000.00000002.2040029296.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 18c9853f39160d9b4434cc1f68107f0577ca9105bd8158e73fe660af15f6057c
Instruction ID: daf4bb6d1c9f25fce5992652e64ac7c513f1712b2fd337c6c19b415bcc7d2132
Opcode Fuzzy Hash: 18c9853f39160d9b4434cc1f68107f0577ca9105bd8158e73fe660af15f6057c
Instruction Fuzzy Hash: C57157B0A00B098FD728DF29D48176ABBF5FF88304F10896DD58AD7A50DB34E949CB91

Function 00BF590C Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00BF59C9

Memory Dump Source

Source File: 00000000.00000002.2040029296.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: bcfd84d6d906e674449d8d3d8b91a4e757f5057376596a0b29154139c4efdc1e
Instruction ID: c70e9aacfa90c4338aaa61c783f344dff9f8b4980223af0cdbd97f7cca1e684f
Opcode Fuzzy Hash: bcfd84d6d906e674449d8d3d8b91a4e757f5057376596a0b29154139c4efdc1e
Instruction Fuzzy Hash: 4141E2B0C0061DCBDB24DFA9C88469DBBF5FF44704F20806AD508AB255DB75694ACF90

Function 00BF44B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00BF59C9

Memory Dump Source

Source File: 00000000.00000002.2040029296.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 77132e4e5f80d809c1332340dc812eed31a0eca3c259b9335ad546f4a227fdc6
Instruction ID: e73d8764c2f0f3540d16893b88a7727ac01d618562a7abec3c63c683146c15d2
Opcode Fuzzy Hash: 77132e4e5f80d809c1332340dc812eed31a0eca3c259b9335ad546f4a227fdc6
Instruction Fuzzy Hash: F841D1B0C00A1DCBDB24DFA9C884B9DBBF5FF49704F20816AD508AB255DB75694ACF90

Function 069CBBD1 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 069CBC68

Memory Dump Source

Source File: 00000000.00000002.2059478043.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d60a146f1360477f2b8bf5d83026efe08239f7699594757a6d16aa054ad0173b
Instruction ID: 7f7d41991c3af8bca3e18e0ecac098ae25b86a4a24178b75a28153a2684da17c
Opcode Fuzzy Hash: d60a146f1360477f2b8bf5d83026efe08239f7699594757a6d16aa054ad0173b
Instruction Fuzzy Hash: 782148B1D003499FCB10CFA9C885BEEBBF5FF48310F10842AE919A7240CB789944CBA1

Function 069CBBD8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 069CBC68

Memory Dump Source

Source File: 00000000.00000002.2059478043.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 546d5b0d4a4fd8d5f4c0430000b02ecaa6ab38e6a9249038508e4124c0884e1a
Instruction ID: 93e58f5557b47d3c6f0d29ca8631abe86e5496c91e7eb848d3b3e05cefd9b278
Opcode Fuzzy Hash: 546d5b0d4a4fd8d5f4c0430000b02ecaa6ab38e6a9249038508e4124c0884e1a
Instruction Fuzzy Hash: 9F2128B19003499FCB10DFA9C985BDEBBF5FF48310F508429E519A7240C7789944CBA1

Function 00BFD658 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00BFD626,?,?,?,?,?), ref: 00BFD6E7

Memory Dump Source

Source File: 00000000.00000002.2040029296.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 46e1956be1ec2e7c89bfbe871e0eee1553e6015b320f0d9439e94c129dabc5f2
Instruction ID: b28e0b39d4ebc477182e6205a434a5f931a43c3b945827c4ccd8654c788e82f9
Opcode Fuzzy Hash: 46e1956be1ec2e7c89bfbe871e0eee1553e6015b320f0d9439e94c129dabc5f2
Instruction Fuzzy Hash: E221E4B5900249AFDB10CFAAD585AEEBFF5FB48310F14805AE918A3350D378A945CFA5

Function 069CBCC0 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 069CBD48

Memory Dump Source

Source File: 00000000.00000002.2059478043.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 078d7a42ebc57c4a6375af627a3683ba652a465a72f1ea0b2f9e33c9fe6c21f3
Instruction ID: 50d30f57b6257eeabf5e57c39af039058fda3b3ad6377c449b4e95b3899ab87d
Opcode Fuzzy Hash: 078d7a42ebc57c4a6375af627a3683ba652a465a72f1ea0b2f9e33c9fe6c21f3
Instruction Fuzzy Hash: 1A212AB1C003499FCB10DFAAC881AEEFBF5FF48310F50842AE519A7250C7389945DBA1

Function 069CBA39 Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 069CBABE

Memory Dump Source

Source File: 00000000.00000002.2059478043.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 059d4dc0ee09408a538ec8e6473a15252c30d7d5858554838ffb0f397f3e02f6
Instruction ID: 4becdf8497fb72f38a4c2b8fc4b7005da4e800e75fd699ef11ef298a1ac7b5d1
Opcode Fuzzy Hash: 059d4dc0ee09408a538ec8e6473a15252c30d7d5858554838ffb0f397f3e02f6
Instruction Fuzzy Hash: 0C213771D003099FDB10DFAAC4857EEBBF8EF88324F14842AD459A7240CB789945CBA1

Function 00BFB770 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00BFD626,?,?,?,?,?), ref: 00BFD6E7

Memory Dump Source

Source File: 00000000.00000002.2040029296.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8d3d83aec6dac28b803032fde361e64c03ec0ed3f13fe4f8da4c94df3a08ebe9
Instruction ID: c0aee86a2f2e614fad0e9b4341f465a3790fa9ee874ab112aceeb5d137045d0c
Opcode Fuzzy Hash: 8d3d83aec6dac28b803032fde361e64c03ec0ed3f13fe4f8da4c94df3a08ebe9
Instruction Fuzzy Hash: C621E3B590024CAFDB10CF9AD584AEEBBF9FB48310F14805AE918A7310D378A944CFA5

Function 069CBCC8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 069CBD48

Memory Dump Source

Source File: 00000000.00000002.2059478043.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1877feb47846bf90bcf9d0cb6898f98600574dd8365265046bcdf14431234d10
Instruction ID: c412824d9b4f6230a1fd1e76fbde24655b8257bcb90feae245537181e994c069
Opcode Fuzzy Hash: 1877feb47846bf90bcf9d0cb6898f98600574dd8365265046bcdf14431234d10
Instruction Fuzzy Hash: 342107B1D003499FDB10DFAAC885AEEFBF5FF48320F50842AE519A7250C7799945CBA1

Function 069CBA40 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 069CBABE

Memory Dump Source

Source File: 00000000.00000002.2059478043.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 251580bcbe7267501c0964d953ce516e9807e3c22e3bec714210753599690f85
Instruction ID: ed4a5f9b6b48739b62410a88e7c0c8f68ac8a0fde6ce91f2954cb81aeb1267b6
Opcode Fuzzy Hash: 251580bcbe7267501c0964d953ce516e9807e3c22e3bec714210753599690f85
Instruction Fuzzy Hash: AB211871D003098FDB10DFAAC4857EEBBF8EF88324F54842AD559A7240CB789945CFA1

Function 069CBB11 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 069CBB86

Memory Dump Source

Source File: 00000000.00000002.2059478043.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a6d2f4b3eff2ec1371a2d972dc393effc7382d032e6ad6ea61918ef32fe289ab
Instruction ID: c96b89b719e227713d93fb1bbe29bbd2fe50caeacabb95a5da5397f520003055
Opcode Fuzzy Hash: a6d2f4b3eff2ec1371a2d972dc393effc7382d032e6ad6ea61918ef32fe289ab
Instruction Fuzzy Hash: D31159B1C003489FCB10DFAAC845AEEBFF5EF48320F108419E519A7250CB79A940CBA1

Function 069CBB18 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 069CBB86

Memory Dump Source

Source File: 00000000.00000002.2059478043.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 33237f2351526f9a0dc2cbc007a964ab71259c4d9b072c26459ee72933d16127
Instruction ID: cdbf3443d3095147112aacd194e73128e3b0ac5cf7cb65f7bab365b28390b543
Opcode Fuzzy Hash: 33237f2351526f9a0dc2cbc007a964ab71259c4d9b072c26459ee72933d16127
Instruction Fuzzy Hash: B4113771D002499FDB10DFAAC845AEEBFF5EF48320F208419E519A7254CB79A940CFA1

Function 069CB98B Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 069CB9F2

Memory Dump Source

Source File: 00000000.00000002.2059478043.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 495d074079cf82c46cce9f4ec7806c9661886f67f909994744edefe681a8015e
Instruction ID: ce6b72de6920e77c958b20928954bd91358d54cae2a8692e2b462adfbee4b517
Opcode Fuzzy Hash: 495d074079cf82c46cce9f4ec7806c9661886f67f909994744edefe681a8015e
Instruction Fuzzy Hash: 3E1158B5D002488ECB20DFAAC5457EEFFF5AF88324F24841AC559A7240CB38A940CBA5

Function 069CB990 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 069CB9F2

Memory Dump Source

Source File: 00000000.00000002.2059478043.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f3765f80cc4b7ce4f0c782f6ff1f6a8cad61b561495e71d95af495bf2794679e
Instruction ID: 775ff53b6cab81461e7329d04f2391df497a6877f34383116d8cd3ae2a60994c
Opcode Fuzzy Hash: f3765f80cc4b7ce4f0c782f6ff1f6a8cad61b561495e71d95af495bf2794679e
Instruction Fuzzy Hash: 97113AB1D003488FDB20DFAAC4457EEFBF9EF88324F208419D519A7240CB79A944CBA5

Function 069CE630 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 069CE695

Memory Dump Source

Source File: 00000000.00000002.2059478043.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 346f821ca6b72f42ad02963bd3460adbafea7166abd2349d33ba9aa360b1c7d3
Instruction ID: 280bc80cf2567c44cf675157ac5e6cbf1d84564d3d951e492fa7e9a50f12720f
Opcode Fuzzy Hash: 346f821ca6b72f42ad02963bd3460adbafea7166abd2349d33ba9aa360b1c7d3
Instruction Fuzzy Hash: 8A11E3B58003489FDB10DF9AD985BDEBFF8EB49320F10841AE959A3610C379A944CFA5

Function 00BFAF78 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00BFAFDE

Memory Dump Source

Source File: 00000000.00000002.2040029296.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9bae41217c25795a12a8f75e62d9add6b61ac57fd5b8181d75b2fb58c95a7dc7
Instruction ID: 22b9714281ed841e9057f54cc9b327d921b07c600efbef6e97ffaf385cd66de7
Opcode Fuzzy Hash: 9bae41217c25795a12a8f75e62d9add6b61ac57fd5b8181d75b2fb58c95a7dc7
Instruction Fuzzy Hash: 4F11E0B6C002498FDB14DF9AC444ADEFBF8EF88314F10845AD529B7610C379A945CFA1

Function 069C87D8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 069CE695

Memory Dump Source

Source File: 00000000.00000002.2059478043.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a1fa2844613fa4eb1dd47d01d8c4ce322450db44c9278268777a77a86ae78438
Instruction ID: acadbcd9a65b2527d4cf231f668b4274837263f9be30a2c4d426ff6fcb744d2e
Opcode Fuzzy Hash: a1fa2844613fa4eb1dd47d01d8c4ce322450db44c9278268777a77a86ae78438
Instruction Fuzzy Hash: 8911F2B58007489FDB50DF9AC984BDEBBF8EB48320F10841AE519A7600C379A944CFA5

Function 00B3D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2039515623.0000000000B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3d000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e9c4f5c80cfd99a77796c7da8808bc26ccb34bfb26a0458fea695ef5ee3513f
Instruction ID: ef6b6554c6be0b40ad0c4c328edc092eedb135389d4e1740492679b0689cca26
Opcode Fuzzy Hash: 0e9c4f5c80cfd99a77796c7da8808bc26ccb34bfb26a0458fea695ef5ee3513f
Instruction Fuzzy Hash: 4E21D675504204DFDB05DF14E9C0B16BFA5FB98314F34C5A9D9090B356C33AE856D7A2

Function 00B4D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2039618442.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b4d000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525b8037c429af99d0d523ed0639f46748744081c805112a581d991134484c33
Instruction ID: c3476bc7b9195a8175f0a3fcd3ae0b1706f871d0249ee9923b91751f25440c27
Opcode Fuzzy Hash: 525b8037c429af99d0d523ed0639f46748744081c805112a581d991134484c33
Instruction Fuzzy Hash: A9210771604204EFDB05DF14D5C0F26BBE5FB84314F20C6ADE9494B356C3BAD906EA61

Function 00B4D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2039618442.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b4d000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb037e002bcdd81699db290420c5b6263794be83ff631047af738dc8b157aa46
Instruction ID: 3019bb8f5e572b56c2fa4d7dee93dbd8375d6e6ef9be1457cefc49c3edf0ed68
Opcode Fuzzy Hash: eb037e002bcdd81699db290420c5b6263794be83ff631047af738dc8b157aa46
Instruction Fuzzy Hash: CE21F271604204DFCB14DF24D9D4B26BFA5FB88314F20C5ADD90A4B396C33AD907EA61

Function 00B4D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2039618442.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b4d000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d6a1f496babe06820b68e078bc0ed13f04cd103ea4080c7aeaa2b9a234fd8c6
Instruction ID: ce800401acfd3ebaec450fbcb2d4525e133772eaf4aa14fd3d700e1110987cbe
Opcode Fuzzy Hash: 4d6a1f496babe06820b68e078bc0ed13f04cd103ea4080c7aeaa2b9a234fd8c6
Instruction Fuzzy Hash: 292192755083809FCB02CF14D994B11BFB1FB46314F28C5DAD8498F2A7C33A990ADB62

Function 00B3D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2039515623.0000000000B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3d000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 5e3411505ce1f7722ca892bbef61f7d5a467f8b36aee67eba12626d180513224
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 4911E176504240CFCB02CF10E5C4B16BFB1FB94324F24C6A9D9490B356C33AE85ACBA2

Function 00B4D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2039618442.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b4d000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 5b9aa17b6c27ae2dd181818cea6a9fd8ef703097adb7b72b7afa231697c19ee2
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 8F11BB75504280DFCB02CF10C5C4B15BBA1FB84314F24C6A9D8494B296C37AD80ADB62

Function 00B3D759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2039515623.0000000000B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3d000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4928cb734ba9984eddad68a372bc8f13d0d6102caf1abe10c85730f7db3907fd
Instruction ID: d82b36343981e8a8a6c81f7e2fcfde60d3acf5a1603e3a77dfc98ed298d8d354
Opcode Fuzzy Hash: 4928cb734ba9984eddad68a372bc8f13d0d6102caf1abe10c85730f7db3907fd
Instruction Fuzzy Hash: 4B01A771104344DAD7218B15EDC4B66BFDCEF55320F38C9AAED094A286C6799C40C671

Function 00B3D758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2039515623.0000000000B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3d000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c03d2536e46124ccf3d6b0dd00577b2edbba331e677aa9ad0f596d40edee8b24
Instruction ID: ff1bcb25b6dcf6607defd4962ec9276651e445e8798b86c765078f2decd65241
Opcode Fuzzy Hash: c03d2536e46124ccf3d6b0dd00577b2edbba331e677aa9ad0f596d40edee8b24
Instruction Fuzzy Hash: 97F06271404344EEE7208A16DC84B62FFE8EF55724F28C55AED484B386C2799C44CAB1

Non-executed Functions

Function 069C9658 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059478043.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 649fe3e5bc8ac6dda7c82ba7042cf1c630cd7333855103c109d16e7479d376c7
Instruction ID: 1fafa7f0def0e2fab6921a465d477475f71b285e782153830e6565bad3e78658
Opcode Fuzzy Hash: 649fe3e5bc8ac6dda7c82ba7042cf1c630cd7333855103c109d16e7479d376c7
Instruction Fuzzy Hash: 1CE11774E001198FCB54DFA9C5809AEFBB2BF89355F24C169D409AB356D730AD42CFA1

Function 069C9220 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059478043.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20ec6f25e069916c6dade1ca301bd793e78a3b0971fcc8dfca5576ba0f14a5df
Instruction ID: 084dbaa45fe4ab7f85895f5c6cc0bf0b4b9db4c04f15531698d0a119cc67da0f
Opcode Fuzzy Hash: 20ec6f25e069916c6dade1ca301bd793e78a3b0971fcc8dfca5576ba0f14a5df
Instruction Fuzzy Hash: DBE10A74E001198FCB54DFA8C5809AEFBB2FF89315F24C169D418AB396D731A942CFA1

Function 069CB168 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059478043.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7da9aa4960f6252de5da5a10393f5a52cc9eea564c60ab3fcea57c9ca5842dc5
Instruction ID: dafc68856955f9a02233e2bdd4e1f012c1f3b47582f63be90b6dffc3a2761eca
Opcode Fuzzy Hash: 7da9aa4960f6252de5da5a10393f5a52cc9eea564c60ab3fcea57c9ca5842dc5
Instruction Fuzzy Hash: 53E11874E00119CFCB54DFA9C5819AEFBB2FF89315F248169D408AB35AD731A942CFA1

Function 069CAD30 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059478043.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76e0da67e3c1a9a7ed6012024c465228bd2b8286caf130cbc01450249c17fe11
Instruction ID: 4e83e3e4327c06cd1142ba14abd6ed0d03f49268ba863d04e15044ea8e1a7842
Opcode Fuzzy Hash: 76e0da67e3c1a9a7ed6012024c465228bd2b8286caf130cbc01450249c17fe11
Instruction Fuzzy Hash: E3E10874E001198FCB54DFA9C5809AEFBB2FF89315F64C169D418AB35AD730A942CFA1

Function 069C9A90 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059478043.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71f7b178a479660d99e7b150d722f07c7a4a6074c0462a528c1c954e835d0450
Instruction ID: 22b59f848e08679928a574e30928c5418d02c9d75c3d22d5d100510ff5cc699b
Opcode Fuzzy Hash: 71f7b178a479660d99e7b150d722f07c7a4a6074c0462a528c1c954e835d0450
Instruction Fuzzy Hash: 4BE11774E001198FCB54DFA8C5809AEFBF2BF89315F24C16AD409AB356D731A942CF61

Function 069C0559 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059478043.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6640a0b82e36c573282d19369e1f5ab0c73b4a603f8aecad999452eeddc51cf1
Instruction ID: 265675dc9acacc454ae3d5cfb132322ccc7627d00c55ea1eb4022d9c9ac44591
Opcode Fuzzy Hash: 6640a0b82e36c573282d19369e1f5ab0c73b4a603f8aecad999452eeddc51cf1
Instruction Fuzzy Hash: 40D11735C1065ACACB51EF64D990A9DF3B5EF95300F20C79AD50A77224FB70AAC9CB81

Function 00BFD344 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2040029296.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b83be8fab411fe845529607daeec5acc556b3b77380ee509986e816f92a90fef
Instruction ID: 97f1be976219c2fdf54944756ebb63b4418ca395b989f16f2ddfa91caea3e53f
Opcode Fuzzy Hash: b83be8fab411fe845529607daeec5acc556b3b77380ee509986e816f92a90fef
Instruction Fuzzy Hash: 7FA12D32A1020A8FCF15DFB5C8445BEB7F2FF85300B1545BAE905AB265DB71E95ACB40

Function 069C0560 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059478043.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b58ce16a1b086a30c563d44935ad3d009b348e06a00df4b02a9896b74b39eb24
Instruction ID: 2c38c600d61a21df7961351a97fdae6adaf5bfcc8dc326e8e26909b3bd68c379
Opcode Fuzzy Hash: b58ce16a1b086a30c563d44935ad3d009b348e06a00df4b02a9896b74b39eb24
Instruction Fuzzy Hash: E3D10735C1065ACACB51EF64D990A9DF3B5EF95300F20C79AD50A77224FB70AAC9CB81

Function 069C9200 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059478043.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2488bb3ff38757cab8639e482bb905ad94310f49e7e5690619d4445c2293aa8
Instruction ID: fa0cce6382fcec6be8be176df0d71229bf2477a8b3db3aaf58a7aa024472acb5
Opcode Fuzzy Hash: b2488bb3ff38757cab8639e482bb905ad94310f49e7e5690619d4445c2293aa8
Instruction Fuzzy Hash: 7B512C74E042198FCB14CFA9C9809AEFBF2BF89315F24C16AD408A7356D7319942CFA1

Analysis Process: GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exePID: 3448, Parent PID: 6644COMMON

Execution Graph

Execution Coverage:	12.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	82
Total number of Limit Nodes:	4

Executed Functions

Function 01579B40 Relevance: 2.8, Instructions: 2820COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bc00b95c1ab9a8c9a1fb226f9d86ba3ba63dfea5382b9d1fbe9349f2425f09f
Instruction ID: 3626f1cf99d621387477d5cdeb3494f53e068cb6144822b89e82d2e190a8ba6e
Opcode Fuzzy Hash: 1bc00b95c1ab9a8c9a1fb226f9d86ba3ba63dfea5382b9d1fbe9349f2425f09f
Instruction Fuzzy Hash: C353E631D10B1A8ADB51EF68C8805ADF7B1FF99300F15C79AE4587B121EB70AAD5CB81

Function 0157CDC0 Relevance: 2.3, Instructions: 2308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d62baf77c14b10428d7ceac7f69c3a045abf2a95790b738a941a3e829f573eee
Instruction ID: 7c50e06f7aa0c86888f0b4cecd9409bb657945bcc8fe33867a6024b20401d623
Opcode Fuzzy Hash: d62baf77c14b10428d7ceac7f69c3a045abf2a95790b738a941a3e829f573eee
Instruction Fuzzy Hash: C2332F31D1071A8EDB11EF68C8846ADF7B1FF99300F15C79AD459AB211EB70AAC5CB81

Function 01573E70 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\VBm, xrefs: 015740BB

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID: \VBm
API String ID: 0-971115878
Opcode ID: 68d1b5156e77242f39cbc2116e0c182fcda05a8dea665473a254b29dc1afd389
Instruction ID: d11058f31ed09def042ee5137dc2df6979aeba22b92e6ff478f600e4d0d052ef
Opcode Fuzzy Hash: 68d1b5156e77242f39cbc2116e0c182fcda05a8dea665473a254b29dc1afd389
Instruction Fuzzy Hash: 30918F70E00209DFDF10DFA9E9827EDBBF2BF88314F148129E415AB294EB749845CB81

Function 0157F4A8 Relevance: .7, Instructions: 687COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 662d9da61b417ff46107c9b805f9c4145684a1cb1263e927eaf9a399e55e189a
Instruction ID: 81cba01af2c882f15cafca2b207442ddf2ee3324fe6e95603a6d66a8ee2a3b8b
Opcode Fuzzy Hash: 662d9da61b417ff46107c9b805f9c4145684a1cb1263e927eaf9a399e55e189a
Instruction Fuzzy Hash: 4C524834A002058FDB25DB68D585AADBBF2FF48314F54846AD429EF356DB34EC82CB91

Function 01574A88 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 277937a98d51f1b4be347a446519db5d87a3b61fbd879704a2642f1f629fe0f1
Instruction ID: 2343d2ba141e215ae10175a423216b10280f195d3490a9bbc8b8bb1f8b22a475
Opcode Fuzzy Hash: 277937a98d51f1b4be347a446519db5d87a3b61fbd879704a2642f1f629fe0f1
Instruction Fuzzy Hash: BFB16F70E00209CFDF14CFA9E9867ADBBF6BF88314F148529D419EB294EB749845CB81

Function 0157FC38 Relevance: 2.7, Strings: 2, Instructions: 215
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(aq, xrefs: 0157FE12
(&]q, xrefs: 0157FD53

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID: (&]q$(aq
API String ID: 0-1602648543
Opcode ID: f28f673f37eea5d06b0fddfd1349ccf6bd3033e77c4fa98578da90acd36931e1
Instruction ID: 99ccf0aa7357f68c17b62f1a33df91a6f7366979462db0126b226c31ba03bc68
Opcode Fuzzy Hash: f28f673f37eea5d06b0fddfd1349ccf6bd3033e77c4fa98578da90acd36931e1
Instruction Fuzzy Hash: 5471A231F002199BDB59DFB9D8506AEBBB6BFC4700F14852AD416AB380DF309D06C7A1

Function 01574800 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\VBm, xrefs: 0157486F
\VBm, xrefs: 015749C2

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID: \VBm$\VBm
API String ID: 0-2856288231
Opcode ID: c085f0fa85e48afc1b252d50b1ecbe215740fd056e779c0772c22db2531fb430
Instruction ID: 5f8d2d61462328c54abe682bce4c63445565dad0286bc1ce3f710cdcbd4cdc69
Opcode Fuzzy Hash: c085f0fa85e48afc1b252d50b1ecbe215740fd056e779c0772c22db2531fb430
Instruction Fuzzy Hash: B1715C70E00209DFDB14DFADD8827AEBBF2BF88714F148129E415AB254EB749842CF95

Function 015747F4 Relevance: 2.7, Strings: 2, Instructions: 178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\VBm, xrefs: 0157486F
\VBm, xrefs: 015749C2

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID: \VBm$\VBm
API String ID: 0-2856288231
Opcode ID: 8fae7ac66195b2ed93e29b9a4a7aa03a13353f8ddcaef7859fa7024d11cbcdd7
Instruction ID: eac323fd1bc991c73aa74f802cf54ed608eda78e3e9ef1bc026b8e657fa145cb
Opcode Fuzzy Hash: 8fae7ac66195b2ed93e29b9a4a7aa03a13353f8ddcaef7859fa7024d11cbcdd7
Instruction Fuzzy Hash: FB714BB0D00249DFDB10DFADD9827AEBBF2BF48314F148129E419AB254EB749842CF95

Function 01576EC7 Relevance: 2.6, Strings: 2, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR]q, xrefs: 01576F96
LR]q, xrefs: 01576EFE

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID: LR]q$LR]q
API String ID: 0-3917262905
Opcode ID: 04e4e2dfb73e09a74178d3ef04c3a4b14befbcd4a2ddef7d3adc5e3f925ece28
Instruction ID: 8f202f469f40406ccb91cefaf3077b0e1ea6c176e14527956055083c853eabb4
Opcode Fuzzy Hash: 04e4e2dfb73e09a74178d3ef04c3a4b14befbcd4a2ddef7d3adc5e3f925ece28
Instruction Fuzzy Hash: A651E030A102058FEB16DF78E45579EBBB2FF89300F10846AE405EF281DB719846CB51

Function 0642E9A0 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.4494935733.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6420000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: dfe73088fcfbe5089c362f6e692c5f9b23261dafc4b005424df8777401406ccc
Instruction ID: d2d69849fad294330a99c8ee33038b7e78da1f6513286a0736194e29af73472c
Opcode Fuzzy Hash: dfe73088fcfbe5089c362f6e692c5f9b23261dafc4b005424df8777401406ccc
Instruction Fuzzy Hash: F1711270A00B168FD7A5DF6AD44475ABBF5BF88200F20892ED09AD7B50DB74E909CB90

Function 064266D3 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0642675F

Memory Dump Source

Source File: 00000005.00000002.4494935733.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6420000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ccc0e9c3eaf66f1ff51856149b24113df2990aed04ec26f53dcf6968957c1f83
Instruction ID: ea0922f2bdbb0f2279eea877a1e3d087f5e6101381295ca90408582d437b7a75
Opcode Fuzzy Hash: ccc0e9c3eaf66f1ff51856149b24113df2990aed04ec26f53dcf6968957c1f83
Instruction Fuzzy Hash: CD21E7B5D002199FDB10DF99D984ADEBFF8EB48310F14841AE914A7310D778A940CFA1

Function 064266D8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0642675F

Memory Dump Source

Source File: 00000005.00000002.4494935733.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6420000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0511eec4a45f34a63735c14b5913917b9a089d2ece6955cc3695a0b94ac3989c
Instruction ID: e37ca6f4530be8abba10cd5bbec8d26c003ce1cef20e1735e69cd9ca8e62f2f3
Opcode Fuzzy Hash: 0511eec4a45f34a63735c14b5913917b9a089d2ece6955cc3695a0b94ac3989c
Instruction Fuzzy Hash: 4021E3B5D002099FDB10DFAAD984ADEBBF8EB48310F14801AE918A3310D778A940CFA0

Function 06422768 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 064227EB

Memory Dump Source

Source File: 00000005.00000002.4494935733.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6420000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 15033187c5ddd3770a48dcbe58c77c8ed823a62c9888b7d1517da0376223db1c
Instruction ID: 5c8952926dbc1f83d6ab08db53c88dec35f96fb1843c50d58f61390a9a0b7af0
Opcode Fuzzy Hash: 15033187c5ddd3770a48dcbe58c77c8ed823a62c9888b7d1517da0376223db1c
Instruction Fuzzy Hash: 1921F575D042598FCB54DFA9C844BEFBBF5FB88310F24841AE459A7250C7749A41CFA1

Function 06422770 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 064227EB

Memory Dump Source

Source File: 00000005.00000002.4494935733.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6420000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 277cbdbf23ae3d6d34673b1d8c5a9a477485f96226f213f90497b1f32534c827
Instruction ID: 4ce484b16724d36a026f0b2a577d99a758916c953cc35da9b0669f244c316473
Opcode Fuzzy Hash: 277cbdbf23ae3d6d34673b1d8c5a9a477485f96226f213f90497b1f32534c827
Instruction Fuzzy Hash: EF2104B5D042198FCB54DF99C844BEEFBF5BB88310F20842AE418A7250C774A940CFA1

Function 0644E308 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(8B55063E), ref: 0644E377

Memory Dump Source

Source File: 00000005.00000002.4495059295.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6440000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: bed3af5e43080e1517ee3ef7ab05f2597be8a43aeaaa2e34422d17ef4011ae60
Instruction ID: 1bdd0b57dbbc0dd8e00481aeb8688f3d4f094c5196bb87536c8bf2e433b6e728
Opcode Fuzzy Hash: bed3af5e43080e1517ee3ef7ab05f2597be8a43aeaaa2e34422d17ef4011ae60
Instruction Fuzzy Hash: 691100B1C006599BDB10DF9AD545BEEFBB4FF48324F10812AE818A7250D778A945CFE1

Function 0644E310 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(8B55063E), ref: 0644E377

Memory Dump Source

Source File: 00000005.00000002.4495059295.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6440000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: a44138586356fca34cb6b1a4223ffc06ebd7397601062cf97b95720d12b872ca
Instruction ID: 8da1eaefb4f0f8b3fccdbd900510ecb6238252fe79821f781c28769927264341
Opcode Fuzzy Hash: a44138586356fca34cb6b1a4223ffc06ebd7397601062cf97b95720d12b872ca
Instruction Fuzzy Hash: EA111FB1C006599BCB10DF9AC444BAEFBF8BF48320F10812AD818A7250D778A940CFE1

Function 0642DE84 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,0642E9BC), ref: 0642EBF6

Memory Dump Source

Source File: 00000005.00000002.4494935733.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6420000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: add3b9555afbadbf246c8cf6c918db4e19e6f36457817ad47ce5d00f57388eb8
Instruction ID: 1418bb03025b63a5aafb753346caa6159ec4868433a702ffa7ad7b52108f7ee7
Opcode Fuzzy Hash: add3b9555afbadbf246c8cf6c918db4e19e6f36457817ad47ce5d00f57388eb8
Instruction Fuzzy Hash: 6211F0B5C003598FDB10DF9AC448AAEFBF4EB49210F20842AD529B7210D379A545CFA5

Function 01573E64 Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

\VBm, xrefs: 015740BB

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID: \VBm
API String ID: 0-971115878
Opcode ID: be3ffea30dcd5b2eb66abccf2081011b062e4ae089e5e74a0b192389078ed3b0
Instruction ID: c72a0bb51a4ffad96b4ccc461372cf88cb0a37506d3235ae37f6f8c5066770a7
Opcode Fuzzy Hash: be3ffea30dcd5b2eb66abccf2081011b062e4ae089e5e74a0b192389078ed3b0
Instruction Fuzzy Hash: C7917F70E00209DFDF10DFA9E9827EDBBF1BF88354F148129E419AB254EB749845CB91

Function 0157F31D Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0157F46B

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 98f57ef4b7d82df4e4a44dd5b72c26b6edf6655f84807d436d05327a67487e40
Instruction ID: 9894ab405c7ff49e6e5060a864f436a2b5da41af5ec10bca5f880c983d68406b
Opcode Fuzzy Hash: 98f57ef4b7d82df4e4a44dd5b72c26b6edf6655f84807d436d05327a67487e40
Instruction Fuzzy Hash: 64312030B002058FDB19AB38E46166E3BE7BF89240F204439D01ADB399DF35CC46CBA1

Function 01576F68 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01576F96

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 0818848cecc06194f963f6232c898cd8344eb81f177c544dfa204d8f96522fdd
Instruction ID: ca253f23e0c757e3322032054519fa44e60a9234e4a7925076995b6cde7020d6
Opcode Fuzzy Hash: 0818848cecc06194f963f6232c898cd8344eb81f177c544dfa204d8f96522fdd
Instruction Fuzzy Hash: EB319034E102099FEB16CFA8E45679DB7B1FF89300F508825E815EF240EB71A985CF51

Function 01576B91 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01576BC7

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 1b7fa009e74a7ea13617f9aacf80b1604be4b8babcd2c70cd8aea9c625b643cf
Instruction ID: 1decdb1921af7c2f5abb726241aeeea0a08bdad9ce1278af1d325f8120de95c7
Opcode Fuzzy Hash: 1b7fa009e74a7ea13617f9aacf80b1604be4b8babcd2c70cd8aea9c625b643cf
Instruction Fuzzy Hash: 8F2135327042068FC705AB7CD465B9E77F6EF85300F008869D009CB355DE798C468792

Function 01577910 Relevance: .6, Instructions: 554COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e6f355d0ddb3eef088b7fe0ff533477d6aafee34e5fbf00caff254c225d9e6
Instruction ID: 9471e55733ebf96965b737be42e9ffb1dc624fd8e3963687e76c9fa13f838063
Opcode Fuzzy Hash: f3e6f355d0ddb3eef088b7fe0ff533477d6aafee34e5fbf00caff254c225d9e6
Instruction Fuzzy Hash: D4123B307102069FCB6AAB38F555A2C37AAFB89314F104A39E416CB365CF75EC56CB91

Function 015796E8 Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84ff40c188dfaeb592f05a3ec26b82c9f9647b69337f6f519584c7b0cec33adb
Instruction ID: 0c578ffa17427399ba2c9dceb773cce59b62f4e71c4c746bb365686004a7b5fd
Opcode Fuzzy Hash: 84ff40c188dfaeb592f05a3ec26b82c9f9647b69337f6f519584c7b0cec33adb
Instruction Fuzzy Hash: 84D1D070B002058FDB14DF68E8817AEBBB6FB89324F14856AE509DF396D770D841CBA1

Function 0157936C Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5b1e1b1413bb9748caa9640145c8ec241e913675edd657be10d6259c7173d01
Instruction ID: 79b1551ce5b96c001d7d918564ecf2ae82065fc8b41760158972e2217afc2824
Opcode Fuzzy Hash: c5b1e1b1413bb9748caa9640145c8ec241e913675edd657be10d6259c7173d01
Instruction Fuzzy Hash: 26B19034A001058FCB19DFA8E595AADBBF6FF88324F204529E506DB395DB74DD42CBA0

Function 01574A7C Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 025adf7803bfa90e0c1422454076bd3fb75c694d6bdb1e1effcceaeaf54ccca7
Instruction ID: 3f42921daac7169a31e7733fd9711beedc14005c289dfcb24e466a703a084d3c
Opcode Fuzzy Hash: 025adf7803bfa90e0c1422454076bd3fb75c694d6bdb1e1effcceaeaf54ccca7
Instruction Fuzzy Hash: B5A15E70E00219CFDF10CFA9E9867ADBBF2BF88314F148529D459EB294EB749845CB81

Function 01576CCD Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31ded8a0ae0dd6c55a205eef0ce9cd99af3614a7cf5cc2cac9c42dc8870b87f9
Instruction ID: 33a6848e6472197248e1c71370a1820a68a04b45ba97f0781a801701557c256a
Opcode Fuzzy Hash: 31ded8a0ae0dd6c55a205eef0ce9cd99af3614a7cf5cc2cac9c42dc8870b87f9
Instruction Fuzzy Hash: 815114B0D106198FEB14CFA9D845B9DBBF1BF48304F148529D819BB391DB749844CF95

Function 01576CD8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acbf991be8736c2eec5adeb8a60386b82fe5866846745ea6088c1f48a793f7b2
Instruction ID: 4a2ea1ca36ea8cf206cad660d71c57ab7eb09310e6cbd4807d11e38b442e16c5
Opcode Fuzzy Hash: acbf991be8736c2eec5adeb8a60386b82fe5866846745ea6088c1f48a793f7b2
Instruction Fuzzy Hash: 67510270D106188FEB18CFA9D885B9EBBF1BF48314F148529E819BB291DB74A844CF95

Function 0157112A Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6655e0d5b78b7115499f452503384131506c2b584710dc50ba290c15e23a7c7f
Instruction ID: 2f643f72933992a41f02102a449789000171c5dbd03f1455170627d464297b50
Opcode Fuzzy Hash: 6655e0d5b78b7115499f452503384131506c2b584710dc50ba290c15e23a7c7f
Instruction Fuzzy Hash: 53510A7160224ADFCB79EFA8F9A1D443FA5FB653047004979D0059B63DDB386D49CB90

Function 01571138 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7575818e2de077ec643a10c7b5f5b1b3ed45974a35869c607cc6ff192771eba
Instruction ID: a2fe631cc428783b237cad8e6e23e0cbf2766698b8bb8225dcecd61b82e6fd21
Opcode Fuzzy Hash: f7575818e2de077ec643a10c7b5f5b1b3ed45974a35869c607cc6ff192771eba
Instruction Fuzzy Hash: FD51097020224ADFCB6AEFA8F9A1D443FA6FB653143008979D0049B23DDB386D49DB90

Function 0157F1E0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ced8dea66a0f2b796abbe77b0724fab9febb10334ddc32a846b43bca5af09ce
Instruction ID: 77a4c45b9992f63648b6b457fc101cb615a7e61deeec7901db690a4c90c170ca
Opcode Fuzzy Hash: 9ced8dea66a0f2b796abbe77b0724fab9febb10334ddc32a846b43bca5af09ce
Instruction Fuzzy Hash: 28316135E106059BCB19CFA9D89569EB7B6FF89300F10851AE816EB350DB70E942CB91

Function 01579257 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76510b7be62ba020adc8798780d5efdd50c3fdcb33420d7215e10b65b985e85e
Instruction ID: d7e68f6505664c5dd81d4b7650965f95abd36ee30f1fe6fee5eb9d716e3d78f3
Opcode Fuzzy Hash: 76510b7be62ba020adc8798780d5efdd50c3fdcb33420d7215e10b65b985e85e
Instruction Fuzzy Hash: 2831D330E0020A9BDB15DFA9E49579EF7B6FF84318F148519E805EF341DB749942CBA1

Function 015726CE Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e6051128d8f3b29ad46366b33f9c7519d9c958b675e7204dfa9974ecda92651
Instruction ID: 7d5fc3be225a51d3e7262d35bd03bcff6a2e3d4b903dec2753dac554e6ccc503
Opcode Fuzzy Hash: 6e6051128d8f3b29ad46366b33f9c7519d9c958b675e7204dfa9974ecda92651
Instruction Fuzzy Hash: C241FEB4D003499FDB10CFA9C985ADEBFB5FF08310F24842AE819AB254DB759946CB90

Function 0157F1F0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eaaee1be47a5bc785806f8905f5f1cf29363071a57b73fdd22690bbac20aa48
Instruction ID: c8afe02cea9b73235cc8792b0f5bd6b94371644907562dee4dd1414bc3336218
Opcode Fuzzy Hash: 2eaaee1be47a5bc785806f8905f5f1cf29363071a57b73fdd22690bbac20aa48
Instruction Fuzzy Hash: 81316034E106099BCB19CFA9D85569EB7B6BF89300F10851AE816EB350DB70ED42CB91

Function 015726D8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c4f0d1d74a92415de5076b90911bd8ce9bc5c66528eb7f4328d22643b6f8d2a
Instruction ID: 4330d83799dc70270da68fc7193a6652298ae13d7dee13fba79fc9fc070bf741
Opcode Fuzzy Hash: 1c4f0d1d74a92415de5076b90911bd8ce9bc5c66528eb7f4328d22643b6f8d2a
Instruction Fuzzy Hash: 3E410EB0D003489FDB10DFA9C584ADEBFF5FF48310F208429E809AB254DB75A946CB90

Function 0157168F Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c427b17a19272aaec4e4845ce645b7da4aa5e43511d14d6524dcecef6b74afa9
Instruction ID: 5d345b51a4d3480f603f26c30d32450fe700174cc7bb5536993af39f30970e1e
Opcode Fuzzy Hash: c427b17a19272aaec4e4845ce645b7da4aa5e43511d14d6524dcecef6b74afa9
Instruction Fuzzy Hash: 403106B96004068FDF36EA28F8D7B2D7759FB50304F100926E00ACF65AEB2CD846CB91

Function 01579268 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3b89228115ab4ef8b63d146392636e6b52c919fb2fec706285f77de016d4b94
Instruction ID: 5b74c8aa8b66260cd78fea0d9d9d2aa1a3c2f7f182334f0903c99e4195de8356
Opcode Fuzzy Hash: b3b89228115ab4ef8b63d146392636e6b52c919fb2fec706285f77de016d4b94
Instruction Fuzzy Hash: A921D334E0020A9BDB15DFA9E49169EF7B6FF89314F10C619E805EB341DB70D842CBA1

Function 01579159 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 405a9405058eef9dde2c6ed8a769ddfeb17a68da3acbb40700d1a6c86c56413e
Instruction ID: a385a61a8f5b2677b3837195aac52fa09a9384a6a9f0367fab85579150c74c95
Opcode Fuzzy Hash: 405a9405058eef9dde2c6ed8a769ddfeb17a68da3acbb40700d1a6c86c56413e
Instruction Fuzzy Hash: ED21C835E002099BCB15DFA4E8556DEF7B2FF89354F108519E815FB341DB709942CB61

Function 01574F7A Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d28bfe355e41d983c6d4944f1e473f523096dc14fceb61a53d28b0bc577e5b34
Instruction ID: 30cd4cf5c20ca532dadb47b0d6e3888cf431b2d907d00022a87fd1617fbbe9c6
Opcode Fuzzy Hash: d28bfe355e41d983c6d4944f1e473f523096dc14fceb61a53d28b0bc577e5b34
Instruction Fuzzy Hash: 21213934700209CFDB68EB79D559AAD77F2FB8D240B200478E506EB3A5DB369D41CB51

Function 01571868 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5910b5544fbf7c1fe1bceda693c9b1ddf5b0caa556dfea33519f7aeb60fb9f7
Instruction ID: 91a0486df789dbe62a16c1b361078c73070e45d07c33d26115396527ffc7b9e9
Opcode Fuzzy Hash: a5910b5544fbf7c1fe1bceda693c9b1ddf5b0caa556dfea33519f7aeb60fb9f7
Instruction Fuzzy Hash: 1D213E30B0060ACFDB65EB78D99ABAE77F1BB59245F100869D106EF394DB368D01CB91

Function 0157FE18 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e86380d8ceb701ae524748839302fc4d73beb1bc4123e1600b712f8339bc0beb
Instruction ID: 77b9e68ab34bc3c580ce56678f714490a61129440fd9a66e248189f608b0f3b9
Opcode Fuzzy Hash: e86380d8ceb701ae524748839302fc4d73beb1bc4123e1600b712f8339bc0beb
Instruction Fuzzy Hash: B911E1357083A81FDB4A6F78581046E3FAAEFC621071104AAE406CB292CE248D1283F6

Function 011ED124 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4485901761.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11ed000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fed436c68634bab86d0c5222eb9fca5f4593c0b080660a0d076b20ddc49d5e0
Instruction ID: 9d729be40d228c0f461f577956d0355ff67a99e2ec97c6dae38faa5fe08605ed
Opcode Fuzzy Hash: 9fed436c68634bab86d0c5222eb9fca5f4593c0b080660a0d076b20ddc49d5e0
Instruction Fuzzy Hash: 63213771604600DFDF09DFA8E9C8B26BBA5FB84314F20C5ADD9094B392C33AD446CB62

Function 01571370 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fb887a73336cd00726c4c2bcb7ed22dfb001b7a250f915befbdbd0b6bc82c4f
Instruction ID: 9559995dbb2ecac09723a81d8e318856d3662d1bed4f89a04946a87f2dd1f936
Opcode Fuzzy Hash: 4fb887a73336cd00726c4c2bcb7ed22dfb001b7a250f915befbdbd0b6bc82c4f
Instruction Fuzzy Hash: 902184746006118FDB3B577CF4DA76C3B6AFB42319F14056AE54ACF392DA29C885C742

Function 01579168 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb67c7de2801401ce09a44e1803ec016641b4dc0ea2a89a85bd473e720a43ddc
Instruction ID: 7991498fee7444d403689c131c864b2568c1c70db4e561fae12449c16e973abd
Opcode Fuzzy Hash: fb67c7de2801401ce09a44e1803ec016641b4dc0ea2a89a85bd473e720a43ddc
Instruction Fuzzy Hash: C121C630E002099BCB19DFA5E85599EF7B2FF89314F10C51AE815FB380DB70A941CBA1

Function 01571878 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42086cffd2eb6dd47953631a8df9177a2b3fd3a86801c08f04747d87d4da652b
Instruction ID: 055dcc41b85294ed29a209482484951ba730a9e01ea913737b592e559204feef
Opcode Fuzzy Hash: 42086cffd2eb6dd47953631a8df9177a2b3fd3a86801c08f04747d87d4da652b
Instruction Fuzzy Hash: 45213D30B00609CFDB65EB78D596BAE77F6BB89241F100868D506EF354DB368D05CBA1

Function 015716A0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c62da4d6663db17e44bbb7b4617507edbd5b39724d0b1ff4cf6b76a327de29c
Instruction ID: f8baaa757af92d8c77ae1461d921871ca87558876c12fe594d109284b0b812a7
Opcode Fuzzy Hash: 0c62da4d6663db17e44bbb7b4617507edbd5b39724d0b1ff4cf6b76a327de29c
Instruction Fuzzy Hash: 39216F786105068FDF36EA28F8D6B1D775AFB54304F104936E00ACF26ADB3CD8458B92

Function 01574F88 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80de7bddb80f98ae214506f754e136802e03693476c3b69b397d7e7aaf81c19b
Instruction ID: 16208504a4022fee30a3b242bbd799b4bfae626cdea3dea97bddb82ab8ee907b
Opcode Fuzzy Hash: 80de7bddb80f98ae214506f754e136802e03693476c3b69b397d7e7aaf81c19b
Instruction Fuzzy Hash: EB211634700209CFDB69EB79D559AAD77F2BB8D240B100468E506EB3A5EB329D44CB91

Function 01570848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b5242c1659d300f37fa988633f08e1be738808e2a597ab11037e022bc61781a
Instruction ID: 4d236d3db402a0099a9e697121e300bb08e8cd43f5361393b6f746d818649cb7
Opcode Fuzzy Hash: 2b5242c1659d300f37fa988633f08e1be738808e2a597ab11037e022bc61781a
Instruction Fuzzy Hash: A3119E30B102099BEF66AA7DE45676E76D5FB46214F20493AF00ACF2D2DA25DC858BC1

Function 01570838 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a6fa8fa49cf1c39d17102929e9ebe610fda990d69b32734f7d6fdc319c25d4b
Instruction ID: 62293f4e80ebb54d9c65e401c6177c3096b3212835fbef6b5c1e81c93c81acf5
Opcode Fuzzy Hash: 1a6fa8fa49cf1c39d17102929e9ebe610fda990d69b32734f7d6fdc319c25d4b
Instruction Fuzzy Hash: 6711C630B103059BEF665A78E41237E36D5FB82314F20493AF406CF2C2DA69DC818BC1

Function 015707F9 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e8c1170e51533a4be16621f84f58e49e046a9f51f5da633bc54e62b3d4ac505
Instruction ID: f427e3093a90aa9d4dd615701bd4fd5909f5578ca8dce837b9393f9d3b3247d7
Opcode Fuzzy Hash: 9e8c1170e51533a4be16621f84f58e49e046a9f51f5da633bc54e62b3d4ac505
Instruction Fuzzy Hash: 8411E371A002058BEF266A7DE5623AE36D5FF43218F144876F005CF2C2EA69D8868BC1

Function 01571478 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acc55d625ef891fb9088d0c4ec6e6847931dd28de2a51c431ddca489e84e3277
Instruction ID: 27583542611bb14796bfd701459adad482810a29a84efcd41fd77ee1ea22855b
Opcode Fuzzy Hash: acc55d625ef891fb9088d0c4ec6e6847931dd28de2a51c431ddca489e84e3277
Instruction Fuzzy Hash: C711A971E007168FCB55EFBC94961AD77F6FF55210B240479E805EB381D735D8428BA1

Function 015717B2 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 322c1a0feac6e40c6bcbb38bc33273ecc933f742fd3147d4d477a9acdd603920
Instruction ID: 1f0d06765ceaa929bdd8003bf93a79009ceacb0c5843d5b927a2d1cd6e773526
Opcode Fuzzy Hash: 322c1a0feac6e40c6bcbb38bc33273ecc933f742fd3147d4d477a9acdd603920
Instruction Fuzzy Hash: D8112B75B002159FCF50ABB5984575EBFE9FB48250F204839FA4AD7340EB34C9028792

Function 01571488 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 075f672658a3e29b8ba04fa8bc7fdfa4324261c7480105aca64bfff4d3967195
Instruction ID: 1de9eade13095958762121216b5dc8a069c83a253c129af3fd8b28ab8994a0d6
Opcode Fuzzy Hash: 075f672658a3e29b8ba04fa8bc7fdfa4324261c7480105aca64bfff4d3967195
Instruction Fuzzy Hash: E3018431E007168FCB65EFBC948119D7BF5FF89210B150479E805EB281E635D8428B91

Function 011ED11F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4485901761.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11ed000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: ec39450c98e5ef93bb6a65f63f8df05a5fd5153c0472a9476059ade8b04cb211
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 8F11D075504680CFDB0ACF58D9C4B15BFB1FB44314F24C6A9D8494B652C33AD44ACB62

Function 01579890 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e54c8d1fa14aca50cb44c141aa85d7c91cd26d808e0202cfd0f234cea5b0fd1
Instruction ID: 0204b3edad8c23f5b90df8e8acec2511bea7af3ee0d61e53b59e06e9de3277da
Opcode Fuzzy Hash: 2e54c8d1fa14aca50cb44c141aa85d7c91cd26d808e0202cfd0f234cea5b0fd1
Instruction Fuzzy Hash: 1C11C830A001058FDB18EF65E984B8ABBAAFF81314F648274C8485F299D7B4D946C7A1

Function 015780F8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6018db6fbffb02ada8bf0220822275c1b7436de27c882cc49827c69dfc6d2809
Instruction ID: 33f56496ab9394406d5b3db515431eb8923092d31efd9937ee4775797504b658
Opcode Fuzzy Hash: 6018db6fbffb02ada8bf0220822275c1b7436de27c882cc49827c69dfc6d2809
Instruction Fuzzy Hash: 19018F7494010EDFCB45EFA8F951A9C7BB6EF50204F104275C00997258DB39AA0A8B91

Function 01577080 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9e58f32f6fc4adbc623d10922dd3823403d8b5b1f1a732dcfccbae55dcc9b61
Instruction ID: f06cffaf5e8e7584343bd46566e481fd9438ac6752a624305d13558491bd9eb7
Opcode Fuzzy Hash: f9e58f32f6fc4adbc623d10922dd3823403d8b5b1f1a732dcfccbae55dcc9b61
Instruction Fuzzy Hash: 7D01DA357002148FD719DB64E569B6C7BB2FB88315F144464E50ADB3A0DB359D46CF41

Function 01571514 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00cb979cc763afae2dfc1aea2b51ddef17bf66101a34e0e82546991d9d74b5e9
Instruction ID: 650a3ced1c1fa715d9e5ba2286363e80818bb61c9fdc34eefd9d851706d89d2c
Opcode Fuzzy Hash: 00cb979cc763afae2dfc1aea2b51ddef17bf66101a34e0e82546991d9d74b5e9
Instruction Fuzzy Hash: 89F0F677A046518BDB218BB8A4D21ACBBE5FEA9111B1800D7D906DF291D234D442CB51

Function 01578108 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4486550902.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1570000_GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0662137cc07698be9c55bf140d2e39f406e9c56fc3585b33637579d64f50be9
Instruction ID: f24e917db83cbbe12fcbfe6a0593de0c675fc694e263656ebd0dde1ef40a7e36
Opcode Fuzzy Hash: e0662137cc07698be9c55bf140d2e39f406e9c56fc3585b33637579d64f50be9
Instruction Fuzzy Hash: E4F01D7490010EDFCB55EFB4FA5199D7BB9EF50204F504679C0099B258DB356A098B91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4i05ubpq.vs3.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b2zn5tjr.ay5.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b35f5gue.kwz.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pej3cim4.311.ps1

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
GLOWINGSEA_RFQ_1105-12-24-3077-103-AUX.exe

Function 069CBE55 Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Function 069CBE60 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 00BFAD88 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Function 00BF590C Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Function 00BF44B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 069CBBD1 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Function 069CBBD8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 00BFD658 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre