Edit tour

Windows Analysis Report
RFQ#1047.exe

Overview

General Information

Sample name:	RFQ#1047.exe
Analysis ID:	1426825
MD5:	6846f1fb78fad5224b98b0137e7a862d
SHA1:	f40fa249d6464ef5c1f9e39748162fd5d70e7aaa
SHA256:	66a0cfa14afdb23dec776fa355b9f89551405989b9838db6398c77ee6c73c084
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: MSBuild connects to smtp port

Yara detected AgentTesla

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Allocates memory in foreign processes

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

RFQ#1047.exe (PID: 2488 cmdline: "C:\Users\user\Desktop\RFQ#1047.exe" MD5: 6846F1FB78FAD5224B98B0137E7A862D)

MSBuild.exe (PID: 6440 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.xpl.co.nz", "Username": "martin@xpl.co.nz", "Password": "martin123"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.4571683281.00000000028C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.4564658212.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.4564658212.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.4571683281.0000000002851000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.4571683281.0000000002851000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2135311417.000000000389E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2135311417.000000000389E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RFQ#1047.exe PID: 2488	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RFQ#1047.exe PID: 2488	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: MSBuild.exe PID: 6440	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6440	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.RFQ#1047.exe.389e128.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RFQ#1047.exe.389e128.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.RFQ#1047.exe.389e128.8.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316f5:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31767:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317f1:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31883:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318ed:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3195f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319f5:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a85:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.RFQ#1047.exe.38d8b48.9.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RFQ#1047.exe.38d8b48.9.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.RFQ#1047.exe.38d8b48.9.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316f5:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31767:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317f1:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31883:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318ed:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3195f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319f5:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a85:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.MSBuild.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.MSBuild.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.MSBuild.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334f5:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33567:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335f1:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33683:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336ed:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3375f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337f5:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33885:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.RFQ#1047.exe.38d8b48.9.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RFQ#1047.exe.38d8b48.9.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.RFQ#1047.exe.38d8b48.9.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.RFQ#1047.exe.38d8b48.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334f5:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dd15:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33567:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dd87:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335f1:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6de11:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33683:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6dea3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336ed:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6df0d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3375f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6df7f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337f5:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e015:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33885:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e0a5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.RFQ#1047.exe.389e128.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RFQ#1047.exe.389e128.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.RFQ#1047.exe.389e128.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.RFQ#1047.exe.389e128.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334f5:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6df15:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa8735:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33567:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df87:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa87a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335f1:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e011:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa8831:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33683:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e0a3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa88c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336ed:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e10d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa892d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3375f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e17f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa899f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337f5:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e215:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa8a35:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 12 entries

Sigma Signatures

Networking

Sigma detected: MSBuild connects to smtp port

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 203.170.87.105, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 6440, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49712

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.RFQ#1047.exe.38d8b48.9.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.xpl.co.nz", "Username": "martin@xpl.co.nz", "Password": "martin123"}

Multi AV Scanner detection for submitted file

Source: RFQ#1047.exe	Virustotal: Detection: 32%			Perma Link
Source: RFQ#1047.exe	ReversingLabs: Detection: 26%

Machine Learning detection for sample

Source: RFQ#1047.exe

Joe Sandbox ML: detected

Source: RFQ#1047.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49722 version: TLS 1.0

Source: RFQ#1047.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Gqwv.pdbSHA256>5 source: RFQ#1047.exe
Source:	Binary string: Gqwv.pdb source: RFQ#1047.exe

Source: C:\Users\user\Desktop\RFQ#1047.exe

Code function: 4x nop then jmp 02541327h

0_2_02540A17

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.RFQ#1047.exe.38d8b48.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ#1047.exe.389e128.8.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.6:49712 -> 203.170.87.105:587

Source: Joe Sandbox View

ASN Name: DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU

Source: Joe Sandbox View

JA3 fingerprint: 1138de370e523e824bbca92d049a3777

Source: global traffic

TCP traffic: 192.168.2.6:49712 -> 203.170.87.105:587

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49722 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.204.65
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.204.65
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: mail.xpl.co.nz

Source: MSBuild.exe, 00000003.00000002.4571683281.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.xpl.co.nz
Source: MSBuild.exe, 00000003.00000002.4575146951.0000000005B11000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4571683281.0000000002851000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4567897518.0000000000A24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: MSBuild.exe, 00000003.00000002.4575146951.0000000005B11000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4571683281.0000000002851000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4567897518.0000000000A24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: MSBuild.exe, 00000003.00000002.4567897518.0000000000A58000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4575146951.0000000005B11000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4571683281.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: MSBuild.exe, 00000003.00000002.4567897518.0000000000A58000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4575146951.0000000005B11000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4571683281.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: RFQ#1047.exe, 00000000.00000002.2135311417.000000000389E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4564658212.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.RFQ#1047.exe.38d8b48.9.raw.unpack, hxAF.cs	.Net Code: glYnN5
Source: 0.2.RFQ#1047.exe.389e128.8.raw.unpack, hxAF.cs	.Net Code: glYnN5

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.RFQ#1047.exe.389e128.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.RFQ#1047.exe.38d8b48.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.RFQ#1047.exe.38d8b48.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.RFQ#1047.exe.389e128.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

.NET source code contains very large array initializations

Source: 0.2.RFQ#1047.exe.26836dc.0.raw.unpack, SQL.cs	Large array initialization: : array initializer size 13797
Source: 0.2.RFQ#1047.exe.4cd0000.11.raw.unpack, SQL.cs	Large array initialization: : array initializer size 13797

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: RFQ#1047.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\RFQ#1047.exe	Code function: 0_2_009FDCD4	0_2_009FDCD4
Source: C:\Users\user\Desktop\RFQ#1047.exe	Code function: 0_2_02542B88	0_2_02542B88
Source: C:\Users\user\Desktop\RFQ#1047.exe	Code function: 0_2_06CC0A98	0_2_06CC0A98
Source: C:\Users\user\Desktop\RFQ#1047.exe	Code function: 0_2_06CC3789	0_2_06CC3789
Source: C:\Users\user\Desktop\RFQ#1047.exe	Code function: 0_2_06CC3798	0_2_06CC3798
Source: C:\Users\user\Desktop\RFQ#1047.exe	Code function: 0_2_06CCC448	0_2_06CCC448
Source: C:\Users\user\Desktop\RFQ#1047.exe	Code function: 0_2_06CCC437	0_2_06CCC437
Source: C:\Users\user\Desktop\RFQ#1047.exe	Code function: 0_2_06CCE080	0_2_06CCE080
Source: C:\Users\user\Desktop\RFQ#1047.exe	Code function: 0_2_06CCC010	0_2_06CCC010
Source: C:\Users\user\Desktop\RFQ#1047.exe	Code function: 0_2_06CCBFE0	0_2_06CCBFE0
Source: C:\Users\user\Desktop\RFQ#1047.exe	Code function: 0_2_06CCEA30	0_2_06CCEA30
Source: C:\Users\user\Desktop\RFQ#1047.exe	Code function: 0_2_06CCC880	0_2_06CCC880
Source: C:\Users\user\Desktop\RFQ#1047.exe	Code function: 0_2_06CCC870	0_2_06CCC870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_026AB2D7	3_2_026AB2D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_026AD065	3_2_026AD065
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_026A4A98	3_2_026A4A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_026A3E80	3_2_026A3E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_026A41C8	3_2_026A41C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0542E660	3_2_0542E660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_05421522	3_2_05421522
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_05421528	3_2_05421528

Source: RFQ#1047.exe, 00000000.00000002.2133925694.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs RFQ#1047.exe
Source: RFQ#1047.exe, 00000000.00000002.2138904413.0000000006D20000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs RFQ#1047.exe
Source: RFQ#1047.exe, 00000000.00000002.2134593828.0000000002661000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs RFQ#1047.exe
Source: RFQ#1047.exe, 00000000.00000002.2134593828.00000000026FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename0514e01a-0008-46df-921e-cd27674422ca.exe4 vs RFQ#1047.exe
Source: RFQ#1047.exe, 00000000.00000002.2135311417.000000000389E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename0514e01a-0008-46df-921e-cd27674422ca.exe4 vs RFQ#1047.exe
Source: RFQ#1047.exe, 00000000.00000002.2135311417.000000000389E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs RFQ#1047.exe
Source: RFQ#1047.exe, 00000000.00000002.2138230748.0000000004CD0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs RFQ#1047.exe
Source: RFQ#1047.exe, 00000000.00000000.2101808600.00000000002AE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameGqwv.exeX vs RFQ#1047.exe
Source: RFQ#1047.exe	Binary or memory string: OriginalFilenameGqwv.exeX vs RFQ#1047.exe

Source: RFQ#1047.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.RFQ#1047.exe.389e128.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.RFQ#1047.exe.38d8b48.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.RFQ#1047.exe.38d8b48.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.RFQ#1047.exe.389e128.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: RFQ#1047.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.RFQ#1047.exe.38d8b48.9.raw.unpack, N43UVggPg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RFQ#1047.exe.38d8b48.9.raw.unpack, N43UVggPg.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.RFQ#1047.exe.38d8b48.9.raw.unpack, Ow96S4wT.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RFQ#1047.exe.38d8b48.9.raw.unpack, Ow96S4wT.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RFQ#1047.exe.38d8b48.9.raw.unpack, Ow96S4wT.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RFQ#1047.exe.38d8b48.9.raw.unpack, Ow96S4wT.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RFQ#1047.exe.38d8b48.9.raw.unpack, MjzNdC.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RFQ#1047.exe.38d8b48.9.raw.unpack, MjzNdC.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, YA7n3FZTdLntNid9Yp.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, YA7n3FZTdLntNid9Yp.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, YA7n3FZTdLntNid9Yp.cs	Security API names: _0020.AddAccessRule
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, tXM2R9Mp9uJhtKSc3Q.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, YA7n3FZTdLntNid9Yp.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, YA7n3FZTdLntNid9Yp.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, YA7n3FZTdLntNid9Yp.cs	Security API names: _0020.AddAccessRule
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, tXM2R9Mp9uJhtKSc3Q.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.winEXE@3/1@1/1

Source: C:\Users\user\Desktop\RFQ#1047.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RFQ#1047.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\RFQ#1047.exe	Mutant created: \Sessions\1\BaseNamedObjects\JodxOYXzEQapGOsShdhFmV

Source: RFQ#1047.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: RFQ#1047.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\RFQ#1047.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RFQ#1047.exe	Virustotal: Detection: 32%
Source: RFQ#1047.exe	ReversingLabs: Detection: 26%

Source: C:\Users\user\Desktop\RFQ#1047.exe

File read: C:\Users\user\Desktop\RFQ#1047.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\RFQ#1047.exe "C:\Users\user\Desktop\RFQ#1047.exe"
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edputil.dll	Jump to behavior

Source: C:\Users\user\Desktop\RFQ#1047.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\RFQ#1047.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: RFQ#1047.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: RFQ#1047.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: RFQ#1047.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Gqwv.pdbSHA256>5 source: RFQ#1047.exe
Source:	Binary string: Gqwv.pdb source: RFQ#1047.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.RFQ#1047.exe.26836dc.0.raw.unpack, SQL.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, YA7n3FZTdLntNid9Yp.cs	.Net Code: T8cgGe95JY System.Reflection.Assembly.Load(byte[])
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, YA7n3FZTdLntNid9Yp.cs	.Net Code: T8cgGe95JY System.Reflection.Assembly.Load(byte[])
Source: 0.2.RFQ#1047.exe.4cd0000.11.raw.unpack, SQL.cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: RFQ#1047.exe

Static PE information: 0xC237A2E0 [Mon Apr 3 06:21:20 2073 UTC]

Source: C:\Users\user\Desktop\RFQ#1047.exe	Code function: 0_2_009FF1D0 push esp; iretd	0_2_009FF1D1
Source: C:\Users\user\Desktop\RFQ#1047.exe	Code function: 0_2_06CC2563 pushad ; iretd	0_2_06CC256E
Source: C:\Users\user\Desktop\RFQ#1047.exe	Code function: 0_2_06CC5017 pushfd ; ret	0_2_06CC501A
Source: C:\Users\user\Desktop\RFQ#1047.exe	Code function: 0_2_06CC29A8 pushfd ; iretd	0_2_06CC29B1

Source: RFQ#1047.exe

Static PE information: section name: .text entropy: 7.976223626985366

Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, EONHNxPdUdAdHmAIMv.cs	High entropy of concatenated method names: 'I7Ew9hvH3g', 'MH9we49t1j', 'rQMwVqiP1R', 'GhuwbbN9nR', 'tSFwsN4D4y', 'KCawdyAupD', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, znlXIrvTbwjF26P0g7.cs	High entropy of concatenated method names: 'aHbK3eW4bZ', 'KQEKfMBT4D', 'o3ow5ssCxs', 'HDswcEDAVg', 'enrKuEj874', 'bOZKDWvMb4', 'S0dKECwAGd', 'BVpKsFgAun', 'tnEKt5phen', 'pvEKyaIcQt'
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, t1BnRSccD4grCcFSLVy.cs	High entropy of concatenated method names: 'ToString', 'wRJYQymZVW', 'FhSYgsKxWk', 'EgtYI3kNmj', 'sCpYO10Vlg', 'U0nY6UNBuy', 'NnOYpsnHbl', 'LboYRGDMrA', 'kZFc3WEk4LEaULb4qmR', 'GtT1JCEpp7Mkw6iULe3'
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, rxBcAh3P57UAjmasZ7.cs	High entropy of concatenated method names: 'cRJwOemShs', 'Fmww6o7yoW', 'couwpMj1sV', 'GlUwRxL6x4', 'er3wJBcuNI', 'WL0w2AK8xX', 'op3wZiBoIa', 'jgfwWtoWHI', 'Fvaw8NFqtt', 'Lo8wmEi5fy'
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, o0vjU3yJZJkjb9yxRt.cs	High entropy of concatenated method names: 'ToString', 'nEhNul9rVd', 'QDNNeoiODx', 'chuNVXMNdU', 'B4fNbGiHg9', 'aUlNdWestV', 'B2ZNlZbm9P', 'No0NAlcld8', 'CUHN0emuyy', 'IhYNaubG75'
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, jdgOKQXoHOhb0JGGc1.cs	High entropy of concatenated method names: 'bnoRrpd6fX', 'f3RRF1iTFk', 'LLQpVxS3wC', 'dV7pbWSTTv', 'aQ9pdNdkWy', 'MUhplxEUa2', 'VI4pAt5Vi1', 'tlIp0CJRMb', 'jBapaoY1YA', 'rukpC1mHkH'
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, Ly2lpSaeIZ2hmuMgm4.cs	High entropy of concatenated method names: 'Kr82iOP1DT', 'U3n21xLNee', 'tbL2G0oThS', 'VFV2kb0HnG', 'UL92rjtLKL', 'O6S2S7bRlx', 'IkW2FRltOu', 'igo2MIpa93', 'Vtk2T5yPou', 'EQl2X1Xx9N'
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, DodQKgElKD3WcFM3b5.cs	High entropy of concatenated method names: 'D4KhMJhNbI', 'vOIhTNHimO', 'fMSh9rg3pu', 'SRUhe2jI9X', 'v3dhbZYse2', 'uajhd8ZTTs', 'LRPhAaLpd7', 'sOlh0gsKTJ', 'rRphCVnBeZ', 'EpohuArMri'
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, p7Da0a6RAbndVtqN8j.cs	High entropy of concatenated method names: 'Dispose', 'KVZcP7Ptby', 'JXxneaNOqN', 'yyxqqy51LF', 'fwxcfBcAhP', 'a7UczAjmas', 'ProcessDialogKey', 'k7Tn5ONHNx', 'JUdncAdHmA', 'eMvnnuRrVR'
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, LQWl9jgFqx9ed5Z0ac.cs	High entropy of concatenated method names: 'BrYc2XM2R9', 'g9ucZJhtKS', 'SuZc8c5KMZ', 'WR3cmc2dgO', 'iGGcLc1DAi', 'K9ocNHIXJq', 'W9UOsdiVlNaVvr6466', 'WaGV5Md3A46WRNP3Us', 'pOuccJCTY4', 'VR9cQMxN46'
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, IH4LNyTuZc5KMZHR3c.cs	High entropy of concatenated method names: 'YSnpknIZU9', 'YjFpSYvZp9', 'LyCpMBEL2L', 'k8qpTHLSPH', 'I5HpLgBJ7p', 'FUBpNTV5Bg', 'jR9pKW6xOo', 'Qyvpwl0Lag', 'XJNp4nvW9i', 'daApYpWUJc'
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, DICsZ8zaHKaTHria89.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'snl4h0XigF', 'iZU4L8veQP', 'bF14NMGTOc', 'cet4KjuT4k', 's4J4w9ZRAH', 'fb8441J556', 'RXN4YcPhHg'
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, dqkscgc5qRyKRlbcFQB.cs	High entropy of concatenated method names: 'UYp4itGvSC', 'm1m41vF867', 'H9M4GeS6Jl', 'V0p4krMkH3', 'zNr4rEUMqw', 'gyP4Sp2wnX', 'zky4FWV41q', 'mfv4M4keIK', 'hsX4TrbcFv', 'uEV4X8aCCh'
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, TH9snRn08Vg9b5CVEn.cs	High entropy of concatenated method names: 'KbNGJBFcW', 'jJmkaqW8d', 'EpWSIkWDi', 'qoTFFAscP', 'ThWTwMncY', 'Fy1XJL7OD', 'tbIZfBGZR3jKoyKxv0', 'dEtK6K1OrJtlnHvRg2', 'lCywIIGgM', 'DBlYhqS7W'
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, NRRM5XsUNoHCuGlSUC.cs	High entropy of concatenated method names: 'xwQLCGETA5', 'Q2RLDx1HOi', 'BD3Lsy6Vwv', 'NbNLtpRfOX', 'wg4LeD3jh4', 'wZaLVI9oWY', 'yPxLbfe7MN', 'MYLLdg8teU', 'c6XLl3Vke5', 'e6tLAxcqYB'
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, ORrVRmfgs7pNHjuU4H.cs	High entropy of concatenated method names: 'afI4cgk7jw', 'Xhd4QCGDrb', 'hXC4gFsWIl', 'CAG4Oatunq', 'p5K46R63qF', 'giE4RICerO', 'pSZ4JCC1Vb', 'a6UwHfV04r', 'CSdw3FA3YN', 'rjowP0JjoF'
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, tXM2R9Mp9uJhtKSc3Q.cs	High entropy of concatenated method names: 'hj06sBbnSK', 'UAZ6t0dV8J', 'xGa6yYolIY', 'yYD6UgpCHV', 'Ugy6xwDDRM', 'lF26vMwZMv', 'TbN6Hp5awH', 'TLH63s1n3k', 'kM46PVA2c5', 'YHZ6fkCUrE'
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, XUCb71cQCrnCYxpmfib.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Bo5Ysyhws8', 'P6bYtDLwB8', 'IqxYy6YlMn', 'fIdYUqRZTn', 'nn1YxJrrYi', 'MENYvfuCyI', 'LpwYHdJMWH'
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, uw0s4PcnXqDkf7IcS02.cs	High entropy of concatenated method names: 'tJYYiF9oeB', 'TDiY1sHcbq', 'CHuYGqMRa3', 'Icv7Z3Eeqq4hwvc9CWQ', 'OprQcSEINl4P9xHQijy', 'oPLYWAEil1yS3LYmQpI', 'nsf9uxEdXX9GIwmVNK8'
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, LuP0AvAVNu3WAkDN2Z.cs	High entropy of concatenated method names: 'Odr2O5NE9y', 'gF12prUkCf', 'Uux2JJxKZ2', 'g8MJf7iKuN', 'xBoJzgUasw', 'Gmu25yRccX', 'aFi2cs9xuu', 'GTf2nlLX2V', 'HuQ2QFfQdp', 'Nt82g666Ln'
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, PAil9o9HIXJqTnkAlF.cs	High entropy of concatenated method names: 'AeDJIHSXsk', 'EWIJ638T4Q', 'MfiJRxcBbb', 'OVRJ2JD8dX', 'QdmJZ5mapI', 'STiRxflhhh', 'YXyRvhdlnO', 'TOnRH0I76M', 'X1TR3JlDBm', 'SoARPF2Qxi'
Source: 0.2.RFQ#1047.exe.6d20000.14.raw.unpack, YA7n3FZTdLntNid9Yp.cs	High entropy of concatenated method names: 'AUoQI8gCqw', 'SH9QOy1Y1Q', 'otJQ6b2LYO', 'bHcQpYOVsf', 'wS5QRLLpSo', 'QcKQJ9NsfA', 'tEdQ2u7lSk', 'FwfQZR5EWL', 'WXUQWgwn4S', 'BiQQ8ZadHV'
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, EONHNxPdUdAdHmAIMv.cs	High entropy of concatenated method names: 'I7Ew9hvH3g', 'MH9we49t1j', 'rQMwVqiP1R', 'GhuwbbN9nR', 'tSFwsN4D4y', 'KCawdyAupD', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, znlXIrvTbwjF26P0g7.cs	High entropy of concatenated method names: 'aHbK3eW4bZ', 'KQEKfMBT4D', 'o3ow5ssCxs', 'HDswcEDAVg', 'enrKuEj874', 'bOZKDWvMb4', 'S0dKECwAGd', 'BVpKsFgAun', 'tnEKt5phen', 'pvEKyaIcQt'
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, t1BnRSccD4grCcFSLVy.cs	High entropy of concatenated method names: 'ToString', 'wRJYQymZVW', 'FhSYgsKxWk', 'EgtYI3kNmj', 'sCpYO10Vlg', 'U0nY6UNBuy', 'NnOYpsnHbl', 'LboYRGDMrA', 'kZFc3WEk4LEaULb4qmR', 'GtT1JCEpp7Mkw6iULe3'
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, rxBcAh3P57UAjmasZ7.cs	High entropy of concatenated method names: 'cRJwOemShs', 'Fmww6o7yoW', 'couwpMj1sV', 'GlUwRxL6x4', 'er3wJBcuNI', 'WL0w2AK8xX', 'op3wZiBoIa', 'jgfwWtoWHI', 'Fvaw8NFqtt', 'Lo8wmEi5fy'
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, o0vjU3yJZJkjb9yxRt.cs	High entropy of concatenated method names: 'ToString', 'nEhNul9rVd', 'QDNNeoiODx', 'chuNVXMNdU', 'B4fNbGiHg9', 'aUlNdWestV', 'B2ZNlZbm9P', 'No0NAlcld8', 'CUHN0emuyy', 'IhYNaubG75'
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, jdgOKQXoHOhb0JGGc1.cs	High entropy of concatenated method names: 'bnoRrpd6fX', 'f3RRF1iTFk', 'LLQpVxS3wC', 'dV7pbWSTTv', 'aQ9pdNdkWy', 'MUhplxEUa2', 'VI4pAt5Vi1', 'tlIp0CJRMb', 'jBapaoY1YA', 'rukpC1mHkH'
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, Ly2lpSaeIZ2hmuMgm4.cs	High entropy of concatenated method names: 'Kr82iOP1DT', 'U3n21xLNee', 'tbL2G0oThS', 'VFV2kb0HnG', 'UL92rjtLKL', 'O6S2S7bRlx', 'IkW2FRltOu', 'igo2MIpa93', 'Vtk2T5yPou', 'EQl2X1Xx9N'
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, DodQKgElKD3WcFM3b5.cs	High entropy of concatenated method names: 'D4KhMJhNbI', 'vOIhTNHimO', 'fMSh9rg3pu', 'SRUhe2jI9X', 'v3dhbZYse2', 'uajhd8ZTTs', 'LRPhAaLpd7', 'sOlh0gsKTJ', 'rRphCVnBeZ', 'EpohuArMri'
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, p7Da0a6RAbndVtqN8j.cs	High entropy of concatenated method names: 'Dispose', 'KVZcP7Ptby', 'JXxneaNOqN', 'yyxqqy51LF', 'fwxcfBcAhP', 'a7UczAjmas', 'ProcessDialogKey', 'k7Tn5ONHNx', 'JUdncAdHmA', 'eMvnnuRrVR'
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, LQWl9jgFqx9ed5Z0ac.cs	High entropy of concatenated method names: 'BrYc2XM2R9', 'g9ucZJhtKS', 'SuZc8c5KMZ', 'WR3cmc2dgO', 'iGGcLc1DAi', 'K9ocNHIXJq', 'W9UOsdiVlNaVvr6466', 'WaGV5Md3A46WRNP3Us', 'pOuccJCTY4', 'VR9cQMxN46'
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, IH4LNyTuZc5KMZHR3c.cs	High entropy of concatenated method names: 'YSnpknIZU9', 'YjFpSYvZp9', 'LyCpMBEL2L', 'k8qpTHLSPH', 'I5HpLgBJ7p', 'FUBpNTV5Bg', 'jR9pKW6xOo', 'Qyvpwl0Lag', 'XJNp4nvW9i', 'daApYpWUJc'
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, DICsZ8zaHKaTHria89.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'snl4h0XigF', 'iZU4L8veQP', 'bF14NMGTOc', 'cet4KjuT4k', 's4J4w9ZRAH', 'fb8441J556', 'RXN4YcPhHg'
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, dqkscgc5qRyKRlbcFQB.cs	High entropy of concatenated method names: 'UYp4itGvSC', 'm1m41vF867', 'H9M4GeS6Jl', 'V0p4krMkH3', 'zNr4rEUMqw', 'gyP4Sp2wnX', 'zky4FWV41q', 'mfv4M4keIK', 'hsX4TrbcFv', 'uEV4X8aCCh'
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, TH9snRn08Vg9b5CVEn.cs	High entropy of concatenated method names: 'KbNGJBFcW', 'jJmkaqW8d', 'EpWSIkWDi', 'qoTFFAscP', 'ThWTwMncY', 'Fy1XJL7OD', 'tbIZfBGZR3jKoyKxv0', 'dEtK6K1OrJtlnHvRg2', 'lCywIIGgM', 'DBlYhqS7W'
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, NRRM5XsUNoHCuGlSUC.cs	High entropy of concatenated method names: 'xwQLCGETA5', 'Q2RLDx1HOi', 'BD3Lsy6Vwv', 'NbNLtpRfOX', 'wg4LeD3jh4', 'wZaLVI9oWY', 'yPxLbfe7MN', 'MYLLdg8teU', 'c6XLl3Vke5', 'e6tLAxcqYB'
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, ORrVRmfgs7pNHjuU4H.cs	High entropy of concatenated method names: 'afI4cgk7jw', 'Xhd4QCGDrb', 'hXC4gFsWIl', 'CAG4Oatunq', 'p5K46R63qF', 'giE4RICerO', 'pSZ4JCC1Vb', 'a6UwHfV04r', 'CSdw3FA3YN', 'rjowP0JjoF'
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, tXM2R9Mp9uJhtKSc3Q.cs	High entropy of concatenated method names: 'hj06sBbnSK', 'UAZ6t0dV8J', 'xGa6yYolIY', 'yYD6UgpCHV', 'Ugy6xwDDRM', 'lF26vMwZMv', 'TbN6Hp5awH', 'TLH63s1n3k', 'kM46PVA2c5', 'YHZ6fkCUrE'
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, XUCb71cQCrnCYxpmfib.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Bo5Ysyhws8', 'P6bYtDLwB8', 'IqxYy6YlMn', 'fIdYUqRZTn', 'nn1YxJrrYi', 'MENYvfuCyI', 'LpwYHdJMWH'
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, uw0s4PcnXqDkf7IcS02.cs	High entropy of concatenated method names: 'tJYYiF9oeB', 'TDiY1sHcbq', 'CHuYGqMRa3', 'Icv7Z3Eeqq4hwvc9CWQ', 'OprQcSEINl4P9xHQijy', 'oPLYWAEil1yS3LYmQpI', 'nsf9uxEdXX9GIwmVNK8'
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, LuP0AvAVNu3WAkDN2Z.cs	High entropy of concatenated method names: 'Odr2O5NE9y', 'gF12prUkCf', 'Uux2JJxKZ2', 'g8MJf7iKuN', 'xBoJzgUasw', 'Gmu25yRccX', 'aFi2cs9xuu', 'GTf2nlLX2V', 'HuQ2QFfQdp', 'Nt82g666Ln'
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, PAil9o9HIXJqTnkAlF.cs	High entropy of concatenated method names: 'AeDJIHSXsk', 'EWIJ638T4Q', 'MfiJRxcBbb', 'OVRJ2JD8dX', 'QdmJZ5mapI', 'STiRxflhhh', 'YXyRvhdlnO', 'TOnRH0I76M', 'X1TR3JlDBm', 'SoARPF2Qxi'
Source: 0.2.RFQ#1047.exe.39c8240.10.raw.unpack, YA7n3FZTdLntNid9Yp.cs	High entropy of concatenated method names: 'AUoQI8gCqw', 'SH9QOy1Y1Q', 'otJQ6b2LYO', 'bHcQpYOVsf', 'wS5QRLLpSo', 'QcKQJ9NsfA', 'tEdQ2u7lSk', 'FwfQZR5EWL', 'WXUQWgwn4S', 'BiQQ8ZadHV'

Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\RFQ#1047.exe	Memory allocated: 9F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Memory allocated: 2660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Memory allocated: 24B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Memory allocated: 8640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Memory allocated: 9640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Memory allocated: 9840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Memory allocated: A840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 25B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\RFQ#1047.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 120000000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 119999862	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 119999738	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 119999613	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 119999488	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 119999363	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 2000			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 7854			Jump to behavior

Source: C:\Users\user\Desktop\RFQ#1047.exe TID: 4972	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -23058430092136925s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3472	Thread sleep count: 2000 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3472	Thread sleep count: 7854 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -99546s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -99438s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -99313s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -99188s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -99078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -98969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -98844s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -98734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -98625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -98485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -98375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -98266s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -98141s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -97922s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -97812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -97703s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -97594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -97484s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -97375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -97266s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -97146s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -97016s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -96906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -96797s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -96687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -96578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -96469s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -96359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -96250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -96140s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -96031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -95922s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -95812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -95703s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -95594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -95484s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -95375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -95266s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -95156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -120000000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -119999862s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -119999738s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -119999613s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -119999488s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1616	Thread sleep time: -119999363s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\RFQ#1047.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97146	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 120000000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 119999862	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 119999738	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 119999613	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 119999488	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 119999363	Jump to behavior

Source: MSBuild.exe, 00000003.00000002.4575146951.0000000005B11000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\RFQ#1047.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\RFQ#1047.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\RFQ#1047.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\RFQ#1047.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\RFQ#1047.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\RFQ#1047.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 43C000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 73A008	Jump to behavior

Source: C:\Users\user\Desktop\RFQ#1047.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\RFQ#1047.exe	Queries volume information: C:\Users\user\Desktop\RFQ#1047.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ#1047.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\RFQ#1047.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.RFQ#1047.exe.389e128.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ#1047.exe.38d8b48.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ#1047.exe.38d8b48.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ#1047.exe.389e128.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4571683281.00000000028C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4564658212.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4571683281.0000000002851000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2135311417.000000000389E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ#1047.exe PID: 2488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6440, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.RFQ#1047.exe.389e128.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ#1047.exe.38d8b48.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ#1047.exe.38d8b48.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ#1047.exe.389e128.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4564658212.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4571683281.0000000002851000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2135311417.000000000389E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ#1047.exe PID: 2488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6440, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.RFQ#1047.exe.389e128.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ#1047.exe.38d8b48.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ#1047.exe.38d8b48.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ#1047.exe.389e128.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4571683281.00000000028C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4564658212.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4571683281.0000000002851000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2135311417.000000000389E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ#1047.exe PID: 2488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6440, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	311 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	1 Credentials in Registry	111 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	21 Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	311 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RFQ#1047.exe	32%	Virustotal		Browse
RFQ#1047.exe	26%	ReversingLabs	Win32.Trojan.CrypterX
RFQ#1047.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.xpl.co.nz	203.170.87.105	true	true		unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://r3.o.lencr.org0	MSBuild.exe, 00000003.00000002.4575146951.0000000005B11000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4571683281.0000000002851000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4567897518.0000000000A24000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	RFQ#1047.exe, 00000000.00000002.2135311417.000000000389E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4564658212.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	MSBuild.exe, 00000003.00000002.4567897518.0000000000A58000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4575146951.0000000005B11000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4571683281.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	MSBuild.exe, 00000003.00000002.4567897518.0000000000A58000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4575146951.0000000005B11000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4571683281.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r3.i.lencr.org/0	MSBuild.exe, 00000003.00000002.4575146951.0000000005B11000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4571683281.0000000002851000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4567897518.0000000000A24000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
203.170.87.105	mail.xpl.co.nz	Australia		38719	DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1426825
Start date and time:	2024-04-16 17:13:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RFQ#1047.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.evad.winEXE@3/1@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 90 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.63.206.91, 52.159.126.152, 40.68.123.157, 192.229.211.108, 23.47.204.63, 23.47.204.79, 23.47.204.52, 23.47.204.73, 23.47.204.45, 23.47.204.82, 23.47.204.44, 23.47.204.76, 23.47.204.78, 52.165.164.15, 13.85.23.206, 23.47.204.67, 23.47.204.64, 23.47.204.75, 23.47.204.49, 23.47.204.69, 23.47.204.48, 23.47.204.68, 52.159.127.243, 40.126.7.32, 40.126.28.21, 40.126.28.12, 40.126.28.14, 40.126.28.13, 40.126.28.19, 40.126.28.18, 40.126.28.20, 204.79.197.200, 13.107.21.200
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, www.tm.lg.prod.aadmsa.akadns.net, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wns.notify.trafficmanager.net, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, www-bing-com.dual-a-0001.a-msedge.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, glb.sls.prod.dcat.dsp.trafficmanager.net, www.bing.com, client.wns.windows.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, dual-a-0001.a-msedge.net, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, login.msa.msidentity.com, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, wwwprod.www-bing-com.akadns.net
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:13:54	API Interceptor	2x Sleep call for process: RFQ#1047.exe modified
17:13:56	API Interceptor	12364467x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
203.170.87.105	RFQ#1047.exe	Get hash	malicious	AgentTesla	Browse
203.170.87.105	RFQ 1.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.xpl.co.nz	RFQ#1047.exe	Get hash	malicious	AgentTesla	Browse	203.170.87.105
mail.xpl.co.nz	RFQ 1.exe	Get hash	malicious	AgentTesla	Browse	203.170.87.105
fp2e7a.wpc.phicdn.net	http://169.150.221.147	Get hash	malicious	Unknown	Browse	192.229.211.108
	http://live-uoe-edweb.pantheonsite.io	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://www.dropbox.com/l/AABrfWjSV514IDLhR60LLT60TO4apO7UVoY/privacy#privacy	Get hash	malicious	Unknown	Browse	192.229.211.108
	http://s.ksrndkehqnwntyxlhgto.com	Get hash	malicious	Unknown	Browse	192.229.211.108
	vRp56pf5a9.exe	Get hash	malicious	CredGrabber, PureLog Stealer, zgRAT	Browse	192.229.211.108
	http://www.makefun.online	Get hash	malicious	Captcha Phish	Browse	192.229.211.108
	http://msmetal.com	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://dweb.link/ipfs/bafkreihtggm5lijbcmgnngp56fgtaxfzglditdvyi6vhk6v4yi5nmurq2u?filename=Login.html#lbannon@nexpoint.com	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://dweb.link/ipfs/bafkreihtggm5lijbcmgnngp56fgtaxfzglditdvyi6vhk6v4yi5nmurq2u?filename=Login.html#hello@better.com	Get hash	malicious	Unknown	Browse	192.229.211.108
	http://www.mtalx.com	Get hash	malicious	Unknown	Browse	192.229.211.108

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU	RFQ#1047.exe	Get hash	malicious	AgentTesla	Browse	203.170.87.105
	RFQ 1.exe	Get hash	malicious	AgentTesla	Browse	203.170.87.105
	http://wyndham.ezybill.com.au	Get hash	malicious	Unknown	Browse	122.201.126.100
	https://loveyawork.com.au/stack/office-3D8/index.php	Get hash	malicious	HTMLPhisher	Browse	122.201.80.143
	https://brentwoodbuilding.com.au/mark/auth/parcel.php	Get hash	malicious	Unknown	Browse	185.184.154.193
	LF6B2XTwcV.elf	Get hash	malicious	Gafgyt, Mirai	Browse	27.54.90.247
	https://elgon.com.au/yahoomail/word/index.php	Get hash	malicious	Unknown	Browse	103.68.166.129
	Payment Receipt.vbs	Get hash	malicious	Remcos, GuLoader	Browse	103.226.222.98
	https://bloxe.vn/za.html	Get hash	malicious	Unknown	Browse	27.54.86.65
	payment_Adv.vbs	Get hash	malicious	Remcos, GuLoader	Browse	103.226.222.98

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	file.exe	Get hash	malicious	Unknown	Browse	173.222.162.64
	vRp56pf5a9.exe	Get hash	malicious	CredGrabber, PureLog Stealer, zgRAT	Browse	173.222.162.64
	http://msmetal.com	Get hash	malicious	Unknown	Browse	173.222.162.64
	https://dweb.link/ipfs/bafkreihtggm5lijbcmgnngp56fgtaxfzglditdvyi6vhk6v4yi5nmurq2u?filename=Login.html#hello@better.com	Get hash	malicious	Unknown	Browse	173.222.162.64
	http://www.mtalx.com	Get hash	malicious	Unknown	Browse	173.222.162.64
	HTZ4az17lj.exe	Get hash	malicious	StormKitty	Browse	173.222.162.64
	http://cubes.concordia.ca/track?type=click&enid=bWFpbGluZ2lkPTM2MjMmbWVzc2FnZWlkPTQxMjEmZGF0YWJhc2VpZD05MDEmc2VyaWFsPTEyNzU1MDM1NzUmZW1haWxpZD13YXJpZXN0NTkzMzgud2Vla2x5bWFpbEBibG9nZ2VyLmNvbSZ1c2VyaWQ9NDcxJmZsPSZleHRyYT1NdWx0aXZhcmlhdGVJZD0mJiY=&&&2028&&&http://gbmaucstans.com/?ddg5B=ZnJhbmNvaXMuYm91bGFuZ2VyQGNnaS5jb20=	Get hash	malicious	Unknown	Browse	173.222.162.64
	DHL Receipt_pdf.vbs	Get hash	malicious	AgentTesla	Browse	173.222.162.64
	SecuriteInfo.com.IL.Trojan.MSILZilla.30455.29056.1307.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	173.222.162.64
	Purchase#order10662324.pdf.exe	Get hash	malicious	AgentTesla	Browse	173.222.162.64

Process:	C:\Users\user\Desktop\RFQ#1047.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.9709267708957725
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	RFQ#1047.exe
File size:	634'368 bytes
MD5:	6846f1fb78fad5224b98b0137e7a862d
SHA1:	f40fa249d6464ef5c1f9e39748162fd5d70e7aaa
SHA256:	66a0cfa14afdb23dec776fa355b9f89551405989b9838db6398c77ee6c73c084
SHA512:	dce3134e45ba2a21efcfb4d3f4080dbecdb98d4dd4dafafd7f87daea5822350aab05dd0148b6a53e7ed7e8af26db7ee6a89de6312d1ea921b81f5a10b20326dc
SSDEEP:	12288:tnteikJg6ZUpq4BRAa0yTow0ADZVY8HnvcHEx0MTOw:3eBJgxpq4B+adowrZfnvckG
TLSH:	7AD423D122EA27A1F2F653FA291173040F72B87B4548E7059EC4B1EB5AB2753836E707
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....7...............0.................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x49c2c6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xC237A2E0 [Mon Apr 3 06:21:20 2073 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
inc esi
inc esp
inc ebp
inc esi
inc ebx
push esp
dec esi
inc edi
dec eax
inc ebp
push edi
inc ecx
dec edi
push edx
push edx
cmp byte ptr [ebx+5Ah], al
dec edx
inc esi
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9c272	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9e000	0x5e4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9b034	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x9a2e4	0x9a400	4c9a6badb726c5657de2578842097774	False	0.9742263472447326	data	7.976223626985366	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x9e000	0x5e4	0x600	ae3244a75bfa6afacd2d654020a8f444	False	0.4290364583333333	data	4.192056340190565	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa0000	0xc	0x200	0427bd97cd700d073390810ff2b0adf5	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x9e090	0x354	data			0.41901408450704225
RT_MANIFEST	0x9e3f4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 16, 2024 17:13:53.885703087 CEST	49674	443	192.168.2.6	173.222.162.64
Apr 16, 2024 17:13:53.885704041 CEST	49673	443	192.168.2.6	173.222.162.64
Apr 16, 2024 17:13:54.166915894 CEST	49672	443	192.168.2.6	173.222.162.64
Apr 16, 2024 17:13:58.242888927 CEST	49712	587	192.168.2.6	203.170.87.105
Apr 16, 2024 17:13:58.545114994 CEST	587	49712	203.170.87.105	192.168.2.6
Apr 16, 2024 17:13:58.545212984 CEST	49712	587	192.168.2.6	203.170.87.105
Apr 16, 2024 17:13:59.384289026 CEST	587	49712	203.170.87.105	192.168.2.6
Apr 16, 2024 17:13:59.395700932 CEST	49712	587	192.168.2.6	203.170.87.105
Apr 16, 2024 17:13:59.697180986 CEST	587	49712	203.170.87.105	192.168.2.6
Apr 16, 2024 17:13:59.697403908 CEST	49712	587	192.168.2.6	203.170.87.105
Apr 16, 2024 17:14:00.003189087 CEST	587	49712	203.170.87.105	192.168.2.6
Apr 16, 2024 17:14:00.010113001 CEST	49712	587	192.168.2.6	203.170.87.105
Apr 16, 2024 17:14:00.329638958 CEST	587	49712	203.170.87.105	192.168.2.6
Apr 16, 2024 17:14:00.329687119 CEST	587	49712	203.170.87.105	192.168.2.6
Apr 16, 2024 17:14:00.329721928 CEST	587	49712	203.170.87.105	192.168.2.6
Apr 16, 2024 17:14:00.329871893 CEST	49712	587	192.168.2.6	203.170.87.105
Apr 16, 2024 17:14:00.359599113 CEST	49712	587	192.168.2.6	203.170.87.105
Apr 16, 2024 17:14:00.661768913 CEST	587	49712	203.170.87.105	192.168.2.6
Apr 16, 2024 17:14:00.677556992 CEST	49712	587	192.168.2.6	203.170.87.105
Apr 16, 2024 17:14:00.979262114 CEST	587	49712	203.170.87.105	192.168.2.6
Apr 16, 2024 17:14:00.980441093 CEST	49712	587	192.168.2.6	203.170.87.105
Apr 16, 2024 17:14:01.282983065 CEST	587	49712	203.170.87.105	192.168.2.6
Apr 16, 2024 17:14:01.283988953 CEST	49712	587	192.168.2.6	203.170.87.105
Apr 16, 2024 17:14:01.599713087 CEST	587	49712	203.170.87.105	192.168.2.6
Apr 16, 2024 17:14:01.600014925 CEST	49712	587	192.168.2.6	203.170.87.105
Apr 16, 2024 17:14:01.902515888 CEST	587	49712	203.170.87.105	192.168.2.6
Apr 16, 2024 17:14:01.902848005 CEST	49712	587	192.168.2.6	203.170.87.105
Apr 16, 2024 17:14:02.206264973 CEST	587	49712	203.170.87.105	192.168.2.6
Apr 16, 2024 17:14:02.206540108 CEST	49712	587	192.168.2.6	203.170.87.105
Apr 16, 2024 17:14:02.509093046 CEST	587	49712	203.170.87.105	192.168.2.6
Apr 16, 2024 17:14:02.509785891 CEST	49712	587	192.168.2.6	203.170.87.105
Apr 16, 2024 17:14:02.509919882 CEST	49712	587	192.168.2.6	203.170.87.105
Apr 16, 2024 17:14:02.509919882 CEST	49712	587	192.168.2.6	203.170.87.105
Apr 16, 2024 17:14:02.510087967 CEST	49712	587	192.168.2.6	203.170.87.105
Apr 16, 2024 17:14:02.814424038 CEST	587	49712	203.170.87.105	192.168.2.6
Apr 16, 2024 17:14:02.814443111 CEST	587	49712	203.170.87.105	192.168.2.6
Apr 16, 2024 17:14:02.814460039 CEST	587	49712	203.170.87.105	192.168.2.6
Apr 16, 2024 17:14:02.814475060 CEST	587	49712	203.170.87.105	192.168.2.6
Apr 16, 2024 17:14:02.825556993 CEST	587	49712	203.170.87.105	192.168.2.6
Apr 16, 2024 17:14:02.870275021 CEST	49712	587	192.168.2.6	203.170.87.105
Apr 16, 2024 17:14:03.495121002 CEST	49673	443	192.168.2.6	173.222.162.64
Apr 16, 2024 17:14:03.496428967 CEST	49674	443	192.168.2.6	173.222.162.64
Apr 16, 2024 17:14:03.776304960 CEST	49672	443	192.168.2.6	173.222.162.64
Apr 16, 2024 17:14:05.209971905 CEST	443	49706	173.222.162.64	192.168.2.6
Apr 16, 2024 17:14:05.210072994 CEST	49706	443	192.168.2.6	173.222.162.64
Apr 16, 2024 17:14:15.861531973 CEST	49706	443	192.168.2.6	173.222.162.64
Apr 16, 2024 17:14:15.861630917 CEST	49706	443	192.168.2.6	173.222.162.64
Apr 16, 2024 17:14:15.863904953 CEST	49722	443	192.168.2.6	173.222.162.64
Apr 16, 2024 17:14:15.863969088 CEST	443	49722	173.222.162.64	192.168.2.6
Apr 16, 2024 17:14:15.864252090 CEST	49722	443	192.168.2.6	173.222.162.64
Apr 16, 2024 17:14:15.865124941 CEST	49722	443	192.168.2.6	173.222.162.64
Apr 16, 2024 17:14:15.865140915 CEST	443	49722	173.222.162.64	192.168.2.6
Apr 16, 2024 17:14:16.013802052 CEST	443	49706	173.222.162.64	192.168.2.6
Apr 16, 2024 17:14:16.013825893 CEST	443	49706	173.222.162.64	192.168.2.6
Apr 16, 2024 17:14:16.179956913 CEST	443	49722	173.222.162.64	192.168.2.6
Apr 16, 2024 17:14:16.180130005 CEST	49722	443	192.168.2.6	173.222.162.64
Apr 16, 2024 17:14:35.339215040 CEST	443	49722	173.222.162.64	192.168.2.6
Apr 16, 2024 17:14:35.339658022 CEST	49722	443	192.168.2.6	173.222.162.64
Apr 16, 2024 17:15:33.573424101 CEST	49704	80	192.168.2.6	23.47.204.65
Apr 16, 2024 17:15:33.679718971 CEST	80	49704	23.47.204.65	192.168.2.6
Apr 16, 2024 17:15:33.679878950 CEST	49704	80	192.168.2.6	23.47.204.65
Apr 16, 2024 17:15:37.934330940 CEST	49712	587	192.168.2.6	203.170.87.105
Apr 16, 2024 17:15:38.238459110 CEST	587	49712	203.170.87.105	192.168.2.6
Apr 16, 2024 17:15:38.243614912 CEST	49712	587	192.168.2.6	203.170.87.105

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 16, 2024 17:13:57.920991898 CEST	53451	53	192.168.2.6	1.1.1.1
Apr 16, 2024 17:13:58.236480951 CEST	53	53451	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 16, 2024 17:13:57.920991898 CEST	192.168.2.6	1.1.1.1	0xe3fb	Standard query (0)	mail.xpl.co.nz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 16, 2024 17:13:58.236480951 CEST	1.1.1.1	192.168.2.6	0xe3fb	No error (0)	mail.xpl.co.nz		203.170.87.105	A (IP address)	IN (0x0001)	false
Apr 16, 2024 17:14:14.894503117 CEST	1.1.1.1	192.168.2.6	0x6df7	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 17:14:14.894503117 CEST	1.1.1.1	192.168.2.6	0x6df7	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 16, 2024 17:13:59.384289026 CEST	587	49712	203.170.87.105	192.168.2.6	220-cp-wc12.per01.ds.network ESMTP Exim 4.96.2 #2 Tue, 16 Apr 2024 23:13:59 +0800 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 16, 2024 17:13:59.395700932 CEST	49712	587	192.168.2.6	203.170.87.105	EHLO 910646
Apr 16, 2024 17:13:59.697180986 CEST	587	49712	203.170.87.105	192.168.2.6	250-cp-wc12.per01.ds.network Hello 910646 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 16, 2024 17:13:59.697403908 CEST	49712	587	192.168.2.6	203.170.87.105	STARTTLS
Apr 16, 2024 17:14:00.003189087 CEST	587	49712	203.170.87.105	192.168.2.6	220 TLS go ahead

Target ID:	0
Start time:	17:13:54
Start date:	16/04/2024
Path:	C:\Users\user\Desktop\RFQ#1047.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RFQ#1047.exe"
Imagebase:	0x210000
File size:	634'368 bytes
MD5 hash:	6846F1FB78FAD5224B98B0137E7A862D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2135311417.000000000389E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2135311417.000000000389E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:13:55
Start date:	16/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x440000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.4571683281.00000000028C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.4564658212.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.4564658212.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.4571683281.0000000002851000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.4571683281.0000000002851000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	138
Total number of Limit Nodes:	9

Executed Functions

Function 06CC0A98 Relevance: 3.1, Strings: 2, Instructions: 564
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:, xrefs: 06CC0D54
~, xrefs: 06CC0CEA

Memory Dump Source

Source File: 00000000.00000002.2138819439.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_RFQ#1047.jbxd

Similarity

API ID:
String ID: :$~
API String ID: 0-2431124681
Opcode ID: 95367758e3243e569ce701f8d774fdb7e26738ad02f1363e783d6f46613b459b
Instruction ID: 7deee83ce339e6c25b666e2de229f29a65d5e262d1b5f4e3137fd7a5ab0f3a8d
Opcode Fuzzy Hash: 95367758e3243e569ce701f8d774fdb7e26738ad02f1363e783d6f46613b459b
Instruction Fuzzy Hash: 8D42E775E00218DFDB55CFA9C840A99BBB2FF49314F1580E9E509AB222D732EE91DF50

Uniqueness

Uniqueness Score: -1.00%

Function 02542B88 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2134551323.0000000002540000.00000040.00000800.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2540000_RFQ#1047.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 267ba09f15f01ad216af668b905463025cd86c4c81b3b7ca601d544ea0b1596d
Instruction ID: 901a344d80223dbf5c17af7c54d17db4dbaf2feec268a73fb946e10e94f114cc
Opcode Fuzzy Hash: 267ba09f15f01ad216af668b905463025cd86c4c81b3b7ca601d544ea0b1596d
Instruction Fuzzy Hash: BDE1BD71B016149FDB29DB65C450BAEBBF6BF88708F144469E90ADB2A1CF34E902CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02540A17 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2134551323.0000000002540000.00000040.00000800.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2540000_RFQ#1047.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142994f707bae91236fd668329e8f597b6b02cda57bf0435c7c97cd9b03b3a77
Instruction ID: bf821014ea5463dcc127dec39455bc44c1ddb69539485e7f8c8fdf413e5c5d98
Opcode Fuzzy Hash: 142994f707bae91236fd668329e8f597b6b02cda57bf0435c7c97cd9b03b3a77
Instruction Fuzzy Hash: 70E08034D4D544CFCB505F55A8441F4F77CFB87119F0464A5C50DF7602D92485D4CA1C

Uniqueness

Uniqueness Score: -1.00%

Function 009FD108 Relevance: 6.1, APIs: 4, Instructions: 135
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 009FD196
GetCurrentThread.KERNEL32 ref: 009FD1D3
GetCurrentProcess.KERNEL32 ref: 009FD210
GetCurrentThreadId.KERNEL32 ref: 009FD269

Memory Dump Source

Source File: 00000000.00000002.2133654711.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_RFQ#1047.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 985336531a4b0a23b2aa472f263f5476de4f129a744892717a9592fa94944ef4
Instruction ID: 45123fce43301659d70b0910137f949e0ae422b5110f122ffa0112527b6c6e73
Opcode Fuzzy Hash: 985336531a4b0a23b2aa472f263f5476de4f129a744892717a9592fa94944ef4
Instruction Fuzzy Hash: 7D518BB0901749CFDB14CFAAD948BEEBBF1EF48304F208059E119A7360D7759944CB65

Uniqueness

Uniqueness Score: -1.00%

Function 009FD118 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 009FD196
GetCurrentThread.KERNEL32 ref: 009FD1D3
GetCurrentProcess.KERNEL32 ref: 009FD210
GetCurrentThreadId.KERNEL32 ref: 009FD269

Memory Dump Source

Source File: 00000000.00000002.2133654711.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_RFQ#1047.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ade8ae061e93c862abf7c5f973297eff8f75b8a5b19d76bacf984de5e591a688
Instruction ID: fec5c6b2c06b17b46658abec0360f55f1190da769b355a196c4b9c16703925f4
Opcode Fuzzy Hash: ade8ae061e93c862abf7c5f973297eff8f75b8a5b19d76bacf984de5e591a688
Instruction Fuzzy Hash: 655168B0901749CFDB14CFAAD948BEEBBF2EF88304F208059E519A7360D775A944CB65

Uniqueness

Uniqueness Score: -1.00%

Function 06CCF1B0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06CCF3E6

Memory Dump Source

Source File: 00000000.00000002.2138819439.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_RFQ#1047.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: cb2ffaf848d9159e952ae17366324624de41d10ee0dffe014f0779772d4ad23d
Instruction ID: 9432a8cbf57aa2ff58299048b400dd65e4f8a958cb795cb85e5ea57008d4b3e2
Opcode Fuzzy Hash: cb2ffaf848d9159e952ae17366324624de41d10ee0dffe014f0779772d4ad23d
Instruction Fuzzy Hash: 3F914B71D00659DFEB50CF68C841BEDBBB2BF48320F1485ADE858A7240DB759A85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 009FAE90 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 009FB0E6

Memory Dump Source

Source File: 00000000.00000002.2133654711.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_RFQ#1047.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: cce3066be6f1da0a0978528c9cdfb5a891c081830937da06f6b2988f9f340a64
Instruction ID: 8bd37e51dda22deb66ddb87b1b454d18b2b9b91705d029ff82481ad170c8352c
Opcode Fuzzy Hash: cce3066be6f1da0a0978528c9cdfb5a891c081830937da06f6b2988f9f340a64
Instruction Fuzzy Hash: D1716CB0A00B099FDB24DF2AD45176ABBF5FF88300F00892DE14ADBA40DB75E845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 009F590C Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 009F59C9

Memory Dump Source

Source File: 00000000.00000002.2133654711.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_RFQ#1047.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9ac8ee0a3e8d5f53c9c1dfa73c66d29b8cc04798769b3d69335fbe598c981b26
Instruction ID: fec16930af8d9dd3324f60b95427da40e46a5e135ad85b0391d08ed273c72738
Opcode Fuzzy Hash: 9ac8ee0a3e8d5f53c9c1dfa73c66d29b8cc04798769b3d69335fbe598c981b26
Instruction Fuzzy Hash: 514100B0C0075DCFDB24CFA9C885B9DBBB5BF89304F20816AD508AB261D771694ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 009F449C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 009F59C9

Memory Dump Source

Source File: 00000000.00000002.2133654711.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_RFQ#1047.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: eac49928398e18b7a3ca969c8c33320b5b9aa185171a87a6e2d2bd7f2500d908
Instruction ID: 7765bce618709d8c621fc5172a7eb40c51f00fca0694008e3d1e88304e818296
Opcode Fuzzy Hash: eac49928398e18b7a3ca969c8c33320b5b9aa185171a87a6e2d2bd7f2500d908
Instruction Fuzzy Hash: 8741E2B0C0071DCBDB24DFAAC884B9EBBF5BF49704F60816AD508AB251DBB56945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 009FD421 Relevance: 1.6, APIs: 1, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 009FD3E7

Memory Dump Source

Source File: 00000000.00000002.2133654711.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_RFQ#1047.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 92f599e805bb3d168bbc251627542ef5da4015a93a68ed3bd45151d3af734d30
Instruction ID: 99af17bb418417f01e8945ae0e04c53b9b81e00b53bc4437df47a8bd0bd5dfcf
Opcode Fuzzy Hash: 92f599e805bb3d168bbc251627542ef5da4015a93a68ed3bd45151d3af734d30
Instruction Fuzzy Hash: EB313934A413808FE714EFA5F8547793BA6E7C8750F10852AE9619F7E9CBB84847CB11

Uniqueness

Uniqueness Score: -1.00%

Function 06CCEF28 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06CCEFB8

Memory Dump Source

Source File: 00000000.00000002.2138819439.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_RFQ#1047.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: c67a0178e64caf73c9d6bfbcfe05e0b1f7efe4c4737ac4255a9929dca58df4b2
Instruction ID: 9e7707fb5769ff8aebe3d769ebc62f80e7502d65ac86ea05781848280ac6503e
Opcode Fuzzy Hash: c67a0178e64caf73c9d6bfbcfe05e0b1f7efe4c4737ac4255a9929dca58df4b2
Instruction Fuzzy Hash: EF2113719003499FDB10CFAAC881BEEBBF5FF48320F10842AE919A7240C7799944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 009FD358 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 009FD3E7

Memory Dump Source

Source File: 00000000.00000002.2133654711.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_RFQ#1047.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fb1f2c335ac2cb1d58ba4f8b83b79bd846566c9ea878c52c8c081c9420e3f01e
Instruction ID: 7fac9a3c7e7e83e0f75b9a979640f9c90ebdee903122015d1fec415081ccc7f9
Opcode Fuzzy Hash: fb1f2c335ac2cb1d58ba4f8b83b79bd846566c9ea878c52c8c081c9420e3f01e
Instruction Fuzzy Hash: 752105B5901249DFDB10CFAAD885ADEBFF5EB48314F10841AE918A3310C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06CCF018 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06CCF098

Memory Dump Source

Source File: 00000000.00000002.2138819439.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_RFQ#1047.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 042d49e2d5d2ea1b6f1ea169d232529a78c88c669984064ba5c1bcb23f0d0da7
Instruction ID: 6c67238a2d59c09dcb54be35d840bc8c99131ae5ea8a20cd58a01c2a4cbeaf4b
Opcode Fuzzy Hash: 042d49e2d5d2ea1b6f1ea169d232529a78c88c669984064ba5c1bcb23f0d0da7
Instruction Fuzzy Hash: 1621E4B1C003499FDB10DFAAC881AEEBBF5FF48720F50842EE519A7240D7799944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06CCE958 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06CCE9D6

Memory Dump Source

Source File: 00000000.00000002.2138819439.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_RFQ#1047.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 217f0f86950338dec69f2888711c402e2783479f58c734a47cef8e8f5bf15e86
Instruction ID: a7d72735e3cfc0024914701fb4b05c1e96786881ca58c03d73a4aae7fd678adf
Opcode Fuzzy Hash: 217f0f86950338dec69f2888711c402e2783479f58c734a47cef8e8f5bf15e86
Instruction Fuzzy Hash: B1213771D003098FDB50DFAAC4857EEBBF4AF89320F14842ED559A7241C7789944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 009FD360 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 009FD3E7

Memory Dump Source

Source File: 00000000.00000002.2133654711.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_RFQ#1047.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 42600f8166b332293b139d9908e8c20c451a70e0c4756289c80e8d96824abbba
Instruction ID: a5106da05970d463a5338747bb4e9263186db614cd54775c4d0f8d71bba40a99
Opcode Fuzzy Hash: 42600f8166b332293b139d9908e8c20c451a70e0c4756289c80e8d96824abbba
Instruction Fuzzy Hash: 6121E4B5900249DFDB10CFAAD884ADEBFF9EB48310F14841AE918A3350C379A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 009FA8D0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,009FB161,00000800,00000000,00000000), ref: 009FB372

Memory Dump Source

Source File: 00000000.00000002.2133654711.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_RFQ#1047.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 533c336c0b60899b13471254730174094ba9c79efdcaf75c6fa5498e4b41821b
Instruction ID: 2fe5661c2c5d511e13d387b6200ef7aad04c6d417c9b938c26bd52da8167f949
Opcode Fuzzy Hash: 533c336c0b60899b13471254730174094ba9c79efdcaf75c6fa5498e4b41821b
Instruction Fuzzy Hash: 4B11E4B6904349DFDB10CF9AD444AAEFBF8EB48714F14842AD919A7200C3B9A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06CCEE68 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06CCEED6

Memory Dump Source

Source File: 00000000.00000002.2138819439.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_RFQ#1047.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0f667a23d2e7d1ebc98640b4441f1fc16e69d753c2210393c54a0c504474ec47
Instruction ID: 411545d68637ddc48613e45de04784c869ed913c242b7b91355e280a97b97d26
Opcode Fuzzy Hash: 0f667a23d2e7d1ebc98640b4441f1fc16e69d753c2210393c54a0c504474ec47
Instruction Fuzzy Hash: 6C1114718002499FDB10DFAAC845AEEBBF5AF89320F148419E519A7250C7799540CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 009FB300 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,009FB161,00000800,00000000,00000000), ref: 009FB372

Memory Dump Source

Source File: 00000000.00000002.2133654711.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_RFQ#1047.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 88cf8284145d4b2427d2e3a4cedf836a4a59f753c587db10be26117239615d20
Instruction ID: c85df8e8d31043931cf500abd432fbf891d5d00dac3dbdbf71667e266bd905cb
Opcode Fuzzy Hash: 88cf8284145d4b2427d2e3a4cedf836a4a59f753c587db10be26117239615d20
Instruction Fuzzy Hash: D511E4B6D00349CFDB10CFAAD444A9EFBF4EB48310F15851AD529A7600C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 025438C0 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,02544229,?,?), ref: 025443D0

Memory Dump Source

Source File: 00000000.00000002.2134551323.0000000002540000.00000040.00000800.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2540000_RFQ#1047.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 2eab4096ee487d579a43aeb29cd0ed5eb374aa03354f0df3c19ecc6d0fabfd11
Instruction ID: d00477b629c279678f1b3742b1b57dbb329c0ac349db0598e7a9ee1a21d6d117
Opcode Fuzzy Hash: 2eab4096ee487d579a43aeb29cd0ed5eb374aa03354f0df3c19ecc6d0fabfd11
Instruction Fuzzy Hash: DB1143B1804749CFDB10CF9AD445BEEFBF4EB48324F108459D558A7340C778A944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0254389C Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,02544229,?,?), ref: 025443D0

Memory Dump Source

Source File: 00000000.00000002.2134551323.0000000002540000.00000040.00000800.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2540000_RFQ#1047.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: cb52d32287fb879cacf640c17a083612f6bebe7e6984cfb950c1e89652d8d65d
Instruction ID: b6a31318d16dde04ca9a4a58422cda8bdb1c89185b38c42ab09520c628107291
Opcode Fuzzy Hash: cb52d32287fb879cacf640c17a083612f6bebe7e6984cfb950c1e89652d8d65d
Instruction Fuzzy Hash: EC1143B1804749CFDB10CF9AD445BEEFBF4EB48328F108459D958A7340C738A944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 025438B4 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,02544229,?,?), ref: 025443D0

Memory Dump Source

Source File: 00000000.00000002.2134551323.0000000002540000.00000040.00000800.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2540000_RFQ#1047.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: d0c0c05905989ffca69f05b78b986bd8476b038535a6661bc0bcf569cc27d0d2
Instruction ID: f2ac173ce0cb0b4cf48c688f93d7b0404bb77e46186fb651931cc6c61c743481
Opcode Fuzzy Hash: d0c0c05905989ffca69f05b78b986bd8476b038535a6661bc0bcf569cc27d0d2
Instruction Fuzzy Hash: 1A1143B1804749CFDB10DF9AD445BEEFBF4EB48328F108459DA58A7240D738A944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 02544371 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,02544229,?,?), ref: 025443D0

Memory Dump Source

Source File: 00000000.00000002.2134551323.0000000002540000.00000040.00000800.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2540000_RFQ#1047.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: e2bef4fadf96f73382927bae4ad1fd5453df8f9f62c361cf2275088607750b08
Instruction ID: 0ef8a45a96d6eb5e37b44b0c04ee9a1b969967e617d7c21434feadfe2aaf5b49
Opcode Fuzzy Hash: e2bef4fadf96f73382927bae4ad1fd5453df8f9f62c361cf2275088607750b08
Instruction Fuzzy Hash: D21143B5800649CFDB10CF99D445BDEBBF4EF88324F10845AD958A7241C339A984CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 02541838 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0254189D

Memory Dump Source

Source File: 00000000.00000002.2134551323.0000000002540000.00000040.00000800.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2540000_RFQ#1047.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: fa4cc22cd6acf889f4cf00abc0fd087676f1802681e29c107627a05efc7438f8
Instruction ID: fca46997158bbf5a92e9d02cdf2d2487d11d2f512241ca08fdbf4bbca1bc050d
Opcode Fuzzy Hash: fa4cc22cd6acf889f4cf00abc0fd087676f1802681e29c107627a05efc7438f8
Instruction Fuzzy Hash: 9511FDB58006499EDB10DF9AD945ADABBF8FB48324F10881AE918A3200D375A584CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06CCE8A8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06CCE90A

Memory Dump Source

Source File: 00000000.00000002.2138819439.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_RFQ#1047.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 3f2eee21285d87e5625d59133280c44b0d8d252dd273a585f40df53582fd41dc
Instruction ID: b264eeb3274e1ba7d5a9bdade5e8d4ee316cf139c3fecf0b1007af8741af8304
Opcode Fuzzy Hash: 3f2eee21285d87e5625d59133280c44b0d8d252dd273a585f40df53582fd41dc
Instruction Fuzzy Hash: 4B112871D003498FDB10DFAAC4457DEFBF4EF89624F248419D519A7240C7796544CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 009FB080 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 009FB0E6

Memory Dump Source

Source File: 00000000.00000002.2133654711.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_RFQ#1047.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a455cef8a49862f6e7f55048459d9e426514feab3e5b8cbfd5b4abedac57f179
Instruction ID: 5dd48f55a049a684fe70ac105daf0ef11c94d6c856a887ee7fabe7b2962da47c
Opcode Fuzzy Hash: a455cef8a49862f6e7f55048459d9e426514feab3e5b8cbfd5b4abedac57f179
Instruction Fuzzy Hash: 0C11DFB5C00749CFDB20CF9AD444A9EFBF8EF88314F14841AD529A7610C779A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02541840 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0254189D

Memory Dump Source

Source File: 00000000.00000002.2134551323.0000000002540000.00000040.00000800.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2540000_RFQ#1047.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 1ae3270042de870cd3d71189bfba582c60c73c34e117ee9f9d563a89a89ae991
Instruction ID: cca6ec2e66a4d7ef39284bed0576f613c0bc129175ec80b2510a54450bda5843
Opcode Fuzzy Hash: 1ae3270042de870cd3d71189bfba582c60c73c34e117ee9f9d563a89a89ae991
Instruction Fuzzy Hash: CA11EDB5800649DFDB10CF9AD985BDEBBF8EB48324F10841AE918A7200C375A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0088D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133277139.000000000088D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0088D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_88d000_RFQ#1047.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7716264e2d0b30905577d7f561c39040f02bdc8bf8592e51061d2f0834458377
Instruction ID: 784d2dc33f354440b2ec79dc17f5ebb13bb4490312d637ee32f4ecbc0fd3025e
Opcode Fuzzy Hash: 7716264e2d0b30905577d7f561c39040f02bdc8bf8592e51061d2f0834458377
Instruction Fuzzy Hash: 3221D372504344EFDF05EF54D9C0B26BB66FB88314F24C569ED098B286C37AE856CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0088D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133277139.000000000088D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0088D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_88d000_RFQ#1047.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 849f35d1422f7ed19ae75d8e2fdf803c304bcce99e295937f37ae38002b61afa
Instruction ID: 419dd8422f4d3ce08bafe1016a49f184ecb4eb5c77142f1357d36c0f78cc33fe
Opcode Fuzzy Hash: 849f35d1422f7ed19ae75d8e2fdf803c304bcce99e295937f37ae38002b61afa
Instruction Fuzzy Hash: 36212871500304EFDB04EF14D9C0B16BF65FB94324F20C16DD9098B296C336E856CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0089D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133388875.000000000089D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0089D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_89d000_RFQ#1047.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e411bab07afa61cb25afc4fc4f77f75e0abd405a8697bbefc70a6ca14dff0816
Instruction ID: 63d2af790f43dff603002d48f83319bf3e1d4690afe4ca718474ab5b561c30ed
Opcode Fuzzy Hash: e411bab07afa61cb25afc4fc4f77f75e0abd405a8697bbefc70a6ca14dff0816
Instruction Fuzzy Hash: D721F271604704EFDF14EF24D9C4B26BB65FB84318F28C56DE90A8B286C33AD847CA65

Uniqueness

Uniqueness Score: -1.00%

Function 0089D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133388875.000000000089D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0089D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_89d000_RFQ#1047.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ecd8f6876a58716235f87eb9a9a67c6ae366c221cd703d36b5fd90736bbf3d7
Instruction ID: 6fe799319bfc91d894112626cc936e90f50a4f2bdb5e210e694cf0d72d9830c4
Opcode Fuzzy Hash: 3ecd8f6876a58716235f87eb9a9a67c6ae366c221cd703d36b5fd90736bbf3d7
Instruction Fuzzy Hash: 6D212971504304EFDF05EF54D5C0B25BB65FB84318F28C56DE9098B392C336E846CA65

Uniqueness

Uniqueness Score: -1.00%

Function 0088D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133277139.000000000088D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0088D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_88d000_RFQ#1047.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a958cd7c859b04241e3965f2995fa9ff46dd324e9e88069bdc96e2e9819e0d2
Instruction ID: e07c006cc1799c4e016738cffdb98d46256a6c4bb8e74a75cc076a363298fb29
Opcode Fuzzy Hash: 8a958cd7c859b04241e3965f2995fa9ff46dd324e9e88069bdc96e2e9819e0d2
Instruction Fuzzy Hash: 60219D76504244DFCB06DF50D9C4B16BF62FB84314F24C6A9DC094B696C33AE82ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0088D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133277139.000000000088D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0088D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_88d000_RFQ#1047.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
Instruction ID: 02530efbc53b5480469b938e74ba198bdda180e45869192a6b0af2b39390da13
Opcode Fuzzy Hash: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
Instruction Fuzzy Hash: 3111B176504344DFCB15DF10D5C4B16BF71FB94324F24C6A9D8094B656C33AE85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0089D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133388875.000000000089D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0089D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_89d000_RFQ#1047.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
Instruction ID: 6f1a81b52a8d5a15f8ad1a9324834605ac5a79169eb1213d67e0c3bde92b0333
Opcode Fuzzy Hash: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
Instruction Fuzzy Hash: 4D118B75904384DFCB15DF50D5C4B15FBA2FB84314F28C6A9D8498B696C33AE84ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0089D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133388875.000000000089D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0089D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_89d000_RFQ#1047.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
Instruction ID: f0cfc71b2129b9e232f371888a41e019833675439fc7f9456ab5929d12e2fe3a
Opcode Fuzzy Hash: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
Instruction Fuzzy Hash: E511BB75504780DFCB11DF14D5C4B15FBA2FB84314F28C6AAD8098B656C33AD80ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0088D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133277139.000000000088D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0088D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_88d000_RFQ#1047.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f13d546fd2e871966aa9c2e77e9ac00fb5ae1ee1c3016dcea888016b2c025028
Instruction ID: b258e3498f5fbf151a87a61081c4ebfd6d7306aa917023d061a46602ba3d4be7
Opcode Fuzzy Hash: f13d546fd2e871966aa9c2e77e9ac00fb5ae1ee1c3016dcea888016b2c025028
Instruction Fuzzy Hash: 0301A771005344EAE7107E25DD84B66FF98FF41764F14C51AED098A2C6D6799844C771

Uniqueness

Uniqueness Score: -1.00%

Function 0088D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133277139.000000000088D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0088D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_88d000_RFQ#1047.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36342c323d323b0202130fb29a456d5475869915cd7201f771e8f0968e91371e
Instruction ID: 00674e41194825f7597513c84e6ff5f3cd0f33ebe65ec1f0fd1f0c091e5ac94f
Opcode Fuzzy Hash: 36342c323d323b0202130fb29a456d5475869915cd7201f771e8f0968e91371e
Instruction Fuzzy Hash: 95F06D71405344AAEB10AE16CD88B66FFA8EB91734F18C45AED084B286C3799844CBB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06CCC448 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138819439.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_RFQ#1047.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c23769dbb63dd6cc1028f99a78d850c82d9bbb9eec93612e6512109f598b6499
Instruction ID: 423db4761a73aa558b4d0ceee2d3bd3b51c6e4a792a91a6214b0413a031f2a0d
Opcode Fuzzy Hash: c23769dbb63dd6cc1028f99a78d850c82d9bbb9eec93612e6512109f598b6499
Instruction Fuzzy Hash: 20E12B74E002598FDB14DFA9C5809AEFBF2FF89315F248169D419AB359C730A942CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06CCE080 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138819439.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_RFQ#1047.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eae0f6c8afcc54ae5376713ebc4d239adbc42af242376339ef80be8ffd5d906
Instruction ID: 5cb14ce0c1b0cc2521e9a4bcebb3a890a6f698d42f3349bb2ac5d407b9f4653e
Opcode Fuzzy Hash: 9eae0f6c8afcc54ae5376713ebc4d239adbc42af242376339ef80be8ffd5d906
Instruction Fuzzy Hash: 69E13C74E00259CFDB14DF99C584AAEFBB2FF89315F248169D415AB359C730A942CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06CCC010 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138819439.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_RFQ#1047.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de47afe02ecb7bc4cd475f91a38f69a479aaf2e162fc3445a04da24016f641d0
Instruction ID: bdf0393b2027b935ccf91f499301a9111b666e699093c53aff49fca5e774fd53
Opcode Fuzzy Hash: de47afe02ecb7bc4cd475f91a38f69a479aaf2e162fc3445a04da24016f641d0
Instruction Fuzzy Hash: 50E13C74E002598FDB14DFA9C5909AEFBF2FF89315F248169D819AB355C730A942CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06CCEA30 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138819439.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_RFQ#1047.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bf7d36a39d767e86cb405f3ab84729efa92c280f1c28abed03823e7dd4ad565
Instruction ID: 6ed0da9c8250cc9ebccc18e1a07655577ae04b097285a415abf0ef7584d44a94
Opcode Fuzzy Hash: 1bf7d36a39d767e86cb405f3ab84729efa92c280f1c28abed03823e7dd4ad565
Instruction Fuzzy Hash: 34E12A74E002598FDB14DFA9C5909AEFBF2FF89315F248169D815AB359C730A942CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06CCC880 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138819439.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_RFQ#1047.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ace51c3b8b3867ba8a3c61a8077bf504aa554ef5c4844c0e45cf293203ab9d49
Instruction ID: 43d5151b8038b6265c8c4c147048810315dba991e0854e1a48680656e5381348
Opcode Fuzzy Hash: ace51c3b8b3867ba8a3c61a8077bf504aa554ef5c4844c0e45cf293203ab9d49
Instruction Fuzzy Hash: D1E12C74E002598FDB14DFA9C5909AEFBB2FF89315F248169D419AB359C730AD42CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06CC3789 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138819439.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_RFQ#1047.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc44a3968dfe170d3693cdc552b0f578b471dae0819e1d258b2e73db43fe5aac
Instruction ID: 9a8a9c9ea1c842a4562d571ee1be256d3b1b483b583f9248a74b1cce31e65da5
Opcode Fuzzy Hash: fc44a3968dfe170d3693cdc552b0f578b471dae0819e1d258b2e73db43fe5aac
Instruction Fuzzy Hash: D1D1163192065ACADB00EB64D89069DF7B1FFA9300F20D79AE54A77214EB706AC5CF81

Uniqueness

Uniqueness Score: -1.00%

Function 009FDCD4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133654711.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_RFQ#1047.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c62fcaa1e9a224df061724955b3056a1ddb4771d6da61c5b176557b932c4e10
Instruction ID: a3af0f674b1f9855555cf3eb05c2339d30158b9c24ab66f21f81e0f29405ac4e
Opcode Fuzzy Hash: 4c62fcaa1e9a224df061724955b3056a1ddb4771d6da61c5b176557b932c4e10
Instruction Fuzzy Hash: C9A18C32E002098FCF15DFB5D8545EEB7B6FF84300B1585BAEA05AB265DB71E906CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06CC3798 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138819439.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_RFQ#1047.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3a8017a69b09e6a9b565581cb5c90e8140c98fb6894c8b6499e63408862afff
Instruction ID: 52ade8bdc300603338ab54b638c05799c4b2cbdf21fbf59780119373d52343a6
Opcode Fuzzy Hash: a3a8017a69b09e6a9b565581cb5c90e8140c98fb6894c8b6499e63408862afff
Instruction Fuzzy Hash: F1D1163192065ACADB00EB64D99069DF3B1FF99300F20D7AAE54A77214FB706AC5CF81

Uniqueness

Uniqueness Score: -1.00%

Function 06CCBFE0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138819439.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_RFQ#1047.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40e58e8109a34896c5c6bcbe4ed2bb77c11ea81bc23b726a59f068e3660c5786
Instruction ID: 0e596cf59eac76cff8f0b46a15bed5811714eea4da3536a3d93e7ac81164ddc9
Opcode Fuzzy Hash: 40e58e8109a34896c5c6bcbe4ed2bb77c11ea81bc23b726a59f068e3660c5786
Instruction Fuzzy Hash: AD515C70E002598FDB14CFA9C9905AEFBF2FF89304F24816AD458AB356D7349942CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06CCC437 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138819439.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_RFQ#1047.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af0b7b0c910a842121cbc89de203993b61a8bfb720c5f2b7f5ddb3756449cbac
Instruction ID: bd36c7135d16b1011f6931f769177ecfb5b5b3df34d989e3eaf062d078d982c2
Opcode Fuzzy Hash: af0b7b0c910a842121cbc89de203993b61a8bfb720c5f2b7f5ddb3756449cbac
Instruction Fuzzy Hash: 20512870E002598FDB14CFA9C5905AEFBF2FF89315F2481AAD458AB356D7309942CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06CCC870 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138819439.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_RFQ#1047.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f24250c75dda64e492aed8ef1fa298099e127c52ad44694e26e0569fe6fe1e22
Instruction ID: 105cf04ff90ab2fdcbeaa6e0500b63fdd2ccba76bfba114edd734eb26c889400
Opcode Fuzzy Hash: f24250c75dda64e492aed8ef1fa298099e127c52ad44694e26e0569fe6fe1e22
Instruction Fuzzy Hash: C2512770E002598FDB14CFA9C5805AEFBF2FF89315F24C16AD419AB255D730AA42CFA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: MSBuild.exePID: 6440, Parent PID: 2488COMMON

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	97
Total number of Limit Nodes:	15

Executed Functions

Function 026AD065 Relevance: 2.2, Instructions: 2232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9d0ac29929f64f64c55ce19d56ef56f6e845235f10d518ec70dff9396389a78
Instruction ID: 7732fec4bf99436a85d57c2183ded0e5cc9dead25a931c33f8d3a0409124e3ec
Opcode Fuzzy Hash: b9d0ac29929f64f64c55ce19d56ef56f6e845235f10d518ec70dff9396389a78
Instruction Fuzzy Hash: 0B331D31D107198EDB11EF68C8906ADF7B1FF99300F15D69AE449A7221EB70AAC5CF81

Uniqueness

Uniqueness Score: -1.00%

Function 026AB2D7 Relevance: 1.2, Instructions: 1238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfa22d2a8ae83a23fb758af51ad88df8c11799d462e2d0632ea54358a8314448
Instruction ID: ff87dd2c8f364a86fc5a0f15743d6963b8268a754b1d63593c4d568e46b93d02
Opcode Fuzzy Hash: cfa22d2a8ae83a23fb758af51ad88df8c11799d462e2d0632ea54358a8314448
Instruction Fuzzy Hash: 92D2D931D10B5A8ADB11EB68C8946A9F7B1FF99300F11D79AE45877221FB70AAC4CF41

Uniqueness

Uniqueness Score: -1.00%

Function 026A4A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02c59584324e7f794139a3ac8c7a4b0ed67ffd5fbe740704c6cfc859fb874666
Instruction ID: 3bd37fff11c02298113f3d1291801d73bdc35b50f554571be354653b2d5bee75
Opcode Fuzzy Hash: 02c59584324e7f794139a3ac8c7a4b0ed67ffd5fbe740704c6cfc859fb874666
Instruction Fuzzy Hash: 76B14C70E00209CFDB14DFA9CCA179DBBF2AF88754F148529D819AB394EBB49845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 026A3E80 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d05a2d31c24d4147c54d52217a7a049adb223d1e3885a8a4c39a312822ca5df8
Instruction ID: 6c5b3a3f7195a7a60b87c3d4d0841a683c90a069f30f5c808c411eb9726cb738
Opcode Fuzzy Hash: d05a2d31c24d4147c54d52217a7a049adb223d1e3885a8a4c39a312822ca5df8
Instruction Fuzzy Hash: 40915870E10249CFDB10CFA9C9A17AEBBF2AF88304F148129E415AB394EB749C45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0542583C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05426BD1

Memory Dump Source

Source File: 00000003.00000002.4575097787.0000000005420000.00000040.00000800.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5420000_MSBuild.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 6795367f914e7534f60f8eac54543ae897f5bfee2417976a35e88e619a9c6091
Instruction ID: 9098bbeda8b195b46de3a124793af9ce9bcaa75f0863a412d67571d66b17e710
Opcode Fuzzy Hash: 6795367f914e7534f60f8eac54543ae897f5bfee2417976a35e88e619a9c6091
Instruction Fuzzy Hash: 03412AB5A00325DFDB14CF59C488AAABBF5FF88314F25C499D519AB321D735A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05427260 Relevance: 1.6, APIs: 1, Instructions: 74
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 054278F0

Memory Dump Source

Source File: 00000003.00000002.4575097787.0000000005420000.00000040.00000800.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5420000_MSBuild.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 383d629530d94f76cf71705223a6984ed755993aad647df868a32906d48071dd
Instruction ID: 953705546814404956cc1597f0c35ed9b245e575e7170b8c8338fce0673fd3a8
Opcode Fuzzy Hash: 383d629530d94f76cf71705223a6984ed755993aad647df868a32906d48071dd
Instruction Fuzzy Hash: 6B31EFB0901329DFEB10CF99C594BCEBBF5EF48704F24806AE409AB390D7B46845CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0542785C Relevance: 1.6, APIs: 1, Instructions: 73
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 054278F0

Memory Dump Source

Source File: 00000003.00000002.4575097787.0000000005420000.00000040.00000800.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5420000_MSBuild.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 313bedd2218f37f6f1af60da5ff76029aa3987abbe59a8e6468180d77a212b50
Instruction ID: 45e2a845626adf11a26035c7a5f2469a0a6238cd8cd9c99557fba463af7736e3
Opcode Fuzzy Hash: 313bedd2218f37f6f1af60da5ff76029aa3987abbe59a8e6468180d77a212b50
Instruction Fuzzy Hash: B731EDB0901329DFEB10CF99C594BCEBBF5AF48304F24805AE409BB390DB746845CB65

Uniqueness

Uniqueness Score: -1.00%

Function 054293AB Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 0542942B

Memory Dump Source

Source File: 00000003.00000002.4575097787.0000000005420000.00000040.00000800.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5420000_MSBuild.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 3707e17b47d04c1ca057c0efbee20a3357b682232b94538acc47334fdc441841
Instruction ID: e86b807d02cbf9b40bfa0a3b8798fafea7cbf93471d91fe902832a031f8a38ac
Opcode Fuzzy Hash: 3707e17b47d04c1ca057c0efbee20a3357b682232b94538acc47334fdc441841
Instruction Fuzzy Hash: F42110B5D042199FDB14CF9AD844BEEFBF5BF88310F10842AE419A7250CB74A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 054293B0 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 0542942B

Memory Dump Source

Source File: 00000003.00000002.4575097787.0000000005420000.00000040.00000800.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5420000_MSBuild.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 6e7945b6e260291de4b87069895660ca644becf364b54b30c76329a6474680cf
Instruction ID: 3846ff4c2c18e2d0fcd0b3dfb99d2c2a17cdad6928b4082486537f799cc30bbd
Opcode Fuzzy Hash: 6e7945b6e260291de4b87069895660ca644becf364b54b30c76329a6474680cf
Instruction Fuzzy Hash: 2E2110B1D042199FDB14CF9AD844BEEFBF5BF88310F10842AE419A7250CB74A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05425892 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,05426E25), ref: 05426EAF

Memory Dump Source

Source File: 00000003.00000002.4575097787.0000000005420000.00000040.00000800.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5420000_MSBuild.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: ac106451d519e18789693849b6c2d4990f04a281f473b92be9abe1a56b2318ee
Instruction ID: abc6b2410dfb951cb146f6b3adde1f79f75e9375bd4e54648a072ee54ea792e5
Opcode Fuzzy Hash: ac106451d519e18789693849b6c2d4990f04a281f473b92be9abe1a56b2318ee
Instruction Fuzzy Hash: 201122B1804259CFDB10CF9AC485BDEBBF4AB48320F20841AD519B7340C778A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0542714C Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 05427775

Memory Dump Source

Source File: 00000003.00000002.4575097787.0000000005420000.00000040.00000800.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5420000_MSBuild.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 2d8bec8f7f1a44e06ca47132895cfc677b2b858f3b62e3dc37583b4f01820603
Instruction ID: 4abd2e3e0757c5f0d4dcfdf8a7e27c9dc99cea81ad218dd7c3ce69fedb5db52b
Opcode Fuzzy Hash: 2d8bec8f7f1a44e06ca47132895cfc677b2b858f3b62e3dc37583b4f01820603
Instruction Fuzzy Hash: 3C1112B5804759CFDB20DF9AD484BDEBBF8EB88320F20845AD519A7310C378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05425894 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,05426E25), ref: 05426EAF

Memory Dump Source

Source File: 00000003.00000002.4575097787.0000000005420000.00000040.00000800.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5420000_MSBuild.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: b07253842d5b2e957a840e9010267d0621231f1e39f87c2b522541318f282ba8
Instruction ID: b404a560c187a3e006f7c2170c50305c67e385a8f133343c2db71f9dd8b9b9c1
Opcode Fuzzy Hash: b07253842d5b2e957a840e9010267d0621231f1e39f87c2b522541318f282ba8
Instruction Fuzzy Hash: B0112EB1804758CFDB20CF9AD444BDEBBF8EB88720F20845AE519A7300C774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05427719 Relevance: 1.5, APIs: 1, Instructions: 45
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 05427775

Memory Dump Source

Source File: 00000003.00000002.4575097787.0000000005420000.00000040.00000800.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5420000_MSBuild.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: d4cc92d502590caaf2f8c0508043894db8ea08f4a7eec80f6963d00c07d1fa21
Instruction ID: 25ca37cbfcbe36d12f3c310aefb13b1a47fd388d5b226d2c5f236e29c0152fb3
Opcode Fuzzy Hash: d4cc92d502590caaf2f8c0508043894db8ea08f4a7eec80f6963d00c07d1fa21
Instruction Fuzzy Hash: 241115B5800759CFDB10CFAAD885BDEBBF4EB48314F14845AD519A7310D378A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05426E49 Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,05426E25), ref: 05426EAF

Memory Dump Source

Source File: 00000003.00000002.4575097787.0000000005420000.00000040.00000800.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5420000_MSBuild.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: cb93511dfb78d749244da6bc1d9dd2b3bbf08531adeb986d11e36600835fb981
Instruction ID: 07ea61cdab75b681f2e36707691fe571c7fb6af13fef34ff0ae771bb21775912
Opcode Fuzzy Hash: cb93511dfb78d749244da6bc1d9dd2b3bbf08531adeb986d11e36600835fb981
Instruction Fuzzy Hash: 24113DB5800258CFDB20CF9AC585BDEBBF4AF48320F20841AD519B7300C738A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 026A7908 Relevance: .6, Instructions: 554
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8b9c32b96c025b0d0949a912f3a0751ef2e0d35763cacf4a4e135620e2bcbfd
Instruction ID: 3654aac6d728f0c312080f0be930ba4be8b29ecaf5d8c05e4b273348e89d1419
Opcode Fuzzy Hash: a8b9c32b96c025b0d0949a912f3a0751ef2e0d35763cacf4a4e135620e2bcbfd
Instruction Fuzzy Hash: 141260347102028BEB29AB38E46536CB7A2EBCA346F10497DE505CB355DF79ED469F80

Uniqueness

Uniqueness Score: -1.00%

Function 026A96E0 Relevance: .4, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80145fa93c0102a7c7a831d256691ba2d9d8accd8c88c6e53726d9984de27fa9
Instruction ID: 9d8784bb41eda3c7e467f128c12dc84f96178b40727dba82dc45ea25d63aa2e2
Opcode Fuzzy Hash: 80145fa93c0102a7c7a831d256691ba2d9d8accd8c88c6e53726d9984de27fa9
Instruction Fuzzy Hash: 6ED1AF30A012058FDB14DF69D8907AEBBB6FF89310F20856AE909EB395D734DC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 026A9364 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70256bc89b0e0f8030f547a8d9d4e8c9c2dfa1b8eae7e19ac11f35b0c69a75c7
Instruction ID: e9377768da3c073c88796f78e54ec41cbfa9a69fed4241a56e13f7ef97b12eb3
Opcode Fuzzy Hash: 70256bc89b0e0f8030f547a8d9d4e8c9c2dfa1b8eae7e19ac11f35b0c69a75c7
Instruction Fuzzy Hash: 19C19F34A012058FDB18DF79D4A4AADBBB2EF89311F208469E906E7395DB35EC42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 026A4A8C Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4403d4827522a43ba53769a053d54f62a470a60f98ebdc2b3657e6572cb2e3a5
Instruction ID: b1eba4bc127efa2b141ef1c295447844558c195cef36fed9c64e7112f3b80d47
Opcode Fuzzy Hash: 4403d4827522a43ba53769a053d54f62a470a60f98ebdc2b3657e6572cb2e3a5
Instruction Fuzzy Hash: 30B16B70E00249CFDB10DFA8DCA179DBBF1AF88754F148529D819AB394EBB49885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 026A3E77 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a949b145825b401e1b1a377a392a4e4ae40a92dab96dacf31d2971c940b49544
Instruction ID: 4c950f10931dad6d52836397ad9679ee993e70660f983073cc27d62c8c07f31c
Opcode Fuzzy Hash: a949b145825b401e1b1a377a392a4e4ae40a92dab96dacf31d2971c940b49544
Instruction Fuzzy Hash: 95A14970E10249DFDB10CFA8C9957AEBBF2AF88314F148129E415A7354EB749C55CF91

Uniqueness

Uniqueness Score: -1.00%

Function 026A4804 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75b148623cb89ef3fc99f91bd9fc462ae11ddbb69b215f71433c49f920986abf
Instruction ID: 82c9e3ffc0c7bcb6c0cc2d0a426c8c7e9070e1ab5e3fb9f78e7fa6b0035bbc3c
Opcode Fuzzy Hash: 75b148623cb89ef3fc99f91bd9fc462ae11ddbb69b215f71433c49f920986abf
Instruction Fuzzy Hash: 877168B0E00249DFDB10CFA9D89179EBBF2BF88714F148129E415AB354EBB49842CF95

Uniqueness

Uniqueness Score: -1.00%

Function 026A4810 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8048fb29794247d17d6fb33abd41cc9b527996c85f7fec0f889adffc5e1a06a2
Instruction ID: 021cc627b8c3f668f2a0ae7e90ea02ee972bfb9f59977206afde693cf4543e68
Opcode Fuzzy Hash: 8048fb29794247d17d6fb33abd41cc9b527996c85f7fec0f889adffc5e1a06a2
Instruction Fuzzy Hash: B8716A70E00249DFDB14CFA9D89179EBBF2BF88714F148129E415AB354EBB49841CF95

Uniqueness

Uniqueness Score: -1.00%

Function 026A6F23 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18e658a8fc0b5fdab6c4a1d2e548dc34fb3b99f956b52fb9a4f2f66b3f6b3b31
Instruction ID: bf21484c78ca6cf45222e35f3259a96f475cab8294876a7f29efeb020bf0f0c5
Opcode Fuzzy Hash: 18e658a8fc0b5fdab6c4a1d2e548dc34fb3b99f956b52fb9a4f2f66b3f6b3b31
Instruction Fuzzy Hash: 3051D170A002459FDF25DF78C4617AEB7B6EF8A304F148569E405EB391DB719C428F91

Uniqueness

Uniqueness Score: -1.00%

Function 026A6CDF Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be4687bf6b2f6139def0545cba6147cae68da4c9f412e916903f526e46326b6a
Instruction ID: 9d42a60ec296759c5953d6b130a8196bc60355df5c394bd5159d58ee173c1402
Opcode Fuzzy Hash: be4687bf6b2f6139def0545cba6147cae68da4c9f412e916903f526e46326b6a
Instruction Fuzzy Hash: C8512371E002188FDF18DFAAC864BADBBB5BF48304F18811AE815BB391D774A844CF95

Uniqueness

Uniqueness Score: -1.00%

Function 026A6CE8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b351cc9882e58bfbe6e505d63b43d52fe178498fae34f57fe9afbae38fa867dc
Instruction ID: def2c18c9bb6c7e950c16e4bf9970e7125b98802028f1d38c3551a7099939efb
Opcode Fuzzy Hash: b351cc9882e58bfbe6e505d63b43d52fe178498fae34f57fe9afbae38fa867dc
Instruction Fuzzy Hash: 32510371E002188FDF18DFAAC8A4BADBBB5BF48314F188519E815BB391D774A844CF95

Uniqueness

Uniqueness Score: -1.00%

Function 026A112B Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ef9946c82b94da973b34ea46d42c07764426626755a5ba97308853e55226874
Instruction ID: 70f5d47a2ddb67140a8fb89b7a2da266944edf0e4daf2f8765d78e275d6a1e9a
Opcode Fuzzy Hash: 8ef9946c82b94da973b34ea46d42c07764426626755a5ba97308853e55226874
Instruction Fuzzy Hash: AF51BD39201B46CFD70AFF28F894B993BB6F7E630571459E9D1004B23AEA686905DB80

Uniqueness

Uniqueness Score: -1.00%

Function 026AF4CD Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 911c884a8f57fee7beb8cdd2e4d776d0d10f687d25f52ff18b61b44b5e16e832
Instruction ID: 69146a3d2f1087b71fe4e831c05789c6f61c2ebc50547d0f9181398ac6373974
Opcode Fuzzy Hash: 911c884a8f57fee7beb8cdd2e4d776d0d10f687d25f52ff18b61b44b5e16e832
Instruction Fuzzy Hash: 0C41C230B002458BDB19AB34D56476E7BB3AFC9254B2445A8D402DB395EF36CC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 026A1138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40f6ef18f67ea47f5993e64bc71afa48510d41b531f481f2c72e7891b4e0af7
Instruction ID: aea269de8845541d93a81e6974780271d8507974102f70e9cdae68f92d9205e8
Opcode Fuzzy Hash: f40f6ef18f67ea47f5993e64bc71afa48510d41b531f481f2c72e7891b4e0af7
Instruction Fuzzy Hash: CE51BC39201B46CFD70AFF29F894B893BB6F7E630531459E9D1004B239EEB86905DB80

Uniqueness

Uniqueness Score: -1.00%

Function 026AF390 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7380dd61b3cd87bfdc268c36df9663b581facbca1e990f283dda246896118f0
Instruction ID: f738f7f34ff454464551e384e820871718d744e7c7eb51b03439cebb9c01b3cb
Opcode Fuzzy Hash: f7380dd61b3cd87bfdc268c36df9663b581facbca1e990f283dda246896118f0
Instruction Fuzzy Hash: DC318E35E006059BDB19CF65D8A469EB7B2FF88300F108929E806E7751EB75EC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 026A6F78 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50e9832e9ac426472153864ee1e36d0b03a8aabdf766a37e7a2bd1fabf77b725
Instruction ID: 6455db02fc78fa001fd44efeb650a38a4ec217c375a201925403641bdc5db0d8
Opcode Fuzzy Hash: 50e9832e9ac426472153864ee1e36d0b03a8aabdf766a37e7a2bd1fabf77b725
Instruction Fuzzy Hash: 1C316E70E002498BEB15CFA5D46179EF7B6EF85300F108525E406EB340DB719D42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 026A26DC Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c49b3f9acf1f50200d96fa1c53c15bb5dfbf96f120c85444f997aa5b11f3c1b6
Instruction ID: b196b69d650c51fd151712ecad155c7c6507a9ef06dbf4978a7bb1e486035ecf
Opcode Fuzzy Hash: c49b3f9acf1f50200d96fa1c53c15bb5dfbf96f120c85444f997aa5b11f3c1b6
Instruction Fuzzy Hash: CA410FB0900349DFEB10CFA9C494ADEBBB5BF48310F148129E819AB250DB359949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 026AF3A0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86105a9912c1b4536a51277a16ac20004b1a57d3d652c12747a1396cbb2cf255
Instruction ID: 5f0ce211a95461d25a0b680beda76365f4e8632beec91a9964d8faebe5079855
Opcode Fuzzy Hash: 86105a9912c1b4536a51277a16ac20004b1a57d3d652c12747a1396cbb2cf255
Instruction Fuzzy Hash: 5B315C34F006059BDB19DF65D86469EB7B2FF89300F108529E806E7791DB75EC42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 026A26E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca18ab99f240fce973f665124e6e898cf39fe3ba9dd03199e20488facdb6f85
Instruction ID: 97fa756a338ac3cef613bbb8c7fb8b0c08d2c88263722a85820aa56e37aef8d5
Opcode Fuzzy Hash: 9ca18ab99f240fce973f665124e6e898cf39fe3ba9dd03199e20488facdb6f85
Instruction Fuzzy Hash: 1D41EFB0D00348DFEB10CFA9C594ADEBBF5BF48710F108029E819AB250DB75A949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 026A17C0 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c226b8510c803baf5ede3db5d88e6f2a19c70c0eb27d427f36dc47744769f7ce
Instruction ID: 10dd35f1bef3aade7c3e150cb102f4fd597990424ba9d875e06afade730fb6e3
Opcode Fuzzy Hash: c226b8510c803baf5ede3db5d88e6f2a19c70c0eb27d427f36dc47744769f7ce
Instruction Fuzzy Hash: 94212935F002019BDF11AB78A8647AA3BE6EB8A754F1454E5EA0EC7344EB38CC418F84

Uniqueness

Uniqueness Score: -1.00%

Function 026A9251 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a15bfc8f13407a6ae5b71a4bd75fd7f2f79df18402b40a3926cf8b3723f003ec
Instruction ID: e33bedd2e9ee5fb0bb2414b414af9a0bd4b1667f09b9f5491d745c53c3812af0
Opcode Fuzzy Hash: a15bfc8f13407a6ae5b71a4bd75fd7f2f79df18402b40a3926cf8b3723f003ec
Instruction Fuzzy Hash: D2317F31E1164A9BDB15CFA4D4A079EB7B2EF89304F208559E905AB350EB71ED42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 026A16A0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 391eee0d6b38ecf04dd3609c4d87bb7078b434e1a67bf474b0c4e61133a06fe2
Instruction ID: 61b1734a9e10240dc73bea1b4965f0b670d2caf4d54a185d3ce94fd2e9f2b8b2
Opcode Fuzzy Hash: 391eee0d6b38ecf04dd3609c4d87bb7078b434e1a67bf474b0c4e61133a06fe2
Instruction Fuzzy Hash: 7121D3346042419FDB12EB7CE8A47693B66EB47344F14A9E9E00ACB356EB78DC418F91

Uniqueness

Uniqueness Score: -1.00%

Function 026A9150 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9146e3077ac73a97a4f067538170b513c80fe6dffbe2393308e1d5ef8bfabd60
Instruction ID: 2a70bfbe3c9efb933be89bc7fd72719980a81730dcd32c03f85500951c6c8bce
Opcode Fuzzy Hash: 9146e3077ac73a97a4f067538170b513c80fe6dffbe2393308e1d5ef8bfabd60
Instruction Fuzzy Hash: 4221E534E012558BDB18CFA4D864ADEB7B2AF89310F20856AE812FB351DB71EC42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 026A9260 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40a0e4085819aa4e34f6bac775e1496f526c63a7d3678bf8d3935b81dcae9ac1
Instruction ID: cbd8fe5947646e168ba3e7c565a3f3c95971fa9d6000494e1205508ee42fa9e9
Opcode Fuzzy Hash: 40a0e4085819aa4e34f6bac775e1496f526c63a7d3678bf8d3935b81dcae9ac1
Instruction Fuzzy Hash: 7B215E30E1160A9BDB05DFA4D59079EF7B2FF89304F20C559E905AB340DB71AC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 026A4F88 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8556e175f6ac4aa84761e0e0a7fea21032c399ead5b631bbef76a9f023f0f60d
Instruction ID: 7170a72bfbdabeb0261bdc144c29356bd8c06b727d9576c68e9df05b75ceff41
Opcode Fuzzy Hash: 8556e175f6ac4aa84761e0e0a7fea21032c399ead5b631bbef76a9f023f0f60d
Instruction Fuzzy Hash: D4214A346002858FDB14DF78C969BAD77F1AF89305B2004A8E406EB3A5DB769D41CF95

Uniqueness

Uniqueness Score: -1.00%

Function 026A1380 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb1b49602d1efec09f508e4af072854cb82e5f7c6a96246639c93c0dce9f41e8
Instruction ID: 5b3000af09a192134dea9583c7a315f33615c583892c94b3b5bbda3b30b1f3fe
Opcode Fuzzy Hash: fb1b49602d1efec09f508e4af072854cb82e5f7c6a96246639c93c0dce9f41e8
Instruction Fuzzy Hash: 66217230A003408BEF256B3CE4B476D7766EB47315F1448EAE60ECB391DB798C858B52

Uniqueness

Uniqueness Score: -1.00%

Function 00C4D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4568388040.0000000000C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c4d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1a34a45753927dcecc9ae1500960046f132901fff30fd5fd026255b38d1e36e
Instruction ID: a1da6415b2d53112380ad7ce527e2cd484522b032fa357cc3f65026821305fd1
Opcode Fuzzy Hash: b1a34a45753927dcecc9ae1500960046f132901fff30fd5fd026255b38d1e36e
Instruction Fuzzy Hash: AE21F371604344EFDB14EF24D9C0B26BBA5FB84314F34C56DE90A4B296C37AD847CA62

Uniqueness

Uniqueness Score: -1.00%

Function 026A187B Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7e82ec93b7be511fa5ef01ef4ac705f2c367b88e746a31f49a1e2e7556cb703
Instruction ID: 9179efb64fac38dfd104a99e65e056f5675ce934a10d9eacca5910b242003e11
Opcode Fuzzy Hash: b7e82ec93b7be511fa5ef01ef4ac705f2c367b88e746a31f49a1e2e7556cb703
Instruction Fuzzy Hash: 66213930B042458FDB14EB68C5647AD77B6BF8A205F2004A8C50AEB3A4DB369D41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C4D005 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4568388040.0000000000C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c4d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d303037e55060fe6b24b2460177e3bce786360d5cdcb4c752f989753fcf1bb3
Instruction ID: 01a8cb73c758e079764bf6316f75de7036308d8b2f667fb4bb847611653a5d86
Opcode Fuzzy Hash: 7d303037e55060fe6b24b2460177e3bce786360d5cdcb4c752f989753fcf1bb3
Instruction Fuzzy Hash: 9C21487150D3C09FCB03DF24D990711BF71AB46214F2985EBD8898F2A7C27A981ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 026A9160 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 890289be1182a7f6cd10e326243d8cce371ed211c79cc48261c90dc760898380
Instruction ID: a1b36e4d14bb1070e443d32c37cceba90146c8877c72aa5e69986215fdb71857
Opcode Fuzzy Hash: 890289be1182a7f6cd10e326243d8cce371ed211c79cc48261c90dc760898380
Instruction Fuzzy Hash: D7215334E1121A9BDB18CFA4D85469EB7B2AF89310F20851AE815FB340DB71ED46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 026A1888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0c8f37dcf18d7e9f7c560b8d412309818813bfb245284f929bdf031113692fc
Instruction ID: 86f2969d1aa64d430ceb662048353d4043eb458aa4fb5d3c0b1ec963c31c1d4d
Opcode Fuzzy Hash: b0c8f37dcf18d7e9f7c560b8d412309818813bfb245284f929bdf031113692fc
Instruction Fuzzy Hash: D121FA34B00249CFDB54EB68C5647AE77F6AB8A205F2004A8D50AEB3A4DF759D41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 026A16B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b92f9e19c725246a1631ac6017e8a147c47c1b08b0fe855551647065c1f5a1c4
Instruction ID: db11d1f041fd80c5b9045f695a9041e2d418d23b1661dab0602835f49eaaf5c2
Opcode Fuzzy Hash: b92f9e19c725246a1631ac6017e8a147c47c1b08b0fe855551647065c1f5a1c4
Instruction Fuzzy Hash: 8921A5386002019BDF12FF38F8A47593766EB46344F1069A5E10ACB355EB78DC41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 026A4F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb0c2fd5d295ff47efaf963209e249db5cdea2324912b8dce982f21fce68092f
Instruction ID: 37de9afe43d182b004d4c818959b190dd931274ef36ced76d96ce5142698d82f
Opcode Fuzzy Hash: cb0c2fd5d295ff47efaf963209e249db5cdea2324912b8dce982f21fce68092f
Instruction Fuzzy Hash: 1F211634A00244CFDB54EF78C969BAD77F2AF89705B2004A8E406EB3A5DB769D41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 026A80F1 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21f7189df22a4c573a209b9d4eb00061d6658ccc0dfbd174d261d5afcc8a0fbe
Instruction ID: b17fdb859ce447eccb12190b6b407e85c31e3bc822d4d7fb1046067cb1b0a15d
Opcode Fuzzy Hash: 21f7189df22a4c573a209b9d4eb00061d6658ccc0dfbd174d261d5afcc8a0fbe
Instruction Fuzzy Hash: 8311B13060024ADBEB01FBB8F89179DBBB1EB85305F0046F9D545DB255EB35AE069B81

Uniqueness

Uniqueness Score: -1.00%

Function 026A0838 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e409907c1d72504d8cb5f53da3c18fbd114fa17eb9cc97817541be1e4a5dac87
Instruction ID: f710e0948923e98d98d80d6906f355f706cb5c475e6c77205014abb729d11870
Opcode Fuzzy Hash: e409907c1d72504d8cb5f53da3c18fbd114fa17eb9cc97817541be1e4a5dac87
Instruction Fuzzy Hash: 3811A330B052144BEF25AA78D87076A3765EB83394F10487AD002CF382DB65DC4A8FDA

Uniqueness

Uniqueness Score: -1.00%

Function 026A0848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1ec20aa337ada042ee6f34ffd40875f81bc314311d5935b392e6c0885a6cb8e
Instruction ID: 68e1e786733463294514e60f4a600f91f117da9f711b99f4e7050a1eb9a6cb54
Opcode Fuzzy Hash: c1ec20aa337ada042ee6f34ffd40875f81bc314311d5935b392e6c0885a6cb8e
Instruction Fuzzy Hash: FE11A030B002098BEF24AA78D8A076A33A5EB86394F20483AD006CF345DB65DC868FD5

Uniqueness

Uniqueness Score: -1.00%

Function 026A148B Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3157ef109e4acde7e8f4d48789d84efac0dd3ec1e93e3ced59f1803c08e65498
Instruction ID: 71d357c52ab023dc0047bbc8559449576356258d35428bedfae191628557d365
Opcode Fuzzy Hash: 3157ef109e4acde7e8f4d48789d84efac0dd3ec1e93e3ced59f1803c08e65498
Instruction Fuzzy Hash: 90117331A002549FCB21AFB884703AEBBF5EF8A220F2444B9D809E7301D731CD428F95

Uniqueness

Uniqueness Score: -1.00%

Function 026A1498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec4b6aca9a93938f3adc664da214069743a37d3d3641fffc00b446ba02de46a7
Instruction ID: fe6be63f00e42526136d04a95cad6164c103a76372c53ae642f279f7027adb2e
Opcode Fuzzy Hash: ec4b6aca9a93938f3adc664da214069743a37d3d3641fffc00b446ba02de46a7
Instruction Fuzzy Hash: B6010071A012159FDB25EFB984602AEBBF6EF49260F2404BAD809E7301E735DD418FE5

Uniqueness

Uniqueness Score: -1.00%

Function 026A7090 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a7815e9d87591c41f4b5e3281a361e4655ed5044ed4c0822d0b4249feeafbd2
Instruction ID: a32cf4882055fb4ea8ca908a502534c277a355966c78c97797ff4d97ff557d01
Opcode Fuzzy Hash: 7a7815e9d87591c41f4b5e3281a361e4655ed5044ed4c0822d0b4249feeafbd2
Instruction Fuzzy Hash: A1F0E739B40248CFD714DB64D5A8BAD77B2EF88715F1144A8E6069B3A4CB35AD42CF40

Uniqueness

Uniqueness Score: -1.00%

Function 026A8100 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cca3fd618d00a65b74606e5d792e08515ded8f379d26da9318ba06e24a9cf221
Instruction ID: 009ffc14d8b745a1d1b6e84b9da63da819794e04093bc4a0e59cbe6c0d5081f9
Opcode Fuzzy Hash: cca3fd618d00a65b74606e5d792e08515ded8f379d26da9318ba06e24a9cf221
Instruction Fuzzy Hash: 34F03C30A0024AEFDB05FFB8F89169D7BB1EB84340F1056F8C5049B254EE716F059B91

Uniqueness

Uniqueness Score: -1.00%

Function 026A6C0C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4570167619.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e4a71e02c8665e520d0af94c7f2da29280365ea5cd44086bf69edb55d6a6f3c
Instruction ID: d573a2ee2f6563ad2a8de293698812f01f1bfc73a1b9233e3cad2663ce7f3124
Opcode Fuzzy Hash: 2e4a71e02c8665e520d0af94c7f2da29280365ea5cd44086bf69edb55d6a6f3c
Instruction Fuzzy Hash: C1C002363540544FC5059768E06447977B5DBCA56935401DAD159CB761CE159C029F44

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RFQ#1047.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Networking

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RFQ#1047.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
RFQ#1047.exe

Function 06CC0A98 Relevance: 3.1, Strings: 2, Instructions: 564
COMMON

Function 009FD108 Relevance: 6.1, APIs: 4, Instructions: 135
threadCOMMON

Function 009FD118 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 06CCF1B0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 009FAE90 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Function 009F590C Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Function 009F449C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 009FD421 Relevance: 1.6, APIs: 1, Instructions: 87
COMMON

Function 06CCEF28 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 009FD358 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 06CCF018 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 06CCE958 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Function 009FD360 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 009FA8D0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 06CCEE68 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre