Edit tour

Windows Analysis Report
clip64.dll

Overview

General Information

Sample name:	clip64.dll
Analysis ID:	1423302
MD5:	8ee29b714ba490ec4a0828816f15ed4f
SHA1:	0556df48a668c35c6611ffce1425f1d9e89d0cd7
SHA256:	fff252c139b136ba131fab2db7880c79856d39fce2e9d0d15cd19de8f4b52bc5
Infos:

Detection

Amadey

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Amadeys Clipper DLL

Yara detected Amadeys stealer DLL

Found potential dummy code loops (likely to delay analysis)

Sample uses string decryption to hide its real strings

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

May sleep (evasive loops) to hinder dynamic analysis

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 3508 cmdline: loaddll32.exe "C:\Users\user\Desktop\clip64.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 3504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5476 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 4460 cmdline: rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2144 cmdline: rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6968 cmdline: rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5276 cmdline: rundll32.exe C:\Users\user\Desktop\clip64.dll,Main MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2304 cmdline: rundll32.exe "C:\Users\user\Desktop\clip64.dll",??4CClipperDLL@@QAEAAV0@$$QAV0@@Z MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4036 cmdline: rundll32.exe "C:\Users\user\Desktop\clip64.dll",??4CClipperDLL@@QAEAAV0@ABV0@@Z MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4560 cmdline: rundll32.exe "C:\Users\user\Desktop\clip64.dll",Main MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"Wallet Addresses": ["bc1q5geckylyfl4952lsex43u56p9c46eptlds05fj", "0x091451c16090f09214C57cB2D15c0cf7967E04d8", "ltc1q2rmqlk85xegdvh3f36smqf2rrfgwsyy26j6lel", "DPtXND8WRCBwX8WHPBLiCt8Lm6xsD3Mbr2", "48dSg7aiVzoAiDwaNHW316Gitnr1VCe2W1yCMNJqEWMe1M15vU1bVnUPZ8NQBSagnq74r57dEuvkC1Hd3gzvKaVZPjAdVSc"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
clip64.dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
clip64.dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000002.4622302958.00000000738F1000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Unpacked PEs

Source	Rule	Description	Author
7.2.rundll32.exe.738f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
7.2.rundll32.exe.738f0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
10.2.rundll32.exe.738f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
10.2.rundll32.exe.738f0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: clip64.dll

Avira: detected

Found malware configuration

Source: clip64.dll

Malware Configuration Extractor: Amadey {"Wallet Addresses": ["bc1q5geckylyfl4952lsex43u56p9c46eptlds05fj", "0x091451c16090f09214C57cB2D15c0cf7967E04d8", "ltc1q2rmqlk85xegdvh3f36smqf2rrfgwsyy26j6lel", "DPtXND8WRCBwX8WHPBLiCt8Lm6xsD3Mbr2", "48dSg7aiVzoAiDwaNHW316Gitnr1VCe2W1yCMNJqEWMe1M15vU1bVnUPZ8NQBSagnq74r57dEuvkC1Hd3gzvKaVZPjAdVSc"]}

Multi AV Scanner detection for submitted file

Source: clip64.dll

ReversingLabs: Detection: 83%

Sample uses string decryption to hide its real strings

Source: 7.2.rundll32.exe.738f0000.0.unpack	String decryptor: bc1q5geckylyfl4952lsex43u56p9c46eptlds05fj
Source: 7.2.rundll32.exe.738f0000.0.unpack	String decryptor: 0x091451c16090f09214C57cB2D15c0cf7967E04d8
Source: 7.2.rundll32.exe.738f0000.0.unpack	String decryptor: ltc1q2rmqlk85xegdvh3f36smqf2rrfgwsyy26j6lel
Source: 7.2.rundll32.exe.738f0000.0.unpack	String decryptor: DPtXND8WRCBwX8WHPBLiCt8Lm6xsD3Mbr2
Source: 7.2.rundll32.exe.738f0000.0.unpack	String decryptor: 48dSg7aiVzoAiDwaNHW316Gitnr1VCe2W1yCMNJqEWMe1M15vU1bVnUPZ8NQBSagnq74r57dEuvkC1Hd3gzvKaVZPjAdVSc

Source: clip64.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: clip64.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: D:\Mktmp\Amadey\ClipperDLL\Release\CLIPPERDLL.pdb source: rundll32.exe, 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.4622328387.00000000738FF000.00000002.00000001.01000000.00000003.sdmp, clip64.dll

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_738F7D7E FindFirstFileExW,

7_2_738F7D7E

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_738F15E0 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,WideCharToMultiByte,WideCharToMultiByte,GlobalUnlock,CloseClipboard,Sleep,

7_2_738F15E0

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_738F15E0 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,WideCharToMultiByte,WideCharToMultiByte,GlobalUnlock,CloseClipboard,Sleep,		7_2_738F15E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_738F15E0 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,WideCharToMultiByte,WideCharToMultiByte,GlobalUnlock,CloseClipboard,Sleep,		7_2_738F15E0

Source: C:\Windows\SysWOW64\rundll32.exe

7_2_738F15E0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_738FDB01

7_2_738FDB01

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: clip64.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: classification engine

Classification label: mal88.spyw.evad.winDLL@18/0@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3504:120:WilError_03

Source: clip64.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1

Source: clip64.dll

ReversingLabs: Detection: 83%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\clip64.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\clip64.dll,Main
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",??4CClipperDLL@@QAEAAV0@ABV0@@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",Main
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\clip64.dll,Main	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",??4CClipperDLL@@QAEAAV0@$$QAV0@@Z	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",??4CClipperDLL@@QAEAAV0@ABV0@@Z	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",Main	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1	Jump to behavior

Source: clip64.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: clip64.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: clip64.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: clip64.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: clip64.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: clip64.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: clip64.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: clip64.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: clip64.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: clip64.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: clip64.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: clip64.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: clip64.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_738F4196 push ecx; ret

7_2_738F41A9

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 2574	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 7425	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 2900	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 7099	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

API coverage: 7.3 %

Source: C:\Windows\SysWOW64\rundll32.exe TID: 5072	Thread sleep count: 2574 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5072	Thread sleep time: -2574000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5072	Thread sleep count: 7425 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5072	Thread sleep time: -7425000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2760	Thread sleep count: 2900 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2760	Thread sleep time: -2900000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2760	Thread sleep count: 7099 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2760	Thread sleep time: -7099000s >= -30000s	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_738F7D7E FindFirstFileExW,

7_2_738F7D7E

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Anti Debugging

Found potential dummy code loops (likely to delay analysis)

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 42% for more than 60s

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_738F5BB4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

7_2_738F5BB4

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_738F62E0 mov eax, dword ptr fs:[00000030h]		7_2_738F62E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_738F7885 mov eax, dword ptr fs:[00000030h]		7_2_738F7885

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_738F92A5 GetProcessHeap,

7_2_738F92A5

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_738F5BB4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_738F5BB4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_738F42F4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_738F42F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_738F4025 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_738F4025

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_738F3E45 cpuid

7_2_738F3E45

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_738F41AC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

7_2_738F41AC

Stealing of Sensitive Information

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: clip64.dll, type: SAMPLE
Source: Yara match	File source: 7.2.rundll32.exe.738f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.738f0000.0.unpack, type: UNPACKEDPE

Yara detected Amadeys stealer DLL

Source: Yara match	File source: clip64.dll, type: SAMPLE
Source: Yara match	File source: 7.2.rundll32.exe.738f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.738f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4622302958.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	112 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	12 Security Software Discovery	Remote Desktop Protocol	3 Clipboard Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	112 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Rundll32	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
clip64.dll	83%	ReversingLabs	Win32.Trojan.Amadey
clip64.dll	100%	Avira	HEUR/AGEN.1301048

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1423302
Start date and time:	2024-04-09 21:57:51 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	clip64.dll
Detection:	MAL
Classification:	mal88.spyw.evad.winDLL@18/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 5 Number of non-executed functions: 25
Cookbook Comments:	Found application associated with file extension: .dll Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: clip64.dll

Simulations

Behavior and APIs

Time	Type	Description
21:58:55	API Interceptor	1x Sleep call for process: loaddll32.exe modified
21:59:26	API Interceptor	11694429x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.3473860804256095
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	clip64.dll
File size:	91'136 bytes
MD5:	8ee29b714ba490ec4a0828816f15ed4f
SHA1:	0556df48a668c35c6611ffce1425f1d9e89d0cd7
SHA256:	fff252c139b136ba131fab2db7880c79856d39fce2e9d0d15cd19de8f4b52bc5
SHA512:	df90bb9497ff20f13c4d19324af91ec9f6bbf3f9b5055e24e3bae0f77c7df6db58384bff8dbdd88104c05e7c586c489968bcb6b3ef86436704aa4cd2f5c8acc8
SSDEEP:	1536:tgYNPCKLbqoYkbpplW9YoUsxXbbcouNh72ZszsWuKcdJUgzaB89p:tg0CWbBNpplToUsNuNh725LJUmaB89p
TLSH:	5E935B1030D2C071D97E55351878EAB68B7CB914CFE08EEF27551A7A8E702D1AE36D3A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........,Cy..Cy..Cy.....~Iy.....~.y.....~Qy.....~Ly.....~Ry.....~by.....~Fy..Cy...y.....~@y.....~By......By.....~By..RichCy.........

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x10003e00
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x63BC2D74 [Mon Jan 9 15:06:28 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	52982bbab8b9d5eafbb4ec438626f86a

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F0D08E2EEA7h
call 00007F0D08E2F290h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007F0D08E2ED58h
add esp, 0Ch
pop ebp
retn 000Ch
jmp 00007F0D08E31EB3h
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F0D08E2E667h
push 10014590h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F0D08E2F4F8h
int3
push ebp
mov ebp, esp
and dword ptr [10016A48h], 00000000h
sub esp, 24h
or dword ptr [10016004h], 01h
push 0000000Ah
call 00007F0D08E3910Ch
test eax, eax
je 00007F0D08E2F04Fh
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword ptr [edi], eax
mov dword ptr [edi+04h], esi
mov dword ptr [edi+08h], ecx
xor ecx, ecx
mov dword ptr [edi+0Ch], edx
mov eax, dword ptr [ebp-24h]
mov edi, dword ptr [ebp-1Ch]
mov dword ptr [ebp-0Ch], eax
xor edi, 6C65746Eh
mov eax, dword ptr [ebp-18h]
xor eax, 49656E69h
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp-20h]
xor eax, 756E6547h
mov dword ptr [ebp-04h], eax
xor eax, eax
inc eax
push ebx
cpuid
mov esi, ebx
pop ebx
lea ebx, dword ptr [ebp-24h]
mov dword ptr [ebx], eax
mov eax, dword ptr [ebp-04h]
mov dword ptr [ebx+04h], esi
or eax, edi
or eax, dword ptr [ebp-08h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x14aa0	0x9c	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x14b3c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18000	0xf8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x19000	0x1054	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x13f20	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x13f90	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xf000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xdd56	0xde00	774a7ce91e30ef3e3d7da140db35dc34	False	0.5611099380630631	data	6.65624829160936	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xf000	0x61ee	0x6200	e4ee272fe0863b0d859bd6ef543ae195	False	0.4253029336734694	data	4.998521354979746	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x16000	0x1444	0xc00	7b35d9606a8db5f8a5e5b03ea0fcbcf3	False	0.1494140625	DOS executable (block device driver @\273)	2.05558001204947	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x18000	0xf8	0x200	d455d3af38ec99962a36d1f49a978aee	False	0.3359375	data	2.5195793504807127	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x19000	0x1054	0x1200	04bba41d6da9e277608bbfbbab660375	False	0.712890625	data	6.26182229426962	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x18060	0x91	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.8689655172413793

Imports

DLL

Import

KERNEL32.dll

GlobalAlloc, GlobalLock, GlobalUnlock, WideCharToMultiByte, Sleep, WriteConsoleW, CloseHandle, CreateFileW, SetFilePointerEx, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetModuleHandleW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, GetCurrentProcess, TerminateProcess, RaiseException, InterlockedFlushSList, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, RtlUnwind, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, HeapAlloc, HeapFree, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, GetEnvironmentStringsW, FreeEnvironmentStringsW, LCMapStringW, GetProcessHeap, GetStdHandle, GetFileType, GetStringTypeW, HeapSize, HeapReAlloc, SetStdHandle, FlushFileBuffers, WriteFile, GetConsoleCP, GetConsoleMode, DecodePointer

USER32.dll

SetClipboardData, EmptyClipboard, OpenClipboard, CloseClipboard, GetClipboardData

Exports

Name	Ordinal	Address
??4CClipperDLL@@QAEAAV0@$$QAV0@@Z	1	0x10001120
??4CClipperDLL@@QAEAAV0@ABV0@@Z	2	0x10001120
Main	3	0x10003040

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	1
Start time:	21:58:45
Start date:	09/04/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\clip64.dll"
Imagebase:	0xee0000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:58:45
Start date:	09/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:58:46
Start date:	09/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:58:46
Start date:	09/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1
Imagebase:	0xb40000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:58:46
Start date:	09/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
Imagebase:	0xb40000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:58:49
Start date:	09/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z
Imagebase:	0xb40000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:58:52
Start date:	09/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\clip64.dll,Main
Imagebase:	0xb40000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	21:58:55
Start date:	09/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\clip64.dll",??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
Imagebase:	0xb40000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	21:58:55
Start date:	09/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\clip64.dll",??4CClipperDLL@@QAEAAV0@ABV0@@Z
Imagebase:	0xb40000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	21:58:55
Start date:	09/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\clip64.dll",Main
Imagebase:	0xb40000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000002.4622302958.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.6%
Total number of Nodes:	1686
Total number of Limit Nodes:	36

Executed Functions

Function 738F15E0 Relevance: 29.9, APIs: 15, Strings: 1, Instructions: 1932COMMON

Download Yara Rule

Strings

abcdefghijklmnopqrstuvwxyz0123456789, xrefs: 738F189A

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: abcdefghijklmnopqrstuvwxyz0123456789
API String ID: 0-3754357371
Opcode ID: 4b1ca98479daa09b1226a8ea459cd899f71a1821cd555d2bc5ebbeac1fdd53d5
Instruction ID: 8a2b5ce9807ad139f4a6d29fdcf355e71951e3bf2db8f670ff7008c5d9b121f1
Opcode Fuzzy Hash: 4b1ca98479daa09b1226a8ea459cd899f71a1821cd555d2bc5ebbeac1fdd53d5
Instruction Fuzzy Hash: A0E2DF716043468BE305DFACC88175EBBA3EFC5314F648A1CE4968B2D5D772E981CB92

Uniqueness

Uniqueness Score: -1.00%

Function 738F3C1F Relevance: 13.6, APIs: 9, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 738F3C66
___scrt_uninitialize_crt.LIBCMT ref: 738F3C80

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 571f3068d4a7eafa9ec08feaa38b0d2d3bd685ce0d8423c96f67336646b21a3b
Instruction ID: 1f7f7f77ce27dd581b82e536f0500b42001105d2d50503ef90618942917ba7e7
Opcode Fuzzy Hash: 571f3068d4a7eafa9ec08feaa38b0d2d3bd685ce0d8423c96f67336646b21a3b
Instruction Fuzzy Hash: E8419672A0472BAFEB11AFEDCC01B9E7A7BEF84794F148119F81567280D7B24D018B90

Uniqueness

Uniqueness Score: -1.00%

Function 738F3B18 Relevance: 4.6, APIs: 3, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 738F3B65

Part of subcall function 738F4244: InitializeSListHead.KERNEL32(73906A58,738F3B6F,73904660,00000010,738F3B00,?,?,?,738F3D28,?,00000001,?,?,00000001,?,739046A8), ref: 738F4249

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 738F3BCF
___scrt_fastfail.LIBCMT ref: 738F3C19

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID: Initialize$HeadList___scrt_fastfail___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 2097537958-0
Opcode ID: eb46ac121697d4bc380a022261e0e43e905776c47fccffb1d07fea7c790af5c0
Instruction ID: cdb44d053cf4ac4821ecec2cbcf5262b71f3daaf93c5666d512726ef52892da0
Opcode Fuzzy Hash: eb46ac121697d4bc380a022261e0e43e905776c47fccffb1d07fea7c790af5c0
Instruction Fuzzy Hash: FC219F323493575FEB017FF8D411B8C3B639B05325F18812AD9926B2C1DBB241848A65

Uniqueness

Uniqueness Score: -1.00%

Function 738FAEEE Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 738F7942: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,738F74FE,00000001,00000364,00000006,000000FF,?,00000001,738F7934,738F79C5,?,?,738F6B9D), ref: 738F7983

_free.LIBCMT ref: 738FAF5D

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: a196c6ce620c801bb0f50d97cecf6e5b5d15b8c15d5bd770e9089454c7477d4e
Instruction ID: ab405c7c9b883f051abe00cf539466df1d286d83ff72626e5d3d84eaa5b055a7
Opcode Fuzzy Hash: a196c6ce620c801bb0f50d97cecf6e5b5d15b8c15d5bd770e9089454c7477d4e
Instruction Fuzzy Hash: 8901DBB26043175BD3218F98D885A8AFBA9EF053B0F150669F546AB5C0E7745811CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 738F7942 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,738F74FE,00000001,00000364,00000006,000000FF,?,00000001,738F7934,738F79C5,?,?,738F6B9D), ref: 738F7983

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 03f2891d7464a7684c744af95bafe1a59b568e8bb71a70d8ddc488eeb3825a09
Instruction ID: a382e234cf36a8ee1c3df69e27795993874d93de738cc71215bb5056be9b7e63
Opcode Fuzzy Hash: 03f2891d7464a7684c744af95bafe1a59b568e8bb71a70d8ddc488eeb3825a09
Instruction Fuzzy Hash: C9F0E9323046275BFB126AEACC01F6B776BDF416F0F149111FC0ADA1C4DA38D80186A0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 738F5BB4 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 738F5CAC
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 738F5CB6
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 738F5CC3

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 776348513db563239602849c9e2f2a9872a218563d9df001d085ee32650d5d99
Instruction ID: f37ddab88d9cd522f25d483ff38f567ec8a1a6c5c8f59545f7b4e100d79ff182
Opcode Fuzzy Hash: 776348513db563239602849c9e2f2a9872a218563d9df001d085ee32650d5d99
Instruction Fuzzy Hash: 9B31E5759113299BCB21DF69D888B8CBBB9BF08310F5081EAE40DA7290E7309B858F54

Uniqueness

Uniqueness Score: -1.00%

Function 738F62E0 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,738F62DF,?,00000001,?,?), ref: 738F6302
TerminateProcess.KERNEL32(00000000,?,738F62DF,?,00000001,?,?), ref: 738F6309
ExitProcess.KERNEL32 ref: 738F631B

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: e9a67794abeea712ce1bf6de270e89ea28dcb491e29d75a40cda0c7b0de69734
Instruction ID: b6772fa126583b2b03247d6e6deb949b0bd4a2af38e827855050dfb753f19df4
Opcode Fuzzy Hash: e9a67794abeea712ce1bf6de270e89ea28dcb491e29d75a40cda0c7b0de69734
Instruction Fuzzy Hash: 45E0EC32001A0AAFDB127FE5C959F5D3B7AFBC4751F244518F90A86220DB75D986CB44

Uniqueness

Uniqueness Score: -1.00%

Function 738FDB01 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,738FDAFC,?,?,00000008,?,?,738FD794,00000000), ref: 738FDD2E

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: fa2e7bb1ede22e328cf7d2996d5973d925076b4469e302d7ea501cd8261af7e9
Instruction ID: 172ddae2703abf95dfd479a33cda6ac27ddb1add214e77368316a292d69537e6
Opcode Fuzzy Hash: fa2e7bb1ede22e328cf7d2996d5973d925076b4469e302d7ea501cd8261af7e9
Instruction Fuzzy Hash: BBB15E3221060ACFD705CF68C486B557BB2FF45364F198658EA9ACF2E9C335E996CB40

Uniqueness

Uniqueness Score: -1.00%

Function 738F3E45 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 738F3E5B

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: d6e42094da1d325f8b9788feb567d6f71f24df06e85de9599ae3b99fe310332b
Instruction ID: 105f94931ce673ebd25956d3272616d190fd7f400a66d60abd3d53337eb376da
Opcode Fuzzy Hash: d6e42094da1d325f8b9788feb567d6f71f24df06e85de9599ae3b99fe310332b
Instruction Fuzzy Hash: 905162B2B05216CBEB15DF9AC98179ABBF5FB84314F24846AD50AEB280D375D940CB50

Uniqueness

Uniqueness Score: -1.00%

Function 738F7D7E Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0820e088b6c9a45ddc007c8af7128d4716f4d9ba7b01750b10c8992fd44c69a0
Instruction ID: c78943352116d003da414b2b321f13d6e14324eca771980449e2e2b95d8e0d37
Opcode Fuzzy Hash: 0820e088b6c9a45ddc007c8af7128d4716f4d9ba7b01750b10c8992fd44c69a0
Instruction Fuzzy Hash: 4141A57580421AAFEB10DFA9CC89BAABBBAEF45344F1442D9F45DD3240D6359E848F10

Uniqueness

Uniqueness Score: -1.00%

Function 738F92A5 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 738F92A5

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 24820062235cae49ccc6e65326082071da258248180ff5707f2c78611043715c
Instruction ID: 42be5ed3d6bd3904929a89af7aa54888ac6369f27275507611d5d768bfbaeb4d
Opcode Fuzzy Hash: 24820062235cae49ccc6e65326082071da258248180ff5707f2c78611043715c
Instruction Fuzzy Hash: D3A00471505503CFD7405F37C54571D35D5F5455F5735D075540DC5150D734C5505F05

Uniqueness

Uniqueness Score: -1.00%

Function 738F7885 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5507de7d6159badeca35d953fc3413e00c20d4a341e50c046b19f343d44c49b2
Instruction ID: 110800173096ce938e74236104205af309b5177376d9d4c08096c9bbfe5f3ec7
Opcode Fuzzy Hash: 5507de7d6159badeca35d953fc3413e00c20d4a341e50c046b19f343d44c49b2
Instruction Fuzzy Hash: 2DE08C32921228EBDB11DBCCC900E8AF3FDEB44A40F114496B502D3210C270DE00CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 738F9E8E Relevance: 19.6, APIs: 13, Instructions: 113
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___free_lconv_mon.LIBCMT ref: 738F9ED2

Part of subcall function 738FA2CE: _free.LIBCMT ref: 738FA2EB
Part of subcall function 738FA2CE: _free.LIBCMT ref: 738FA2FD
Part of subcall function 738FA2CE: _free.LIBCMT ref: 738FA30F
Part of subcall function 738FA2CE: _free.LIBCMT ref: 738FA321
Part of subcall function 738FA2CE: _free.LIBCMT ref: 738FA333
Part of subcall function 738FA2CE: _free.LIBCMT ref: 738FA345
Part of subcall function 738FA2CE: _free.LIBCMT ref: 738FA357
Part of subcall function 738FA2CE: _free.LIBCMT ref: 738FA369
Part of subcall function 738FA2CE: _free.LIBCMT ref: 738FA37B
Part of subcall function 738FA2CE: _free.LIBCMT ref: 738FA38D
Part of subcall function 738FA2CE: _free.LIBCMT ref: 738FA39F
Part of subcall function 738FA2CE: _free.LIBCMT ref: 738FA3B1
Part of subcall function 738FA2CE: _free.LIBCMT ref: 738FA3C3

_free.LIBCMT ref: 738F9EC7

Part of subcall function 738F799F: HeapFree.KERNEL32(00000000,00000000,?,738F6B9D), ref: 738F79B5
Part of subcall function 738F799F: GetLastError.KERNEL32(?,?,738F6B9D), ref: 738F79C7

_free.LIBCMT ref: 738F9EE9
_free.LIBCMT ref: 738F9EFE
_free.LIBCMT ref: 738F9F09
_free.LIBCMT ref: 738F9F2B
_free.LIBCMT ref: 738F9F3E
_free.LIBCMT ref: 738F9F4C
_free.LIBCMT ref: 738F9F57
_free.LIBCMT ref: 738F9F8F
_free.LIBCMT ref: 738F9F96
_free.LIBCMT ref: 738F9FB3
_free.LIBCMT ref: 738F9FCB

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 165e1eebdb4aadbcddfd9635e5565d6a54cc81b7af1c9b33c118fbe2942b9e2c
Instruction ID: a9524b7ce64c62ee1054af6f96c55ee54eb326a8fa6bc087edeff8a5cc696299
Opcode Fuzzy Hash: 165e1eebdb4aadbcddfd9635e5565d6a54cc81b7af1c9b33c118fbe2942b9e2c
Instruction Fuzzy Hash: 3731E7316047079FFB219BB9D945B5AB3FBEB00264F289829F45AD7190DF75E8808A60

Uniqueness

Uniqueness Score: -1.00%

Function 738F7218 Relevance: 15.1, APIs: 10, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 738F722E

Part of subcall function 738F799F: HeapFree.KERNEL32(00000000,00000000,?,738F6B9D), ref: 738F79B5
Part of subcall function 738F799F: GetLastError.KERNEL32(?,?,738F6B9D), ref: 738F79C7

_free.LIBCMT ref: 738F723A
_free.LIBCMT ref: 738F7245
_free.LIBCMT ref: 738F7250
_free.LIBCMT ref: 738F725B
_free.LIBCMT ref: 738F7266
_free.LIBCMT ref: 738F7271
_free.LIBCMT ref: 738F727C
_free.LIBCMT ref: 738F7287
_free.LIBCMT ref: 738F7295

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d67c07ec389db9910022473c2253f2d83629d0fbf65f97f6fbcd63bf9d5588c5
Instruction ID: a6ab4649ce0cac5805ab9944dae3eae1a7f8b9a8d585fbeaaf8ad610035c7b61
Opcode Fuzzy Hash: d67c07ec389db9910022473c2253f2d83629d0fbf65f97f6fbcd63bf9d5588c5
Instruction Fuzzy Hash: D621AB76904209AFEB41EFD8C880EDD7BBBBF08380F0095A5F5559B161DB35EA54CB80

Uniqueness

Uniqueness Score: -1.00%

Function 738F45A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_ValidateLocalCookies.LIBCMT ref: 738F45D7
___except_validate_context_record.LIBVCRUNTIME ref: 738F45DF
_ValidateLocalCookies.LIBCMT ref: 738F4668
__IsNonwritableInCurrentImage.LIBCMT ref: 738F4693
_ValidateLocalCookies.LIBCMT ref: 738F46E8

Strings

csm, xrefs: 738F467D
csm, xrefs: 738F4711

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$csm
API String ID: 1170836740-3733052814
Opcode ID: 188a81cb03a3fb38e3e9904664782e5ce96dd6a726ca2492d23d27e94f23d379
Instruction ID: 5f98a72740570f2c76286aebb839254d83d6f0a2baa23927b0fc347c66880408
Opcode Fuzzy Hash: 188a81cb03a3fb38e3e9904664782e5ce96dd6a726ca2492d23d27e94f23d379
Instruction Fuzzy Hash: 6851B134A0022A9FDF00DFA9C840FAD7BBBEF45314F2C815AD8169B2A1D735DA41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 738F8EC3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ext-ms-, xrefs: 738F8F2E
api-ms-, xrefs: 738F8F1A

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: ac6b49988043b47a5a00d575a969fa9976b012367c50979433170aadab76415a
Instruction ID: 7b0ff13c452dfdd1e58c763c85a3b52974e28988e913014d56d2b22a1be5d2ee
Opcode Fuzzy Hash: ac6b49988043b47a5a00d575a969fa9976b012367c50979433170aadab76415a
Instruction Fuzzy Hash: 3E21A532A06627AFDB1256A5CC45F4A377BDB41764F290221ED1ABB2C0E730DD00C6E1

Uniqueness

Uniqueness Score: -1.00%

Function 738FA46D Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 738FA435: _free.LIBCMT ref: 738FA45A

_free.LIBCMT ref: 738FA4BB

Part of subcall function 738F799F: HeapFree.KERNEL32(00000000,00000000,?,738F6B9D), ref: 738F79B5
Part of subcall function 738F799F: GetLastError.KERNEL32(?,?,738F6B9D), ref: 738F79C7

_free.LIBCMT ref: 738FA4C6
_free.LIBCMT ref: 738FA4D1
_free.LIBCMT ref: 738FA525
_free.LIBCMT ref: 738FA530
_free.LIBCMT ref: 738FA53B
_free.LIBCMT ref: 738FA546

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 594bc71536ac1a9de237e6d71aefe758ed8c3ffb7343d6ed820c9bf440261df1
Instruction ID: 8a2c4637dbfcded72fa78a76145d3438238224c663e558044be6a3ef959a5f23
Opcode Fuzzy Hash: 594bc71536ac1a9de237e6d71aefe758ed8c3ffb7343d6ed820c9bf440261df1
Instruction Fuzzy Hash: E2114F71640B09AFF520AFF4CC09FCBB7AF6F14750F809815B2AD6A094DA7DB6045A91

Uniqueness

Uniqueness Score: -1.00%

Function 738FB29C Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000001,00000000), ref: 738FB2E4
__fassign.LIBCMT ref: 738FB4C3
__fassign.LIBCMT ref: 738FB4E0
WriteFile.KERNEL32(?,738F99C5,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 738FB528
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 738FB568
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 738FB614

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: b1fe690b3a89ac493843e7f9f2a445f5c9caba7f2c4ae761b1d447f28384a405
Instruction ID: 590116d14fbcfaecf51380e59023c75e8880768031e8e7407a37e9bd81a1e293
Opcode Fuzzy Hash: b1fe690b3a89ac493843e7f9f2a445f5c9caba7f2c4ae761b1d447f28384a405
Instruction Fuzzy Hash: 03D16E75D0025A9FDF06CFE8C990AEDBBB6FF48314F28416AE456BB341D6309A46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 738F49ED Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,738F4527,738F3856,738F3AF0,?,738F3D28,?,00000001,?,?,00000001,?,739046A8,0000000C,738F3E1C), ref: 738F49FB
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 738F4A09
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 738F4A22
SetLastError.KERNEL32(00000000,738F3D28,?,00000001,?,?,00000001,?,739046A8,0000000C,738F3E1C,?,00000001,?), ref: 738F4A74

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 9e764df76ef54e9084f86275cb758552f10e8bf6978ada462a22cd1edeb29204
Instruction ID: cf10901fac7f29b5f12df41ae4003487034edbc3fcd0dbfdcd09441b84fa64f4
Opcode Fuzzy Hash: 9e764df76ef54e9084f86275cb758552f10e8bf6978ada462a22cd1edeb29204
Instruction Fuzzy Hash: F6019E3374D7335FF71129FAAC86F162AABEB45678F38032BE11A460E4FB7148019258

Uniqueness

Uniqueness Score: -1.00%

Function 738F820C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 738F8211

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: 766040d2f2cdc3a00791134da35db055f12c83c1676780b40c7bc592be101eb1
Instruction ID: 42007166a8569651ab1114fcef3f90eca927ef30b23587bbd3d127a6c40e00ce
Opcode Fuzzy Hash: 766040d2f2cdc3a00791134da35db055f12c83c1676780b40c7bc592be101eb1
Instruction Fuzzy Hash: 33213D71604A0BAFE7119EF9DC85B6B77AFAB412B4F148514F915E6190EB70FC008660

Uniqueness

Uniqueness Score: -1.00%

Function 738F4D04 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 738F4D54

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: c6d9277fa77cc1b4e532909127bd0d651ee2f246b84effcd8a563567ddcf7308
Instruction ID: 82aaa806365df6658c3b2efce2c77ec72c21fb409f22d43d8538d38790d17fcd
Opcode Fuzzy Hash: c6d9277fa77cc1b4e532909127bd0d651ee2f246b84effcd8a563567ddcf7308
Instruction Fuzzy Hash: 27116A72A01637ABD7126AE58845F4A377ADF456A4F2E0522ED16E72D4D730D900C5E0

Uniqueness

Uniqueness Score: -1.00%

Function 738F6365 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,738F6317,?,?,738F62DF,?,00000001,?), ref: 738F637A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 738F638D
FreeLibrary.KERNEL32(00000000,?,?,738F6317,?,?,738F62DF,?,00000001,?), ref: 738F63B0

Strings

CorExitProcess, xrefs: 738F6385
mscoree.dll, xrefs: 738F6373

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: dc28a0358e2624d85c543a6dc262d703b16cf63642768584d7071fbd985a61cc
Instruction ID: ef4c0c0583d649144febd9de1719b0a3f09cebe0ca7021aae38ad0a434b14bb8
Opcode Fuzzy Hash: dc28a0358e2624d85c543a6dc262d703b16cf63642768584d7071fbd985a61cc
Instruction Fuzzy Hash: 1BF0123690251AFFDB21ABA1CD09F9D7B79EF85755F244150F906E1291DB308A00EA90

Uniqueness

Uniqueness Score: -1.00%

Function 738FA3CC Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 738FA3E4

Part of subcall function 738F799F: HeapFree.KERNEL32(00000000,00000000,?,738F6B9D), ref: 738F79B5
Part of subcall function 738F799F: GetLastError.KERNEL32(?,?,738F6B9D), ref: 738F79C7

_free.LIBCMT ref: 738FA3F6
_free.LIBCMT ref: 738FA408
_free.LIBCMT ref: 738FA41A
_free.LIBCMT ref: 738FA42C

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1c34733789ba2c3bc445f8e6ba767abaa27b2f269f3ca810df6d8be6c4b544c7
Instruction ID: f7101638145bbd691ecd47883a4c7bbd0a8d9308e88f532445df130b0d4b060a
Opcode Fuzzy Hash: 1c34733789ba2c3bc445f8e6ba767abaa27b2f269f3ca810df6d8be6c4b544c7
Instruction Fuzzy Hash: 51F04F326047039BE600EBADE086F1A73FBEA14360B64B815F00ADB580CB38F8804A60

Uniqueness

Uniqueness Score: -1.00%

Function 738F7B8F Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 738F7D29

Strings

*?, xrefs: 738F7BD2

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 2ac16678b16e0a25b780da8791ccbb249bc7102ea72d03631edb619c25b3a17a
Instruction ID: bdef6c86e8e12c3355d28831168858ed4a93a517d977b08e4badf07943ee2bdd
Opcode Fuzzy Hash: 2ac16678b16e0a25b780da8791ccbb249bc7102ea72d03631edb619c25b3a17a
Instruction Fuzzy Hash: DC612D75D0021A9FEB15CFA8C8816ADFBFAEF48350F288169F805E7344D6759A418B90

Uniqueness

Uniqueness Score: -1.00%

Function 738F7AA3 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 738F80C6: _free.LIBCMT ref: 738F80D4

Part of subcall function 738F8CA0: WideCharToMultiByte.KERNEL32(?,00000000,738F9A36,00000000,00000001,738F99C5,738FBC2C,?,738F9A36,?,00000000,?,738FB99B,0000FDE9,00000000,?), ref: 738F8D42

GetLastError.KERNEL32 ref: 738F7B0B
__dosmaperr.LIBCMT ref: 738F7B12
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 738F7B51
__dosmaperr.LIBCMT ref: 738F7B58

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 8b751c4985a50878dfb59eff1565977310d61342b222ddc128815f860ff49382
Instruction ID: e86342fe733acbdb82dccc715fdfe4061f3d1c17789cd1a35e8591ebae8c3ae1
Opcode Fuzzy Hash: 8b751c4985a50878dfb59eff1565977310d61342b222ddc128815f860ff49382
Instruction Fuzzy Hash: B6217F7160430BAFFB119EE99C80E5BB7AFEF412A4F148528F52597280E731DD008760

Uniqueness

Uniqueness Score: -1.00%

Function 738F735C Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,738FB6E2,00000000,00000001,738F9A36,?,738FBBA1,00000001,?,?,?,738F99C5,?,00000000), ref: 738F7361
_free.LIBCMT ref: 738F73BE
_free.LIBCMT ref: 738F73F4
SetLastError.KERNEL32(00000000,00000006,000000FF,?,738FBBA1,00000001,?,?,?,738F99C5,?,00000000,00000000,73904908,0000002C,738F9A36), ref: 738F73FF

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 72a3ab4167278a8323c3505a7fc63affe1f1b34f75a988396d088b810077d667
Instruction ID: a97df98a20148399800692295e76abefe4f635c80971d50f57d8765966d99a9f
Opcode Fuzzy Hash: 72a3ab4167278a8323c3505a7fc63affe1f1b34f75a988396d088b810077d667
Instruction Fuzzy Hash: F8114F333447077BF7023AEE8D85F1B266BEBC16E4F754234FA168A1D0EB7588054120

Uniqueness

Uniqueness Score: -1.00%

Function 738F74B3 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000001,738F7934,738F79C5,?,?,738F6B9D), ref: 738F74B8
_free.LIBCMT ref: 738F7515
_free.LIBCMT ref: 738F754B
SetLastError.KERNEL32(00000000,00000006,000000FF,?,00000001,738F7934,738F79C5,?,?,738F6B9D), ref: 738F7556

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 6abd4aee884351073f55b4068b1fc2af4bd587b31c369e46074801d39d9483e2
Instruction ID: 20c25c4516fbef9f393eb23c5bb0ad361a0d338d1f0a9e3b933bd9cb7622a77c
Opcode Fuzzy Hash: 6abd4aee884351073f55b4068b1fc2af4bd587b31c369e46074801d39d9483e2
Instruction Fuzzy Hash: D61173323447072BF6013AFE4D85F2B266BD7C57F8F244234F229861D0EF3588418120

Uniqueness

Uniqueness Score: -1.00%

Function 738FC6B6 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,738F9A36,00000000,?,?,738FC110,?,00000001,?,00000001,?,738FB671,00000000,00000000,00000001), ref: 738FC6CD
GetLastError.KERNEL32(?,738FC110,?,00000001,?,00000001,?,738FB671,00000000,00000000,00000001,00000000,00000001,?,738FBBC5,738F99C5), ref: 738FC6D9

Part of subcall function 738FC69F: CloseHandle.KERNEL32(FFFFFFFE,738FC6E9,?,738FC110,?,00000001,?,00000001,?,738FB671,00000000,00000000,00000001,00000000,00000001), ref: 738FC6AF

___initconout.LIBCMT ref: 738FC6E9

Part of subcall function 738FC661: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,738FC690,738FC0FD,00000001,?,738FB671,00000000,00000000,00000001,00000000), ref: 738FC674

WriteConsoleW.KERNEL32(?,?,738F9A36,00000000,?,738FC110,?,00000001,?,00000001,?,738FB671,00000000,00000000,00000001,00000000), ref: 738FC6FE

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: f0fe5f95a5f4dda7152a3e8fb7a821112f8c0e973eff5e46384c14bf762401a6
Instruction ID: d85e7e83366adf96b53538d97461ac27ad69d93927c81785aaa744a6ad46d132
Opcode Fuzzy Hash: f0fe5f95a5f4dda7152a3e8fb7a821112f8c0e973eff5e46384c14bf762401a6
Instruction Fuzzy Hash: 55F0F83714111ABBCB222FD6CC44F8A3F76EB492A0F145414FE1989120D7328920ABA5

Uniqueness

Uniqueness Score: -1.00%

Function 738F6CDE Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 738F6CE7

Part of subcall function 738F799F: HeapFree.KERNEL32(00000000,00000000,?,738F6B9D), ref: 738F79B5
Part of subcall function 738F799F: GetLastError.KERNEL32(?,?,738F6B9D), ref: 738F79C7

_free.LIBCMT ref: 738F6CFA
_free.LIBCMT ref: 738F6D0B
_free.LIBCMT ref: 738F6D1C

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 07f59e1416d9a166b5404b3004ba68ad596d4c6cddf9d14c0d8e810b334f93f7
Instruction ID: 2dcc4e4915b2b4604b5bf931b3e57b3bb3bdd1a70ef6613349ac78c4fff4fa63
Opcode Fuzzy Hash: 07f59e1416d9a166b5404b3004ba68ad596d4c6cddf9d14c0d8e810b334f93f7
Instruction Fuzzy Hash: 15E046738083639BF6023F6A8A00B3A7E37F7046687207666F41C0E221E739C0129AC1

Uniqueness

Uniqueness Score: -1.00%

Function 738F63F3 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 738F6436, 738F643D, 738F6473

Memory Dump Source

Source File: 00000007.00000002.4622283675.00000000738F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 738F0000, based on PE: true

Associated: 00000007.00000002.4622263770.00000000738F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622303884.00000000738FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622327689.0000000073906000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.4622345441.0000000073908000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738f0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: a0e892e090c0ee1787b18d619332daf1c2332732f7a63953bc803962a3a33410
Instruction ID: a6e8bc223495a9fc3fa7c8dad052cd215e1680bf823065ffb40fc996814465b6
Opcode Fuzzy Hash: a0e892e090c0ee1787b18d619332daf1c2332732f7a63953bc803962a3a33410
Instruction Fuzzy Hash: A0417571A0071AABD712EFD9C981B9EBBBEEB99310F144266E505E7240D7719A40CB60

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report clip64.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: loaddll32.exePID: 3508, Parent PID: 4004

General

Windows Analysis Report
clip64.dll

Function 738F3C1F Relevance: 13.6, APIs: 9, Instructions: 134
COMMON

Function 738F3B18 Relevance: 4.6, APIs: 3, Instructions: 76
COMMON

Function 738FAEEE Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Function 738F7942 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Function 738F9E8E Relevance: 19.6, APIs: 13, Instructions: 113
COMMONLIBRARYCODE

Function 738F7218 Relevance: 15.1, APIs: 10, Instructions: 69
COMMON

Function 738F45A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 168
COMMON

Function 738F8EC3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE