Edit tour

Windows Analysis Report
Quote.exe

Overview

General Information

Sample name:	Quote.exe
Analysis ID:	1427944
MD5:	4bde497149d69bd21bce08c8dd20cbe6
SHA1:	51b7b2a217a8ee771ba08cddb9afc94c9d57ddbb
SHA256:	646da2f80123a9ae67c58d474c19609900b5816941164677dc24238316b512e9
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

.NET source code contains very large strings

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Quote.exe (PID: 6904 cmdline: "C:\Users\user\Desktop\Quote.exe" MD5: 4BDE497149D69BD21BCE08C8DD20CBE6)

Quote.exe (PID: 3484 cmdline: "C:\Users\user\Desktop\Quote.exe" MD5: 4BDE497149D69BD21BCE08C8DD20CBE6)

Quote.exe (PID: 6208 cmdline: "C:\Users\user\Desktop\Quote.exe" MD5: 4BDE497149D69BD21BCE08C8DD20CBE6)

MpCmdRun.exe (PID: 3484 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 6936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "us2.smtp.mailhostbox.com", "Username": "kk@framsanjuen.com", "Password": "fzesv)c2"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2878079925.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2878079925.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.2880214725.0000000002EEE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1692358614.0000000003B99000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1692358614.0000000003B99000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.2880214725.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2880214725.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1692358614.00000000045F5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1692358614.00000000045F5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Quote.exe PID: 6904	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Quote.exe PID: 6904	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Quote.exe PID: 6904	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Quote.exe PID: 6208	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Quote.exe PID: 6208	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.Quote.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.Quote.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.Quote.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33e27:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33e99:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33f23:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33fb5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3401f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34091:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34127:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x341b7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Quote.exe.3bd9dc8.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Quote.exe.3bd9dc8.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Quote.exe.3bd9dc8.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32027:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32099:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32123:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x321b5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3221f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32291:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32327:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x323b7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Quote.exe.3bd9dc8.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Quote.exe.3bd9dc8.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Quote.exe.3bd9dc8.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33e27:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33e99:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33f23:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33fb5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3401f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34091:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34127:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x341b7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Quote.exe.488f1a8.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Quote.exe.488f1a8.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Quote.exe.488f1a8.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Quote.exe.488f1a8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x174a67:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1afc87:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x174ad9:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1afcf9:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x174b63:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1afd83:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x174bf5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1afe15:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x174c5f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1afe7f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x174cd1:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1afef1:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x174d67:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1aff87:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x174df7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x1b0017:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 208.91.198.143, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\Quote.exe, Initiated: true, ProcessId: 6208, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.Quote.exe.3bd9dc8.1.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "us2.smtp.mailhostbox.com", "Username": "kk@framsanjuen.com", "Password": "fzesv)c2"}

Multi AV Scanner detection for submitted file

Source: Quote.exe	Virustotal: Detection: 37%			Perma Link
Source: Quote.exe	ReversingLabs: Detection: 34%

Machine Learning detection for sample

Source: Quote.exe

Joe Sandbox ML: detected

Source: Quote.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Quote.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: xLZii.pdb source: Quote.exe
Source:	Binary string: xLZii.pdbSHA256 source: Quote.exe

Source: C:\Users\user\Desktop\Quote.exe	Code function: 4x nop then jmp 04B90F35h	0_2_04B9048D
Source: C:\Users\user\Desktop\Quote.exe	Code function: 4x nop then jmp 04B90F35h	0_2_04B903E8
Source: C:\Users\user\Desktop\Quote.exe	Code function: 4x nop then jmp 04B90F35h	0_2_04B90469
Source: C:\Users\user\Desktop\Quote.exe	Code function: 4x nop then jmp 04B90F35h	0_2_04B9061A
Source: C:\Users\user\Desktop\Quote.exe	Code function: 4x nop then jmp 04B90F35h	0_2_04B909FA

Networking

Yara detected Generic Downloader

Source: Yara match

File source: 0.2.Quote.exe.488f1a8.0.raw.unpack, type: UNPACKEDPE

Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 208.91.199.223:587
Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 208.91.199.225:587
Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 208.91.199.224:587

Source: Joe Sandbox View	IP Address: 208.91.198.143 208.91.198.143
Source: Joe Sandbox View	IP Address: 208.91.199.225 208.91.199.225
Source: Joe Sandbox View	IP Address: 208.91.199.223 208.91.199.223
Source: Joe Sandbox View	IP Address: 208.91.199.224 208.91.199.224

Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 208.91.199.223:587
Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 208.91.199.225:587
Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 208.91.199.224:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: us2.smtp.mailhostbox.com

Source: Quote.exe	String found in binary or memory: http://tempuri.org/DataSet1.xsd)Microsoft
Source: Quote.exe, 00000002.00000002.2880214725.0000000002EF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: Quote.exe, 00000000.00000002.1692358614.0000000003B99000.00000004.00000800.00020000.00000000.sdmp, Quote.exe, 00000000.00000002.1692358614.00000000045F5000.00000004.00000800.00020000.00000000.sdmp, Quote.exe, 00000002.00000002.2878079925.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Quote.exe.3bd9dc8.1.raw.unpack, cPKWk.cs

.Net Code: Bt4Hz

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.Quote.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Quote.exe.3bd9dc8.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Quote.exe.3bd9dc8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

.NET source code contains very large array initializations

Source: 0.2.Quote.exe.5770000.2.raw.unpack, LoginForm.cs

Large array initialization: : array initializer size 33603

.NET source code contains very large strings

Source: Quote.exe, Form1.cs

Long String: Length: 131612

Source: C:\Users\user\Desktop\Quote.exe	Code function: 0_2_0122D59C	0_2_0122D59C
Source: C:\Users\user\Desktop\Quote.exe	Code function: 0_2_04B902D0	0_2_04B902D0
Source: C:\Users\user\Desktop\Quote.exe	Code function: 0_2_04B93148	0_2_04B93148
Source: C:\Users\user\Desktop\Quote.exe	Code function: 0_2_04B902C1	0_2_04B902C1
Source: C:\Users\user\Desktop\Quote.exe	Code function: 0_2_085BC818	0_2_085BC818
Source: C:\Users\user\Desktop\Quote.exe	Code function: 0_2_085BE890	0_2_085BE890
Source: C:\Users\user\Desktop\Quote.exe	Code function: 0_2_085BE8A0	0_2_085BE8A0
Source: C:\Users\user\Desktop\Quote.exe	Code function: 0_2_085BDAB8	0_2_085BDAB8
Source: C:\Users\user\Desktop\Quote.exe	Code function: 0_2_085B3B70	0_2_085B3B70
Source: C:\Users\user\Desktop\Quote.exe	Code function: 0_2_085B3B80	0_2_085B3B80
Source: C:\Users\user\Desktop\Quote.exe	Code function: 0_2_085BDEF0	0_2_085BDEF0
Source: C:\Users\user\Desktop\Quote.exe	Code function: 0_2_085BDEE0	0_2_085BDEE0
Source: C:\Users\user\Desktop\Quote.exe	Code function: 0_2_085BC3C2	0_2_085BC3C2
Source: C:\Users\user\Desktop\Quote.exe	Code function: 0_2_085BC3E0	0_2_085BC3E0
Source: C:\Users\user\Desktop\Quote.exe	Code function: 0_2_085B569F	0_2_085B569F
Source: C:\Users\user\Desktop\Quote.exe	Code function: 0_2_085B56A0	0_2_085B56A0
Source: C:\Users\user\Desktop\Quote.exe	Code function: 2_2_011D4A98	2_2_011D4A98
Source: C:\Users\user\Desktop\Quote.exe	Code function: 2_2_011D9C00	2_2_011D9C00
Source: C:\Users\user\Desktop\Quote.exe	Code function: 2_2_011DCF60	2_2_011DCF60
Source: C:\Users\user\Desktop\Quote.exe	Code function: 2_2_011D3E80	2_2_011D3E80
Source: C:\Users\user\Desktop\Quote.exe	Code function: 2_2_011D41C8	2_2_011D41C8
Source: C:\Users\user\Desktop\Quote.exe	Code function: 2_2_01258840	2_2_01258840
Source: C:\Users\user\Desktop\Quote.exe	Code function: 2_2_0125B360	2_2_0125B360
Source: C:\Users\user\Desktop\Quote.exe	Code function: 2_2_01259AA8	2_2_01259AA8
Source: C:\Users\user\Desktop\Quote.exe	Code function: 2_2_011DD240	2_2_011DD240

Source: Quote.exe, 00000000.00000002.1691749786.0000000002BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec7c7bdcc-01c6-4686-b6a8-e115dc8b943c.exe4 vs Quote.exe
Source: Quote.exe, 00000000.00000000.1629494668.0000000000850000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamexLZii.exeT vs Quote.exe
Source: Quote.exe, 00000000.00000002.1690847319.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Quote.exe
Source: Quote.exe, 00000000.00000002.1692358614.0000000003B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec7c7bdcc-01c6-4686-b6a8-e115dc8b943c.exe4 vs Quote.exe
Source: Quote.exe, 00000000.00000002.1697141984.0000000008AD0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Quote.exe
Source: Quote.exe, 00000000.00000002.1695598593.0000000005770000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs Quote.exe
Source: Quote.exe, 00000000.00000002.1692358614.00000000045F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Quote.exe
Source: Quote.exe, 00000000.00000002.1692358614.00000000045F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec7c7bdcc-01c6-4686-b6a8-e115dc8b943c.exe4 vs Quote.exe
Source: Quote.exe, 00000002.00000002.2878079925.000000000043E000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec7c7bdcc-01c6-4686-b6a8-e115dc8b943c.exe4 vs Quote.exe
Source: Quote.exe, 00000002.00000002.2878320559.0000000000F38000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Quote.exe
Source: Quote.exe	Binary or memory string: OriginalFilenamexLZii.exeT vs Quote.exe

Source: Quote.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.Quote.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Quote.exe.3bd9dc8.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Quote.exe.3bd9dc8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: Quote.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Quote.exe.3bd9dc8.1.raw.unpack, cPs8D.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Quote.exe.3bd9dc8.1.raw.unpack, 72CF8egH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Quote.exe.3bd9dc8.1.raw.unpack, G5CXsdn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Quote.exe.3bd9dc8.1.raw.unpack, 3uPsILA6U.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Quote.exe.3bd9dc8.1.raw.unpack, 6oQOw74dfIt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Quote.exe.3bd9dc8.1.raw.unpack, aMIWm.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.Quote.exe.3bd9dc8.1.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Quote.exe.3bd9dc8.1.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, dusU9FUqOeCN2dcgfT.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, dusU9FUqOeCN2dcgfT.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, dusU9FUqOeCN2dcgfT.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, dusU9FUqOeCN2dcgfT.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, dusU9FUqOeCN2dcgfT.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, dusU9FUqOeCN2dcgfT.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, aJKD1lJZ1eWhKJQBCo.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, aJKD1lJZ1eWhKJQBCo.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@1/4

Source: C:\Users\user\Desktop\Quote.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Quote.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Quote.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6936:120:WilError_03

Source: Quote.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Quote.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Quote.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Quote.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Quote.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Quote.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Quote.exe	Virustotal: Detection: 37%
Source: Quote.exe	ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\Quote.exe "C:\Users\user\Desktop\Quote.exe"
Source: C:\Users\user\Desktop\Quote.exe	Process created: C:\Users\user\Desktop\Quote.exe "C:\Users\user\Desktop\Quote.exe"
Source: C:\Users\user\Desktop\Quote.exe	Process created: C:\Users\user\Desktop\Quote.exe "C:\Users\user\Desktop\Quote.exe"
Source: C:\Users\user\Desktop\Quote.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Quote.exe	Process created: C:\Users\user\Desktop\Quote.exe "C:\Users\user\Desktop\Quote.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process created: C:\Users\user\Desktop\Quote.exe "C:\Users\user\Desktop\Quote.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Quote.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll	Jump to behavior

Source: C:\Users\user\Desktop\Quote.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Quote.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Quote.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Quote.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Quote.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Quote.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: xLZii.pdb source: Quote.exe
Source:	Binary string: xLZii.pdbSHA256 source: Quote.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, dusU9FUqOeCN2dcgfT.cs	.Net Code: W6WelnT8sP System.Reflection.Assembly.Load(byte[])
Source: 0.2.Quote.exe.5770000.2.raw.unpack, .cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, dusU9FUqOeCN2dcgfT.cs	.Net Code: W6WelnT8sP System.Reflection.Assembly.Load(byte[])

Source: Quote.exe

Static PE information: 0xF430D9AD [Wed Oct 28 03:42:37 2099 UTC]

Source: Quote.exe

Static PE information: section name: .text entropy: 7.284313720335351

Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, oDqPgchOEduOpRGb6x.cs	High entropy of concatenated method names: 'NlDQR62Khn', 'NU4QHw8Sxl', 'GrCQu50egf', 'kMVQPQZcgN', 'WQsQSl7WH8', 'vyHQZK3Fxy', 'osdQKpmx0h', 'YbEQD7qS29', 'T0jQwI8No4', 'LVQQvMI7Aw'
Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, jY9IDVrxbISJ2mFqDNl.cs	High entropy of concatenated method names: 'hMgB3Yf2IH', 'k7yBmKPwyS', 's97BlMxKmE', 'IeaBUV0392', 'YisBMI729X', 'nEeBGNTxrK', 'kqEBjCa2ZG', 'wnbBRVlihN', 'BCjBH547Jf', 'hTVBJcq5Tx'
Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, rZ0tUc6sjYil5041q9.cs	High entropy of concatenated method names: 'EVxpumH4Bd', 'YiWpPeB0v2', 'hYppoOExyq', 'bS0pSthX0u', 'LdcpkXZjDO', 'u9apZyAvwp', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, DZPMNMTl2XCOTCDo0x.cs	High entropy of concatenated method names: 'lXgBrknEWt', 'JCZBO2yu3W', 'rAaBeagpag', 'OnGBNeDqe9', 'uGHByutIJc', 'VNaB6RGy5E', 'K5RBIWCcUQ', 'OgRp4lDAmF', 'DXopXw6v1Q', 'adqp7JhPeN'
Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, hHLfLFfChJJ2nfmChT.cs	High entropy of concatenated method names: 'Dwi6MWNEIS', 'y0e6jVSbkT', 'FxugoZDQhf', 'sjDgSZTMge', 'gmogZYokua', 'unagTYGu5D', 'tGPgKpx9LI', 'IXogDLN2Lb', 'mnPgs542FR', 'ejrgwo6x3t'
Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, wqv2JArNmuicgUdZpdH.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'wLh5kqgbeu', 'q0C51U9iym', 'S9b5cA0reo', 'nsi52xnjhI', 'ecM5C74IO3', 'Wvx5FeyaDR', 'TQG540YmAg'
Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, NZJObT0WPWtn1QcQkv.cs	High entropy of concatenated method names: 'ayQAN6R2EU', 'RZRAgGCfIS', 'jdZAIbk6MW', 'jhkIqlxh3u', 'xwxIzWuerJ', 'OBnAx3fNZX', 'iLjArlXhuu', 't64Af5KbiO', 'MojAOY4MkJ', 'WY6AeWVco0'
Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, aJKD1lJZ1eWhKJQBCo.cs	High entropy of concatenated method names: 'zThyk30M0p', 'sfOy1J6YA0', 'i9Vycj4fOU', 'KW4y2DQpcn', 'GLuyCxAkN8', 'UbsyFONBaU', 'a0By451odL', 'HqfyXSeHPo', 'bOYy75FR1j', 'amQyqyaqc5'
Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, qjeHK2rgkyFMKQhGq7i.cs	High entropy of concatenated method names: 'j7K53ar1Sy', 'RXN5mGVjAE', 'WLx5lpJVt3', 'yr0bESBbwCcatAWJpA9', 'L1oMs3BhUWvnxMdJGh3', 'WvqMQhBUp2jnv2xXBUF', 'ODBGu8BI4CyHQZufwOB'
Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, dusU9FUqOeCN2dcgfT.cs	High entropy of concatenated method names: 'zGROVyAV3k', 'bqlONxxEHd', 'm4MOyCKQIX', 'rPsOgHxvWk', 'mt6O64GPlY', 'BxBOIHg79v', 'YU2OAwCHqV', 'yB3O03sB6c', 'vNrOassll8', 'DiJO82C8dO'
Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, Tn5BvgzgtSP3IMfIZc.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'tyNBQAlDo9', 'mLxBELwPOD', 'PRNB93nSS9', 'aaHBtKEFpY', 'FP6Bp9ASKv', 'YdEBBfVmxx', 'ugIB52Z5Dk'
Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, b49EfBjmB3RWT14Akn.cs	High entropy of concatenated method names: 'rKxIVJo245', 'xjkIyHPhod', 'QbfI67gK8C', 'V9VIAneqPt', 'pNsI0AqZS9', 'Y9R6CbXiOH', 'gtV6FcDYTW', 'LLw64wJ4M8', 'jYt6XPPYJV', 'qAy67q9Sfo'
Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, bmMe2wtHomAOKIdiDJ.cs	High entropy of concatenated method names: 'CPEtXKI5UH', 'iW2tq23QT6', 'y3OpxSuhQc', 'Q8dprmNhLI', 'TlCtv6idTX', 'XZltbpjMeq', 'S6Mtd04ykZ', 'TaotklGfkH', 'khvt1Ujqdd', 'BTMtcIfBeS'
Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, qdu2VxKAfRMv4iq68B.cs	High entropy of concatenated method names: 'bjaA3Je16w', 'pnVAmeZalA', 'a6SAlJjDm7', 'oSQAU5gkME', 'ykdAMZTK0P', 'YEaAGoIQtP', 'VGTAjj1Lfo', 'UbNAREltWf', 'TwBAHSPrLk', 'O8AAJuQxqV'
Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, Rg9BeoBmU3Bm6DRvlj.cs	High entropy of concatenated method names: 'ToString', 'LB19v6w5Df', 'cIt9PK6OBv', 'W7X9obA5vG', 'AxG9SsNUaS', 'jhC9Zu5K8h', 'vUX9TKZANJ', 'NQK9KV5rlO', 'ncW9DIdgQT', 'd4n9sWK0xy'
Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, YpD5iVpvFqL5T9qYP6.cs	High entropy of concatenated method names: 'Q4xrAT4Ue3', 'cNar0pGGFW', 'sylr8A9tQe', 'Q8Trh9TP3a', 'JwErEE1h0f', 'YUmr9hO6rx', 'exHXi405QpD6vhjnYY', 'hTmeHFNYxwn88o1sL4', 'kjxrrleakW', 'pMerO5Hgoh'
Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, mnc9nCeFT7NTLh5jGQ.cs	High entropy of concatenated method names: 'UF4t8ZSiWw', 'TGBthBcouE', 'ToString', 'fPItNFv1DR', 'LwatyTxJuD', 'CQAtgSrgsJ', 'Rr3t6qeKAu', 'r7HtIyckfF', 'ETRtAJwyGk', 'b9tt0535cR'
Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, p1Q13Ryq2DmEfQtp5p.cs	High entropy of concatenated method names: 'Dispose', 'O5wr7nKonG', 'mdOfPQR6eG', 'w3Riic6Af2', 'wmarqGJoXc', 'GxQrzC4afJ', 'ProcessDialogKey', 'YsBfxxj0gX', 'kBLfr5BFWj', 'BPXffOUtbV'
Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, zK3tQ8CNp39aAk0UGC.cs	High entropy of concatenated method names: 'l5CpNZcRIT', 'pimpyShJ8L', 'BTbpg21JQd', 'DJFp6nsFUx', 'tskpILswFk', 'YmtpAHR2I8', 'z9Ap0xiQtu', 'CA6paCpZvm', 'hvlp8VpVtZ', 'jDephr1XmP'
Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, Ea9OQpRKEUYYgGC1Kk.cs	High entropy of concatenated method names: 'x40gULYrVV', 'msogGVFA9e', 'okMgRE3FAe', 's5HgHZBBEj', 'zeHgEiBZcm', 'QZNg9cDfPu', 'NOIgtgKWIE', 'Pkvgp2Kile', 'AFlgBHjSVm', 'kDEg50iUyT'
Source: 0.2.Quote.exe.8ad0000.5.raw.unpack, OU0diqgdjVN0wlEQO2.cs	High entropy of concatenated method names: 'DsololCaL', 'KjHUe6NQA', 'WtRGbdHY6', 'thljApXX7', 'dpsHOMock', 'Jc2JtQmw6', 'aGdKOyjfQ4vvLFn4go', 'zjtMvyA5MKL8ZNPm2P', 'iBdpBlYuL', 'W5n5Rk8C9'
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, oDqPgchOEduOpRGb6x.cs	High entropy of concatenated method names: 'NlDQR62Khn', 'NU4QHw8Sxl', 'GrCQu50egf', 'kMVQPQZcgN', 'WQsQSl7WH8', 'vyHQZK3Fxy', 'osdQKpmx0h', 'YbEQD7qS29', 'T0jQwI8No4', 'LVQQvMI7Aw'
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, jY9IDVrxbISJ2mFqDNl.cs	High entropy of concatenated method names: 'hMgB3Yf2IH', 'k7yBmKPwyS', 's97BlMxKmE', 'IeaBUV0392', 'YisBMI729X', 'nEeBGNTxrK', 'kqEBjCa2ZG', 'wnbBRVlihN', 'BCjBH547Jf', 'hTVBJcq5Tx'
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, rZ0tUc6sjYil5041q9.cs	High entropy of concatenated method names: 'EVxpumH4Bd', 'YiWpPeB0v2', 'hYppoOExyq', 'bS0pSthX0u', 'LdcpkXZjDO', 'u9apZyAvwp', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, DZPMNMTl2XCOTCDo0x.cs	High entropy of concatenated method names: 'lXgBrknEWt', 'JCZBO2yu3W', 'rAaBeagpag', 'OnGBNeDqe9', 'uGHByutIJc', 'VNaB6RGy5E', 'K5RBIWCcUQ', 'OgRp4lDAmF', 'DXopXw6v1Q', 'adqp7JhPeN'
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, hHLfLFfChJJ2nfmChT.cs	High entropy of concatenated method names: 'Dwi6MWNEIS', 'y0e6jVSbkT', 'FxugoZDQhf', 'sjDgSZTMge', 'gmogZYokua', 'unagTYGu5D', 'tGPgKpx9LI', 'IXogDLN2Lb', 'mnPgs542FR', 'ejrgwo6x3t'
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, wqv2JArNmuicgUdZpdH.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'wLh5kqgbeu', 'q0C51U9iym', 'S9b5cA0reo', 'nsi52xnjhI', 'ecM5C74IO3', 'Wvx5FeyaDR', 'TQG540YmAg'
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, NZJObT0WPWtn1QcQkv.cs	High entropy of concatenated method names: 'ayQAN6R2EU', 'RZRAgGCfIS', 'jdZAIbk6MW', 'jhkIqlxh3u', 'xwxIzWuerJ', 'OBnAx3fNZX', 'iLjArlXhuu', 't64Af5KbiO', 'MojAOY4MkJ', 'WY6AeWVco0'
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, aJKD1lJZ1eWhKJQBCo.cs	High entropy of concatenated method names: 'zThyk30M0p', 'sfOy1J6YA0', 'i9Vycj4fOU', 'KW4y2DQpcn', 'GLuyCxAkN8', 'UbsyFONBaU', 'a0By451odL', 'HqfyXSeHPo', 'bOYy75FR1j', 'amQyqyaqc5'
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, qjeHK2rgkyFMKQhGq7i.cs	High entropy of concatenated method names: 'j7K53ar1Sy', 'RXN5mGVjAE', 'WLx5lpJVt3', 'yr0bESBbwCcatAWJpA9', 'L1oMs3BhUWvnxMdJGh3', 'WvqMQhBUp2jnv2xXBUF', 'ODBGu8BI4CyHQZufwOB'
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, dusU9FUqOeCN2dcgfT.cs	High entropy of concatenated method names: 'zGROVyAV3k', 'bqlONxxEHd', 'm4MOyCKQIX', 'rPsOgHxvWk', 'mt6O64GPlY', 'BxBOIHg79v', 'YU2OAwCHqV', 'yB3O03sB6c', 'vNrOassll8', 'DiJO82C8dO'
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, Tn5BvgzgtSP3IMfIZc.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'tyNBQAlDo9', 'mLxBELwPOD', 'PRNB93nSS9', 'aaHBtKEFpY', 'FP6Bp9ASKv', 'YdEBBfVmxx', 'ugIB52Z5Dk'
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, b49EfBjmB3RWT14Akn.cs	High entropy of concatenated method names: 'rKxIVJo245', 'xjkIyHPhod', 'QbfI67gK8C', 'V9VIAneqPt', 'pNsI0AqZS9', 'Y9R6CbXiOH', 'gtV6FcDYTW', 'LLw64wJ4M8', 'jYt6XPPYJV', 'qAy67q9Sfo'
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, bmMe2wtHomAOKIdiDJ.cs	High entropy of concatenated method names: 'CPEtXKI5UH', 'iW2tq23QT6', 'y3OpxSuhQc', 'Q8dprmNhLI', 'TlCtv6idTX', 'XZltbpjMeq', 'S6Mtd04ykZ', 'TaotklGfkH', 'khvt1Ujqdd', 'BTMtcIfBeS'
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, qdu2VxKAfRMv4iq68B.cs	High entropy of concatenated method names: 'bjaA3Je16w', 'pnVAmeZalA', 'a6SAlJjDm7', 'oSQAU5gkME', 'ykdAMZTK0P', 'YEaAGoIQtP', 'VGTAjj1Lfo', 'UbNAREltWf', 'TwBAHSPrLk', 'O8AAJuQxqV'
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, Rg9BeoBmU3Bm6DRvlj.cs	High entropy of concatenated method names: 'ToString', 'LB19v6w5Df', 'cIt9PK6OBv', 'W7X9obA5vG', 'AxG9SsNUaS', 'jhC9Zu5K8h', 'vUX9TKZANJ', 'NQK9KV5rlO', 'ncW9DIdgQT', 'd4n9sWK0xy'
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, YpD5iVpvFqL5T9qYP6.cs	High entropy of concatenated method names: 'Q4xrAT4Ue3', 'cNar0pGGFW', 'sylr8A9tQe', 'Q8Trh9TP3a', 'JwErEE1h0f', 'YUmr9hO6rx', 'exHXi405QpD6vhjnYY', 'hTmeHFNYxwn88o1sL4', 'kjxrrleakW', 'pMerO5Hgoh'
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, mnc9nCeFT7NTLh5jGQ.cs	High entropy of concatenated method names: 'UF4t8ZSiWw', 'TGBthBcouE', 'ToString', 'fPItNFv1DR', 'LwatyTxJuD', 'CQAtgSrgsJ', 'Rr3t6qeKAu', 'r7HtIyckfF', 'ETRtAJwyGk', 'b9tt0535cR'
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, p1Q13Ryq2DmEfQtp5p.cs	High entropy of concatenated method names: 'Dispose', 'O5wr7nKonG', 'mdOfPQR6eG', 'w3Riic6Af2', 'wmarqGJoXc', 'GxQrzC4afJ', 'ProcessDialogKey', 'YsBfxxj0gX', 'kBLfr5BFWj', 'BPXffOUtbV'
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, zK3tQ8CNp39aAk0UGC.cs	High entropy of concatenated method names: 'l5CpNZcRIT', 'pimpyShJ8L', 'BTbpg21JQd', 'DJFp6nsFUx', 'tskpILswFk', 'YmtpAHR2I8', 'z9Ap0xiQtu', 'CA6paCpZvm', 'hvlp8VpVtZ', 'jDephr1XmP'
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, Ea9OQpRKEUYYgGC1Kk.cs	High entropy of concatenated method names: 'x40gULYrVV', 'msogGVFA9e', 'okMgRE3FAe', 's5HgHZBBEj', 'zeHgEiBZcm', 'QZNg9cDfPu', 'NOIgtgKWIE', 'Pkvgp2Kile', 'AFlgBHjSVm', 'kDEg50iUyT'
Source: 0.2.Quote.exe.488f1a8.0.raw.unpack, OU0diqgdjVN0wlEQO2.cs	High entropy of concatenated method names: 'DsololCaL', 'KjHUe6NQA', 'WtRGbdHY6', 'thljApXX7', 'dpsHOMock', 'Jc2JtQmw6', 'aGdKOyjfQ4vvLFn4go', 'zjtMvyA5MKL8ZNPm2P', 'iBdpBlYuL', 'W5n5Rk8C9'

Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Quote.exe PID: 6904, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Quote.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\Quote.exe	Memory allocated: 11C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Memory allocated: 2B90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Memory allocated: 4B90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Memory allocated: 61F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Memory allocated: 71F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Memory allocated: 7330000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Memory allocated: 8330000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Memory allocated: 8B80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Memory allocated: 9B80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Memory allocated: AB80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Memory allocated: BB80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Memory allocated: 11D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Memory allocated: 2EA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Memory allocated: 2D20000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\Quote.exe	Window / User API: threadDelayed 698			Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Window / User API: threadDelayed 9163			Jump to behavior

Source: C:\Users\user\Desktop\Quote.exe TID: 6960	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -30437127721620741s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7092	Thread sleep count: 698 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -99874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7092	Thread sleep count: 9163 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -99546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -99326s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -99217s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -99109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -99000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -98890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -98781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -98671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -98562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -98453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -98343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -98234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -98124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -98015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -97906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -97796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -97687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -97578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -97468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -97359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -97250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -97140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -97031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -96921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -96812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -96703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -96582s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -96453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -96343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -96234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -96125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -96015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -95894s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -95765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -95656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -95546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -95437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -95328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -95207s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -95078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -94968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -94859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -94750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -94640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe TID: 7088	Thread sleep time: -94531s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Quote.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Quote.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Quote.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 99874	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 99546	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 99326	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 99217	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 98671	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 98562	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 98453	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 98343	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 98234	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 98124	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 98015	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 97906	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 97796	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 97578	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 97468	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 97359	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 97250	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 97140	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 97031	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 96921	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 96812	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 96703	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 96582	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 96453	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 96343	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 96234	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 96125	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 96015	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 95894	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 95765	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 95656	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 95546	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 95437	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 95328	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 95207	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 95078	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 94968	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 94859	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 94750	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 94640	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Thread delayed: delay time: 94531	Jump to behavior

Source: Quote.exe, 00000002.00000002.2879179529.000000000139B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllm

Source: C:\Users\user\Desktop\Quote.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Quote.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Quote.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Quote.exe

Memory written: C:\Users\user\Desktop\Quote.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Quote.exe	Process created: C:\Users\user\Desktop\Quote.exe "C:\Users\user\Desktop\Quote.exe"			Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Process created: C:\Users\user\Desktop\Quote.exe "C:\Users\user\Desktop\Quote.exe"			Jump to behavior

Source: C:\Users\user\Desktop\Quote.exe	Queries volume information: C:\Users\user\Desktop\Quote.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Queries volume information: C:\Users\user\Desktop\Quote.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Quote.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\Quote.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Users\user\Desktop\Quote.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 2.2.Quote.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quote.exe.3bd9dc8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quote.exe.3bd9dc8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quote.exe.488f1a8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2878079925.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2880214725.0000000002EEE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1692358614.0000000003B99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2880214725.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1692358614.00000000045F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Quote.exe PID: 6904, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Quote.exe PID: 6208, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Quote.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Quote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Quote.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Quote.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Quote.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 2.2.Quote.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quote.exe.3bd9dc8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quote.exe.3bd9dc8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quote.exe.488f1a8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2878079925.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1692358614.0000000003B99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2880214725.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1692358614.00000000045F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Quote.exe PID: 6904, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Quote.exe PID: 6208, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 2.2.Quote.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quote.exe.3bd9dc8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quote.exe.3bd9dc8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quote.exe.488f1a8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2878079925.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2880214725.0000000002EEE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1692358614.0000000003B99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2880214725.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1692358614.00000000045F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Quote.exe PID: 6904, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Quote.exe PID: 6208, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	2 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	1 Process Discovery	Remote Desktop Protocol	1 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	141 Virtualization/Sandbox Evasion	1 Credentials in Registry	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	2 Data from Local System	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Quote.exe	37%	Virustotal		Browse
Quote.exe	34%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
Quote.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://tempuri.org/DataSet1.xsd)Microsoft	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
us2.smtp.mailhostbox.com	208.91.198.143	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://account.dyn.com/	Quote.exe, 00000000.00000002.1692358614.0000000003B99000.00000004.00000800.00020000.00000000.sdmp, Quote.exe, 00000000.00000002.1692358614.00000000045F5000.00000004.00000800.00020000.00000000.sdmp, Quote.exe, 00000002.00000002.2878079925.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://tempuri.org/DataSet1.xsd)Microsoft	Quote.exe	false	1%, Virustotal, Browse	unknown
http://us2.smtp.mailhostbox.com	Quote.exe, 00000002.00000002.2880214725.0000000002EF6000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.91.198.143	us2.smtp.mailhostbox.com	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	false
208.91.199.225	unknown	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	false
208.91.199.223	unknown	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	false
208.91.199.224	unknown	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427944
Start date and time:	2024-04-18 11:17:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Quote.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@1/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 96 Number of non-executed functions: 17
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:17:55	API Interceptor	127352x Sleep call for process: Quote.exe modified
11:18:21	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
208.91.198.143	SecuriteInfo.com.Heur.15333.25205.exe	Get hash	malicious	AgentTesla	Browse
	Fsd5TmAZfy.exe	Get hash	malicious	AgentTesla	Browse
	April 2024 order Pdf.exe	Get hash	malicious	AgentTesla	Browse
	TT Invoice copy.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	MT103.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Transmiison Remit.exe	Get hash	malicious	AgentTesla	Browse
	account details ptgd.exe	Get hash	malicious	AgentTesla	Browse
	DHL-7654544CNT Pdf.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Trojan.PackedNET.2794.21912.2151.exe	Get hash	malicious	AgentTesla	Browse
	Prices.exe	Get hash	malicious	AgentTesla	Browse
208.91.199.225	Quote.exe	Get hash	malicious	AgentTesla	Browse
	Quotation 0048484.exe	Get hash	malicious	AgentTesla	Browse
	MV SUN OCEAN BUNKER INV.doc	Get hash	malicious	AgentTesla	Browse
	Transmiison Remit.exe	Get hash	malicious	AgentTesla	Browse
	Quotation.exe	Get hash	malicious	AgentTesla	Browse
	euFL17ioCm.exe	Get hash	malicious	AgentTesla	Browse
	Quote.exe	Get hash	malicious	AgentTesla	Browse
	Zarefy4bOs.exe	Get hash	malicious	Snake Keylogger	Browse
	Request for Quotation.exe	Get hash	malicious	AgentTesla	Browse
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse
208.91.199.223	Quote.exe	Get hash	malicious	AgentTesla	Browse
	Cleared Payment.exe	Get hash	malicious	AgentTesla	Browse
	ReInquiry Lenght Error.exe	Get hash	malicious	AgentTesla	Browse
	Transmiison Remit.exe	Get hash	malicious	AgentTesla	Browse
	MT103 .exe	Get hash	malicious	AgentTesla	Browse
	New Order 0048757.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.19751.7678.exe	Get hash	malicious	AgentTesla	Browse
	Po094847 Urgent .exe	Get hash	malicious	AgentTesla	Browse
	PO_10042024.exe	Get hash	malicious	AgentTesla	Browse
	cgprgRztWc.exe	Get hash	malicious	AgentTesla	Browse
208.91.199.224	MV SUN OCEAN BUNKER INV.doc	Get hash	malicious	AgentTesla	Browse
	ES502900012.pdf.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.PWSX-gen.22951.7290.exe	Get hash	malicious	AgentTesla	Browse
	Transmiison Remit.exe	Get hash	malicious	AgentTesla	Browse
	Quote.exe	Get hash	malicious	AgentTesla	Browse
	Purchase Order.exe	Get hash	malicious	AgentTesla	Browse
	Quotation.exe	Get hash	malicious	AgentTesla	Browse
	Quote.exe	Get hash	malicious	AgentTesla	Browse
	CLQJDkgY3X.exe	Get hash	malicious	AgentTesla	Browse
	UPS 984645.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
us2.smtp.mailhostbox.com	Quote.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	SecuriteInfo.com.Heur.15333.25205.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	Cleared Payment.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	Quote.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	Quotation 0048484.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	Fsd5TmAZfy.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	MV SUN OCEAN BUNKER INV.doc	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	ReInquiry Lenght Error.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	ES502900012.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	April 2024 order Pdf.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	Quote.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	SecuriteInfo.com.Heur.15333.25205.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	DOCUMENTS.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	Cleared Payment.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	Quote.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	Quotation 0048484.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	SecuriteInfo.com.Win32.PWSX-gen.28055.17747.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	Fsd5TmAZfy.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	SHIPPING ORDER.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	MV SUN OCEAN BUNKER INV.doc	Get hash	malicious	AgentTesla	Browse	208.91.199.224
PUBLIC-DOMAIN-REGISTRYUS	Quote.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	SecuriteInfo.com.Heur.15333.25205.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	DOCUMENTS.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	Cleared Payment.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	Quote.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	Quotation 0048484.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	SecuriteInfo.com.Win32.PWSX-gen.28055.17747.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	Fsd5TmAZfy.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	SHIPPING ORDER.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	MV SUN OCEAN BUNKER INV.doc	Get hash	malicious	AgentTesla	Browse	208.91.199.224
PUBLIC-DOMAIN-REGISTRYUS	Quote.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	SecuriteInfo.com.Heur.15333.25205.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	DOCUMENTS.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	Cleared Payment.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	Quote.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	Quotation 0048484.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	SecuriteInfo.com.Win32.PWSX-gen.28055.17747.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	Fsd5TmAZfy.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	SHIPPING ORDER.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	MV SUN OCEAN BUNKER INV.doc	Get hash	malicious	AgentTesla	Browse	208.91.199.224
PUBLIC-DOMAIN-REGISTRYUS	Quote.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	SecuriteInfo.com.Heur.15333.25205.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	DOCUMENTS.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	Cleared Payment.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	Quote.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	Quotation 0048484.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	SecuriteInfo.com.Win32.PWSX-gen.28055.17747.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	Fsd5TmAZfy.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	SHIPPING ORDER.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	MV SUN OCEAN BUNKER INV.doc	Get hash	malicious	AgentTesla	Browse	208.91.199.224

Process:	C:\Users\user\Desktop\Quote.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	4926
Entropy (8bit):	3.2439260532546705
Encrypted:	false
SSDEEP:	48:FaqdF79/0+AAHdKoqKFxcxkF3/waqdF70+AAHdKoqKFxcxkFV:cEi+AAsoJjykzE0+AAsoJjyk/
MD5:	A302FE36F47524F9EB23A3442AE11901
SHA1:	506BC2EAFF79414E9B6F02A7172F5F7AC28E497E
SHA-256:	25498382CA1AAF97A2811FEAAD1275623737691F46FE9B8325E3F4E399F77112
SHA-512:	66B891042AF754C3323F6FE159BCEBD439860152873629E69949C695D71D219E19B91E6326D4DF206B5266C81F5BF835E776210D6BDA652D20DEF6F21CA6FE1A
Malicious:	false
Reputation:	low
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. W.e.d. .. O.c.t. .. 0.4. .. 2.0.2.3. .1.2.:.0.3.:.4.2.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.276564135948447
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Quote.exe
File size:	1'036'800 bytes
MD5:	4bde497149d69bd21bce08c8dd20cbe6
SHA1:	51b7b2a217a8ee771ba08cddb9afc94c9d57ddbb
SHA256:	646da2f80123a9ae67c58d474c19609900b5816941164677dc24238316b512e9
SHA512:	c5d741dfbd6453fa0da97e7964ce8baedd1a0c042b15df49c42f38bb5720ca22ecb730c5cdb7b8d990e47fa951b5e5a91a6a5367ed6faf2be308316e695f0150
SSDEEP:	12288:yYEuIzHyxF+p8AkFrenbnx1BCHrqZKgnZdHYDsQDl0mFVWooGorRLxg7SD9cZ6m/:XE1zSypl0glPkMX0D2mFVW3+Aco2mE
TLSH:	4F25E23D1CBD2A3B9075D2A9CFE98567F040D47B3A11AD7A88D383958346A9379C313E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....0...............0.............*.... ........@.. .......................@............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4fe52a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF430D9AD [Wed Oct 28 03:42:37 2099 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xfe4d8	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x100000	0x624	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x102000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xfc1fc	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xfc530	0xfc600	243b1e4ec64a25c2a378b0ff65dcaad3	False	0.7812567716072313	data	7.284313720335351	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x100000	0x624	0x800	9b0cf8a275cc1e926cabffb2b586b31e	False	0.333984375	data	3.4587830036363085	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x102000	0xc	0x200	fc23b933bd7748e3599e22eb4f084f95	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x100090	0x394	OpenPGP Secret Key			0.42248908296943233
RT_MANIFEST	0x100434	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 11:18:02.344532967 CEST	49730	587	192.168.2.4	208.91.198.143
Apr 18, 2024 11:18:03.337131023 CEST	49730	587	192.168.2.4	208.91.198.143
Apr 18, 2024 11:18:05.337068081 CEST	49730	587	192.168.2.4	208.91.198.143
Apr 18, 2024 11:18:09.337074041 CEST	49730	587	192.168.2.4	208.91.198.143
Apr 18, 2024 11:18:17.352746010 CEST	49730	587	192.168.2.4	208.91.198.143
Apr 18, 2024 11:18:23.370054007 CEST	49730	587	192.168.2.4	208.91.199.223
Apr 18, 2024 11:18:24.383977890 CEST	49730	587	192.168.2.4	208.91.199.223
Apr 18, 2024 11:18:26.399636030 CEST	49730	587	192.168.2.4	208.91.199.223
Apr 18, 2024 11:18:30.399765015 CEST	49730	587	192.168.2.4	208.91.199.223
Apr 18, 2024 11:18:38.415304899 CEST	49730	587	192.168.2.4	208.91.199.223
Apr 18, 2024 11:18:44.431261063 CEST	49730	587	192.168.2.4	208.91.199.225
Apr 18, 2024 11:18:45.446526051 CEST	49730	587	192.168.2.4	208.91.199.225
Apr 18, 2024 11:18:47.446544886 CEST	49730	587	192.168.2.4	208.91.199.225
Apr 18, 2024 11:18:51.446645021 CEST	49730	587	192.168.2.4	208.91.199.225
Apr 18, 2024 11:18:59.446585894 CEST	49730	587	192.168.2.4	208.91.199.225
Apr 18, 2024 11:19:05.446878910 CEST	49730	587	192.168.2.4	208.91.199.224
Apr 18, 2024 11:19:06.446671009 CEST	49730	587	192.168.2.4	208.91.199.224
Apr 18, 2024 11:19:08.446755886 CEST	49730	587	192.168.2.4	208.91.199.224
Apr 18, 2024 11:19:12.446588039 CEST	49730	587	192.168.2.4	208.91.199.224
Apr 18, 2024 11:19:20.446647882 CEST	49730	587	192.168.2.4	208.91.199.224

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 11:18:02.229640961 CEST	53106	53	192.168.2.4	1.1.1.1
Apr 18, 2024 11:18:02.336376905 CEST	53	53106	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 18, 2024 11:18:02.229640961 CEST	192.168.2.4	1.1.1.1	0x2326	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 18, 2024 11:18:02.336376905 CEST	1.1.1.1	192.168.2.4	0x2326	No error (0)	us2.smtp.mailhostbox.com	208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:18:02.336376905 CEST	1.1.1.1	192.168.2.4	0x2326	No error (0)	us2.smtp.mailhostbox.com	208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:18:02.336376905 CEST	1.1.1.1	192.168.2.4	0x2326	No error (0)	us2.smtp.mailhostbox.com	208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:18:02.336376905 CEST	1.1.1.1	192.168.2.4	0x2326	No error (0)	us2.smtp.mailhostbox.com	208.91.199.224	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	11:17:54
Start date:	18/04/2024
Path:	C:\Users\user\Desktop\Quote.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Quote.exe"
Imagebase:	0x750000
File size:	1'036'800 bytes
MD5 hash:	4BDE497149D69BD21BCE08C8DD20CBE6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1692358614.0000000003B99000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1692358614.0000000003B99000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1692358614.00000000045F5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1692358614.00000000045F5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:18:00
Start date:	18/04/2024
Path:	C:\Users\user\Desktop\Quote.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Quote.exe"
Imagebase:	0x160000
File size:	1'036'800 bytes
MD5 hash:	4BDE497149D69BD21BCE08C8DD20CBE6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:18:00
Start date:	18/04/2024
Path:	C:\Users\user\Desktop\Quote.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Quote.exe"
Imagebase:	0xa80000
File size:	1'036'800 bytes
MD5 hash:	4BDE497149D69BD21BCE08C8DD20CBE6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2878079925.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2878079925.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2880214725.0000000002EEE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2880214725.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2880214725.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	11:18:21
Start date:	18/04/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff6fb0e0000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:18:21
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	7.4%
Total number of Nodes:	231
Total number of Limit Nodes:	12

Executed Functions

Function 04B902D0 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694064151.0000000004B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b90000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b9fef9fb92814bf77bbce72e3cfb717c4a1978e68167f88f96a944a1541d060
Instruction ID: b7f9592a399362d21df9b24d253586ae8cedd409b7a35911868a137849ea916c
Opcode Fuzzy Hash: 1b9fef9fb92814bf77bbce72e3cfb717c4a1978e68167f88f96a944a1541d060
Instruction Fuzzy Hash: 5B51D671E4562ACBDB28DF66C8407E9BBF6BF89300F14D5FAC40DA6211EB705A859F40

Uniqueness

Uniqueness Score: -1.00%

Function 04B909FA Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694064151.0000000004B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b90000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e1578015ae55c2f4c37f7569995b4f0ecdbba5a1d041d1ea911557ec633440a
Instruction ID: 05c57e57eb6d5a08ce7b50083aface7f0b68fa39eee14d2bb9b12707f4962f2b
Opcode Fuzzy Hash: 9e1578015ae55c2f4c37f7569995b4f0ecdbba5a1d041d1ea911557ec633440a
Instruction Fuzzy Hash: 1B41B174909229CFCB64EF68D9847E8BBF5EB49305F0490EAD40EA6252E7306E85DF11

Uniqueness

Uniqueness Score: -1.00%

Function 04B903E8 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694064151.0000000004B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b90000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8039a560fc92f80b01781b88f2cded8078acfd2146e8a6b2f0cc60d702d08297
Instruction ID: 02f010bb8b7ac499ca70b11cfbaa426eb7b1f162c63c14c89966fa638a7b0cb6
Opcode Fuzzy Hash: 8039a560fc92f80b01781b88f2cded8078acfd2146e8a6b2f0cc60d702d08297
Instruction Fuzzy Hash: 3631E174A08228DFCB24DF68C9457E8BBF4EB49301F1094EAD54AA6292D7706EC5DF10

Uniqueness

Uniqueness Score: -1.00%

Function 04B9048D Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694064151.0000000004B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b90000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485d3ae1296d60b8182e57e435b5bd60cd65421566485a8fde114c03f9812b98
Instruction ID: 91ef5c678390a2faed553530a7b62beec6e1a2fb456d874754868da1bedb969a
Opcode Fuzzy Hash: 485d3ae1296d60b8182e57e435b5bd60cd65421566485a8fde114c03f9812b98
Instruction Fuzzy Hash: B831E274905268CFCB24EF69D9487E8BBF4EB49311F0094EAD44AA3292E7305E85DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0122D010 Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0122D09E
GetCurrentThread.KERNEL32 ref: 0122D0DB
GetCurrentProcess.KERNEL32 ref: 0122D118
GetCurrentThreadId.KERNEL32 ref: 0122D171

Memory Dump Source

Source File: 00000000.00000002.1691074941.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1220000_Quote.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4c4f45f0ab08d69891ecab52ef583d1bdcccaf5de18dd543bb6b0b430a508da1
Instruction ID: c4ced9f1dcc81c71175509778d0e321a410d7facae7444f2427ac3cbd1692c5c
Opcode Fuzzy Hash: 4c4f45f0ab08d69891ecab52ef583d1bdcccaf5de18dd543bb6b0b430a508da1
Instruction Fuzzy Hash: 385177B0D11249DFDB18DFA9D548BDEBBF1AF48304F20C459E408AB2A1DB349984CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0122D020 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0122D09E
GetCurrentThread.KERNEL32 ref: 0122D0DB
GetCurrentProcess.KERNEL32 ref: 0122D118
GetCurrentThreadId.KERNEL32 ref: 0122D171

Memory Dump Source

Source File: 00000000.00000002.1691074941.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1220000_Quote.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 86aeb99fbb8a64b96f8a64972e214bcdb72974d86f932d7b127826196f4da92a
Instruction ID: a89afeae739c389c4c6f34e071b9098187f467b030115e33b417e3a6732631c1
Opcode Fuzzy Hash: 86aeb99fbb8a64b96f8a64972e214bcdb72974d86f932d7b127826196f4da92a
Instruction Fuzzy Hash: 445154B09112499FDB18DFAAD548BEEBBF1AF88314F20C019E419A7260DB749984CF65

Uniqueness

Uniqueness Score: -1.00%

Function 085BF017 Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 085BF256

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c018907ed74176db04936070a07b1290e22f95c4b57c346777edf4d520d9e91b
Instruction ID: f095abf01e3d8f2b3e0a4d0b2ef76cabac9b8381a5c76fb3013ba689adf796d4
Opcode Fuzzy Hash: c018907ed74176db04936070a07b1290e22f95c4b57c346777edf4d520d9e91b
Instruction Fuzzy Hash: 80913871D00219DFEB10CFA8CC41BEEBBB2BF48315F1485A9E859A7250DB749986CF91

Uniqueness

Uniqueness Score: -1.00%

Function 085BF020 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 085BF256

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9bdf54513535baee99eadbb182a4bcb1c39f4c444f9d5a0efe514b85c6d4ef04
Instruction ID: 0127931a30295969603a49f067c9b3d9411cd0add90cedaf1920df518becac9d
Opcode Fuzzy Hash: 9bdf54513535baee99eadbb182a4bcb1c39f4c444f9d5a0efe514b85c6d4ef04
Instruction Fuzzy Hash: EF913871D00219DFEB10CFA9CC417EEBBB2BF48315F1485AAE819A7250DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0122AD88 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0122AFDE

Memory Dump Source

Source File: 00000000.00000002.1691074941.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1220000_Quote.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2f66715813362ba8b7b89c7323f27d93c9296de4e3106f2609c703f84b7eef91
Instruction ID: efacab8aefd287e2f8793bc573cf6e9914dfbede8c2eafef95453a561bec8651
Opcode Fuzzy Hash: 2f66715813362ba8b7b89c7323f27d93c9296de4e3106f2609c703f84b7eef91
Instruction Fuzzy Hash: 6C714270A10B169FD724DF29D14479ABBF1FF88304F008A2DD58ADBA50DB75E94ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 0122590C Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 012259C9

Memory Dump Source

Source File: 00000000.00000002.1691074941.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1220000_Quote.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 54975e7e1acbb3a2520a627e492fee0d557731a20c590e32c48d679f043379a7
Instruction ID: 86eae886b6bfd3189e9e29c8295fd5c8695af17e303a7ace884ef8ffa9569240
Opcode Fuzzy Hash: 54975e7e1acbb3a2520a627e492fee0d557731a20c590e32c48d679f043379a7
Instruction Fuzzy Hash: 4A41EFB0C10729DFDB24CFA9C985ACEBBB5BF48304F24816AD408AB255DB755986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 012244B0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 012259C9

Memory Dump Source

Source File: 00000000.00000002.1691074941.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1220000_Quote.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 1eb94f336e3afa2f745a436cd6393cb2aa6d30071429d3bd5e26a36365855e31
Instruction ID: e8e1a3451fff5d75d0e2f5b3a950898a0fbe2e866fdaa55a5769b2736dc37dae
Opcode Fuzzy Hash: 1eb94f336e3afa2f745a436cd6393cb2aa6d30071429d3bd5e26a36365855e31
Instruction Fuzzy Hash: 7541D2B0C1071DDBDB24CFA9C8857DDBBB5BF49304F24805AD408AB255DB755985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 085BED90 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 085BEE28

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: e8515f8e2df42138194e0e94f6fe632ebff161a8b53ab3a182fed6c029bc9acf
Instruction ID: e3a23bd3d4d72c4f4f940355350ffe763f8b8c0cf5be624f2cdb5fbc12937cc3
Opcode Fuzzy Hash: e8515f8e2df42138194e0e94f6fe632ebff161a8b53ab3a182fed6c029bc9acf
Instruction Fuzzy Hash: 652135B19002599FCB10CFAAC885BEEBBF1FF88310F148429E959A7251C7789954CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 085BED98 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 085BEE28

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d5fb19485d1b755201cdf0fbf3cf26d241735ece01d986d35bf558f85b38df96
Instruction ID: 454700dabd1fd683ee5bacdf2000883318a105a0b231df7f77d9ae64f39a8b51
Opcode Fuzzy Hash: d5fb19485d1b755201cdf0fbf3cf26d241735ece01d986d35bf558f85b38df96
Instruction Fuzzy Hash: 122139B1900359DFCB10CFA9C885BDEBBF5FF48310F148429E958A7251D7789954CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 085BE7C0 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 085BE846

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9249802e06d48e3543f025710d6d70b2231ad1268f424dda499822c3c200f7a5
Instruction ID: 5f392674f3a05108a59f4de96c39644ec4c370b40a2004b927fc8f1d863c80a6
Opcode Fuzzy Hash: 9249802e06d48e3543f025710d6d70b2231ad1268f424dda499822c3c200f7a5
Instruction Fuzzy Hash: 6D2128B1D002098FDB10DFAAD4857EEBBF0AF88324F14842DD459A7241C7789945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 085BEE80 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 085BEF08

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 924c50f05311fd6e94365fe66fb6b917c4b6aa086235a61012c8aafeeafdd851
Instruction ID: 5c3f5094a2db7de986e788ce31301f44469ea5651248d42a194b3375c92b36ed
Opcode Fuzzy Hash: 924c50f05311fd6e94365fe66fb6b917c4b6aa086235a61012c8aafeeafdd851
Instruction Fuzzy Hash: C12136B19002499FCB10CFAAD885AEEBBF1FF88320F10842DE559A7251C7789945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 085BEE88 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 085BEF08

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 97dc05447b2820d0415852d0599478c2aec43a552a878313acb7314881f06dc3
Instruction ID: 9425b17408f3d6b1cf51027e0fdb721725a40bed2cdfe663393d8015602ccf7b
Opcode Fuzzy Hash: 97dc05447b2820d0415852d0599478c2aec43a552a878313acb7314881f06dc3
Instruction Fuzzy Hash: 972128B18002599FCB10DFAAC885ADEFBF5FF48320F108429E558A7251C7749944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 085BE7C8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 085BE846

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 805a09190aac7e9c3977bfe1a5ded3b6d85a3224985f93da49370990d3f3c198
Instruction ID: 216fa94516946f9104c440fd35092ea271da2bff99d645f9ca10f2c969a9453e
Opcode Fuzzy Hash: 805a09190aac7e9c3977bfe1a5ded3b6d85a3224985f93da49370990d3f3c198
Instruction Fuzzy Hash: AA2138B1D002098FDB10DFAAC4857EEBBF4EF88324F54842DD459A7241CB78A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0122D668 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0122D6F7

Memory Dump Source

Source File: 00000000.00000002.1691074941.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1220000_Quote.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 446b2e915e335bd51e0b897acfc9fe5aabb1aca98f3ff43d4d6a20c6363688b4
Instruction ID: 490f044b3a147e797ab95ef1332ef1fe56c5bcb8e5ba903f36ec53ce5e0fcfd1
Opcode Fuzzy Hash: 446b2e915e335bd51e0b897acfc9fe5aabb1aca98f3ff43d4d6a20c6363688b4
Instruction Fuzzy Hash: B82103B59002589FDB10CFA9E584AEEBFF4EB48320F14801AE918A7250C378A940CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0122D670 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0122D6F7

Memory Dump Source

Source File: 00000000.00000002.1691074941.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1220000_Quote.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f23b88048ee6fa49677acc24221f9ece8bfd5d849726a2e1acb467bfe0c8b234
Instruction ID: 93bfd84bee12672df7eba2f46c35a43766e52bb1797cb5fbdf2304593cd03e6f
Opcode Fuzzy Hash: f23b88048ee6fa49677acc24221f9ece8bfd5d849726a2e1acb467bfe0c8b234
Instruction Fuzzy Hash: 3021E4B5900258AFDB10CF9AD984ADEBFF4FB48320F14801AE918A7350D374A940CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0122A110 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0122B059,00000800,00000000,00000000), ref: 0122B26A

Memory Dump Source

Source File: 00000000.00000002.1691074941.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1220000_Quote.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7a10ac67409b9c0ed49d80217e060292c00457452b8eee0367e5734542048f24
Instruction ID: 931ca7b1b1806f818ef2f235e18350a69a65eda2c592c0ab81c6fc136dbeef44
Opcode Fuzzy Hash: 7a10ac67409b9c0ed49d80217e060292c00457452b8eee0367e5734542048f24
Instruction Fuzzy Hash: 2A1126B6D103599FDB10CF9AD444ADEFBF4EB49310F10852AD519A7210C375A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0122B1F8 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0122B059,00000800,00000000,00000000), ref: 0122B26A

Memory Dump Source

Source File: 00000000.00000002.1691074941.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1220000_Quote.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 03d47b67059775f8c21c6eeb51c31338203b780458a309aa84942b3b9c8e2bcf
Instruction ID: 0a4f6f99f380d90b2e45fc63a16bf113a02a4af19d2f64034a987f65798572ce
Opcode Fuzzy Hash: 03d47b67059775f8c21c6eeb51c31338203b780458a309aa84942b3b9c8e2bcf
Instruction Fuzzy Hash: 771112B6C003199FDB14CFAAD444ADEFBF4EB88320F10852AD559AB210C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 085BECD1 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 085BED46

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4f275ce17c110eea98135403ec0da49c41a00cbdfe0d7b7a91b42cd6bb6a392e
Instruction ID: 0d48bf2daf071d90e3dcb301e3b20b3984da313623238f75960e2164e8e9e77a
Opcode Fuzzy Hash: 4f275ce17c110eea98135403ec0da49c41a00cbdfe0d7b7a91b42cd6bb6a392e
Instruction Fuzzy Hash: 731156B59002488FCB10DFAAC845AEFBFF1AF88320F24841DE559AB250C7759944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 085BECD8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 085BED46

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8dce91c641bb250ada183af618dc5ab266266ef91a93d473281a2e091d8994cc
Instruction ID: f7e5e6654ecd6854ef7b24dc54537289ecb13f1399ee1c270df5914f33bb6109
Opcode Fuzzy Hash: 8dce91c641bb250ada183af618dc5ab266266ef91a93d473281a2e091d8994cc
Instruction Fuzzy Hash: 191134B29002499FCB10DFAAC845BDEBFF5EF88320F248419E559AB250C775A954CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 085BE710 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(5CF9E804), ref: 085BE77A

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 51a3787f2c333064bdf8ff5fc15c2d5ac4e9633ab364b772cd1512722f5022df
Instruction ID: 01905ba8f768d1faead64c803517c9c0ddba0f1767ffa2f1ba23a1b20e074c70
Opcode Fuzzy Hash: 51a3787f2c333064bdf8ff5fc15c2d5ac4e9633ab364b772cd1512722f5022df
Instruction Fuzzy Hash: 0D1146B5D002488FDB20DFAAC4457EEFFF4AF88324F248429C459A7250C774A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 085BE718 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(5CF9E804), ref: 085BE77A

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0a8d93abbcf977b38dc8af58f2a8d33b5cc74fe4477b13520249e35198ea0b6c
Instruction ID: 825d73e9a7af84e44285dff5f364fcf5b35e3ad4365b8851b28780211b6cd6ac
Opcode Fuzzy Hash: 0a8d93abbcf977b38dc8af58f2a8d33b5cc74fe4477b13520249e35198ea0b6c
Instruction Fuzzy Hash: 281125B1D002488BCB20DFAAC8457DEFBF4AF88324F248429D459A7250CA79A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0122AF78 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0122AFDE

Memory Dump Source

Source File: 00000000.00000002.1691074941.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1220000_Quote.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 25ca38511a1b01c4cb5de4be4d9cdaa235a86ed11279fa49c60ad2c8b5340287
Instruction ID: 3d7fa643c3b159dfc9acd8c7b43275cbda6fcc31995d86ec1e290cb48096746e
Opcode Fuzzy Hash: 25ca38511a1b01c4cb5de4be4d9cdaa235a86ed11279fa49c60ad2c8b5340287
Instruction Fuzzy Hash: 671122B5C003598FDB10CF9AD444ADEFBF4EF88324F10842AD928A7A50C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04B91278 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 04B91A9D

Memory Dump Source

Source File: 00000000.00000002.1694064151.0000000004B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b90000_Quote.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 4be534434c84c3afc7a7e276f31d806b55682849a54afcf95aae0ff3cb118259
Instruction ID: a79b9e70faf3007455573fe7927506b0cf4e79b9fc9eb700c452695994d55c01
Opcode Fuzzy Hash: 4be534434c84c3afc7a7e276f31d806b55682849a54afcf95aae0ff3cb118259
Instruction Fuzzy Hash: FA1125B58003499FDB10DF9AD584BDEBFF8EB48320F108459E914A7201C375A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04B91A39 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 04B91A9D

Memory Dump Source

Source File: 00000000.00000002.1694064151.0000000004B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b90000_Quote.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: fb4be0b65754ac49a3b0d2f9e6adc3ad9c7d50812c5e960b7d4178a45b411975
Instruction ID: 811913f35ba02e0bd342317b743faac4cc7b7997ff082ac687beb9df3c64daff
Opcode Fuzzy Hash: fb4be0b65754ac49a3b0d2f9e6adc3ad9c7d50812c5e960b7d4178a45b411975
Instruction Fuzzy Hash: DA1103B58002499FDB10CF9AD484BDEFFF4EB48320F20855AD858A7251C3B5A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E0D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690677751.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0d000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1065b2698fb7af6328dc6b63f3323e544f2ed1af737c9c1dac3c8322c2e8c1ea
Instruction ID: 97966e426c9a78737c908cde9b24ea0a7e98aa372bc7a5c0d8f0673ab6b2f24a
Opcode Fuzzy Hash: 1065b2698fb7af6328dc6b63f3323e544f2ed1af737c9c1dac3c8322c2e8c1ea
Instruction Fuzzy Hash: DB213A71508204DFDB05DF54DDC0B2BBF65FB94324F20C169E9095B296C336E896C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00F2D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690745914.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f2d000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af838ccb10d2a399661d565b1674225ecae047f0137b961671dc77284343b0eb
Instruction ID: 101a29c3659044b7bee8c582f1678f1ef3b80bc9df848471d23ea9ce6211d2b3
Opcode Fuzzy Hash: af838ccb10d2a399661d565b1674225ecae047f0137b961671dc77284343b0eb
Instruction Fuzzy Hash: AF210471A04240DFCB14DF14E9C4B26BFA5FB84324F20C56DD94A4B2AAC33AD847DA61

Uniqueness

Uniqueness Score: -1.00%

Function 00F2D1EC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690745914.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f2d000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e1fcc4750dbe5f425365ab0f04aa32a2ba6bf0b64c5fe9c5c33504b1a31dbc4
Instruction ID: 142c2052531299986c2cff25978e130c2e07599dfc0e79c212a423fa19c6ad73
Opcode Fuzzy Hash: 6e1fcc4750dbe5f425365ab0f04aa32a2ba6bf0b64c5fe9c5c33504b1a31dbc4
Instruction Fuzzy Hash: 43210471944200DFDB04DF14E9C0B26BBA5FB98324F20C56DD8094B2D6C37AD846EAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F2D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690745914.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f2d000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41188f49962c296389add89137c20b11fc6b3568757a05b1c00d98ed66152a04
Instruction ID: e03cfe68babb4c664c9d4b468ffec522b8cf6c8844d54726c0c6646add8b5367
Opcode Fuzzy Hash: 41188f49962c296389add89137c20b11fc6b3568757a05b1c00d98ed66152a04
Instruction Fuzzy Hash: 4F215E755093808FDB12CF24D994715BF71EB46324F28C5EAD8498F6A7C33A980ADB62

Uniqueness

Uniqueness Score: -1.00%

Function 00E0D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690677751.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0d000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 916f635bd7cd2d98ae01a33fdfe6744ad54c245a30d9070ba44cf28ce6bc104a
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: EF112672404240CFCB12CF44D9C4B16BF71FB94328F24C2A9DC090B256C33AE85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F2D1E7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690745914.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f2d000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: f2fdb02c894a77eaa26dc5c41779fc886ac7027ecb8fb1307da17e48eba0ef43
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: AB119D75904280DFDB05CF54E5C4B15BFA2FB84328F24C6AAD8494B696C33AD84ADBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E0D731 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690677751.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0d000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b5de73a720542dfac1fc9888f449beecd0c6e79464e215c31aa94efabab305a
Instruction ID: a8b1304dfcfcc38ac665f7062da3e48f90ddc667e6054d7c8e5dc91914269769
Opcode Fuzzy Hash: 2b5de73a720542dfac1fc9888f449beecd0c6e79464e215c31aa94efabab305a
Instruction Fuzzy Hash: 5A01A77140C3449AE7104A69CDC47A7FF98EF85324F1CC52BED095A1D6C6799C80C771

Uniqueness

Uniqueness Score: -1.00%

Function 00E0D730 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690677751.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0d000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38bff414e1cb80921ef0c9a94e517a27c9ab910ddaa100082860fe28d7e36f3a
Instruction ID: 7d165feabaa2f495a0b33955fa812ee955fc64bbd8500291b7bf1a04a34b640d
Opcode Fuzzy Hash: 38bff414e1cb80921ef0c9a94e517a27c9ab910ddaa100082860fe28d7e36f3a
Instruction Fuzzy Hash: 64F062714083449EE7108A1ACDC4BA6FFA8EF95738F18C55AED085E286C2799C84CB71

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 085B56A0 Relevance: 5.3, Strings: 4, Instructions: 259COMMON

Download Yara Rule

Strings

T+-q, xrefs: 085B59DA
[V~*, xrefs: 085B5805
]\`, xrefs: 085B5922
[V~*, xrefs: 085B580C

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID:
String ID: T+-q$[V~*$[V~*$]\`
API String ID: 0-1849991408
Opcode ID: fa87880ebd61830e52ba5a82b4d35293740e781f355f812c047b5b58fbb7cd2c
Instruction ID: f2e1969de60eeb3293a087ebf649b9067ae4a031fb2b99be54207c157550b7c1
Opcode Fuzzy Hash: fa87880ebd61830e52ba5a82b4d35293740e781f355f812c047b5b58fbb7cd2c
Instruction Fuzzy Hash: D2B1E574E15219DBCB08CFAAD9809DEFBF2BF99340B14D92AD415BB214E730A9068F54

Uniqueness

Uniqueness Score: -1.00%

Function 085B569F Relevance: 4.0, Strings: 3, Instructions: 251COMMON

Download Yara Rule

Strings

T+-q, xrefs: 085B59DA
]\`, xrefs: 085B5922
[V~*, xrefs: 085B580C

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID:
String ID: T+-q$[V~*$]\`
API String ID: 0-3978741314
Opcode ID: b33c20510fef0211d2f7391d463d7b6e84f65779fd8d1b2864d49ecbda86bb7e
Instruction ID: d12e5094dbe687a1a8108a3cf8d87f16455589e8111457467b1e277213359b63
Opcode Fuzzy Hash: b33c20510fef0211d2f7391d463d7b6e84f65779fd8d1b2864d49ecbda86bb7e
Instruction Fuzzy Hash: 0FA1F774E15219DFCB08CFAAD9809DEFBF2BF99340B14D92AD415BB214E73099058F64

Uniqueness

Uniqueness Score: -1.00%

Function 04B93148 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694064151.0000000004B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b90000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 389253414a2a28b35968b001be4a78882c59b27474108c5d1d9b65289cffad71
Instruction ID: 7ac980d15955ee643a8ec43a04e897c012b8d85d2f2774cbb1ea9f0660fd6d9d
Opcode Fuzzy Hash: 389253414a2a28b35968b001be4a78882c59b27474108c5d1d9b65289cffad71
Instruction Fuzzy Hash: 46D19931B006119FEB29DB79C450BAEB7F6EF89304F1488B9D5469B6A0DB35EC02CB51

Uniqueness

Uniqueness Score: -1.00%

Function 085BC818 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5ab6b0b8d3be3675369269db399bb8af8037798789387ffa4fadeda7ae11976
Instruction ID: 71d82b9c015a1e274706819738fe2bbc568d752f616c8807e730d91d5e403c1b
Opcode Fuzzy Hash: f5ab6b0b8d3be3675369269db399bb8af8037798789387ffa4fadeda7ae11976
Instruction Fuzzy Hash: 38E1F874E101198FDB14DFA9C5809AEFBF2BF89305F2481A9E415AB356DB30AD42CF64

Uniqueness

Uniqueness Score: -1.00%

Function 085BE8A0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88211fc8aecf0eb6fe9f942cbbe0773d5a30bb328f83720c3204bece260dc784
Instruction ID: 2837d8cec1e0564e2e7271eeeb20a5420df724406d9f8b803334c739c1fc8ca8
Opcode Fuzzy Hash: 88211fc8aecf0eb6fe9f942cbbe0773d5a30bb328f83720c3204bece260dc784
Instruction Fuzzy Hash: 92E1F874E001198FCB14DFA9C5859AEFBF2BF89305F24C169E415AB356DB30A941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 085BDAB8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b0fea02a04090653ba1304984277942ca47c099db0c2efc409512943032a00d
Instruction ID: 1d8a47029a9bcbca4bb9c25005e78288f0dde5cbad04a8ca0c8c822b36b23f4c
Opcode Fuzzy Hash: 3b0fea02a04090653ba1304984277942ca47c099db0c2efc409512943032a00d
Instruction Fuzzy Hash: 18E1D874E001198FCB14DFA9C5859AEFBF2BF89305F2481AAE414AB356DB31A941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 085BDEF0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74b8f76fb035710bce3557f5f9e2b25f7ba28aa9b66801f6711637c4f348c312
Instruction ID: 3000547c325e35bc470c27468842175c9506951254bfeb5a9b3723eccf421a6f
Opcode Fuzzy Hash: 74b8f76fb035710bce3557f5f9e2b25f7ba28aa9b66801f6711637c4f348c312
Instruction Fuzzy Hash: B9E1F774E002198FDB14DFA9C5859AEFBF2BF89305F248169E414AB356DB30A942CF60

Uniqueness

Uniqueness Score: -1.00%

Function 085BC3E0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d6a2a72cdf5eb986edfa5a2e810d69696dcf00bc921eef768c8feadfdc3f22b
Instruction ID: fd2e110893651dd2a28e9bd10e6b886840c2e7c85cc3055bf5c0b72db3aa0c59
Opcode Fuzzy Hash: 2d6a2a72cdf5eb986edfa5a2e810d69696dcf00bc921eef768c8feadfdc3f22b
Instruction Fuzzy Hash: EEE1E874E001198FCB14DFA9C5849AEFBF2BF89305F2481AAD414AB356DB31AD42CF64

Uniqueness

Uniqueness Score: -1.00%

Function 085B3B70 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83932c368234c41228c602fc5d3107f448e503e8718ffee83b750bf40c1fae85
Instruction ID: ee3795fdd3f81490cf554460d9365e0c64622d179a7cb237c4c1348dc3260c25
Opcode Fuzzy Hash: 83932c368234c41228c602fc5d3107f448e503e8718ffee83b750bf40c1fae85
Instruction Fuzzy Hash: 86D1E431920B5A8ECB10EBA4D950A9DB7B1FF95300F20C79AD00937665FB706AC9CF91

Uniqueness

Uniqueness Score: -1.00%

Function 085B3B80 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f81348055aec88659e6cd9547c7439cd489b556b7c1c50598d2cdc5fc81c7e71
Instruction ID: a9f07237447363c94b12a7c9a157e6c1564356d49286bf32584a30c0ccc7991b
Opcode Fuzzy Hash: f81348055aec88659e6cd9547c7439cd489b556b7c1c50598d2cdc5fc81c7e71
Instruction Fuzzy Hash: A2D1D43192075A8ECB00EBA4D950A9DB7B5FF95300F20C79AD40937665FB706AC9CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0122D59C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691074941.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1220000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 748cd585175baa53848eacd9474d14fc6ed92a9ed5a3b434ae784e5e6c24448c
Instruction ID: 52343a95967a108cf508e1478f6f4b7e7020179ded717e58ddf6023ab63dae56
Opcode Fuzzy Hash: 748cd585175baa53848eacd9474d14fc6ed92a9ed5a3b434ae784e5e6c24448c
Instruction Fuzzy Hash: 2EA1B632E1021ADFCF15DFB4CA448EEB7B2FF85300B25856AE901AB265DB71D916CB40

Uniqueness

Uniqueness Score: -1.00%

Function 085BC3C2 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 283dcca60c300f745fe05273027fffbf79e9f4195be9bfcf27131240b39ddc8b
Instruction ID: 5bdf67151387422c1a6ed95f879806eba681cf8809f74d080147b13f5a2df575
Opcode Fuzzy Hash: 283dcca60c300f745fe05273027fffbf79e9f4195be9bfcf27131240b39ddc8b
Instruction Fuzzy Hash: F4512874E002198FCB14CFA9C9845AEFBF2BF89305F24C1AAD418AB256D7319D42CF65

Uniqueness

Uniqueness Score: -1.00%

Function 085BE890 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbdf78e535ddaf7cf7980773cf3def8971d5a31f875b96aa2c26f35affc634b5
Instruction ID: 4f867f96cb03a3e9dcdf1f5d2290d03121ac585c3417cb39f55dfc2f87ac2bfc
Opcode Fuzzy Hash: dbdf78e535ddaf7cf7980773cf3def8971d5a31f875b96aa2c26f35affc634b5
Instruction Fuzzy Hash: 9551F674E002198BDB14DFA9C5855EEFBF2BF89305F24C1AAD418A7256DB309942CF61

Uniqueness

Uniqueness Score: -1.00%

Function 085BDEE0 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1696773832.00000000085B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85b0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7933731d37296c9df23a3a49a6b7cbb45ceed828c50efe3cb35416ffb97942b7
Instruction ID: 49efcc656aae7827663f10ddb74d3459e25a1c4f816970b3b5789576b12490d6
Opcode Fuzzy Hash: 7933731d37296c9df23a3a49a6b7cbb45ceed828c50efe3cb35416ffb97942b7
Instruction Fuzzy Hash: 4551FC74E002198FDB14CFA9C5855EEFBF2BF89305F24C1AAD418A7216D7319941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 04B902C1 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694064151.0000000004B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b90000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6f3ed291a28b9864497e417f28e93c333272d7342b2b6907f07e828067be56c
Instruction ID: 85fe3f2091bf00fd1048656f35af744706c266b1b84d3a1694c2ce2bed2027b0
Opcode Fuzzy Hash: e6f3ed291a28b9864497e417f28e93c333272d7342b2b6907f07e828067be56c
Instruction Fuzzy Hash: 7E31DA71E456298BEB28DF6688047EDBBF6AFC9300F14C1FAC41DA6255EB341A859E00

Uniqueness

Uniqueness Score: -1.00%

Function 04B90469 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694064151.0000000004B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b90000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eb88a5fe12e0aa014770df7fe6378f131611b15f3c75aa56a784c486fe1c052
Instruction ID: 51392258b4744f215bed424e3b62a0ef870179d57282eeb579f90844c8fd705e
Opcode Fuzzy Hash: 6eb88a5fe12e0aa014770df7fe6378f131611b15f3c75aa56a784c486fe1c052
Instruction Fuzzy Hash: 4011BF74909668CFCB24EF28D9447E8BBF5EB4A302F0094EAD40AA2252E7305E84DF10

Uniqueness

Uniqueness Score: -1.00%

Function 04B9061A Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694064151.0000000004B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b90000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d34746a185164a48f46eeb84d463e1a8666881d1741fa19ac6c8da5d30c830d
Instruction ID: 6d41ad258ca21c0dfa1d0e89500a50a5eca47b26d1565cd74fe5a174289b3426
Opcode Fuzzy Hash: 9d34746a185164a48f46eeb84d463e1a8666881d1741fa19ac6c8da5d30c830d
Instruction Fuzzy Hash: B3F01774A09645DFCB10EF94D4885F8BBF8EB4B311B0450FAD40A97213E7306955EB15

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Quote.exePID: 6208, Parent PID: 6904COMMON

Execution Graph

Execution Coverage:	12%
Dynamic/Decrypted Code Coverage:	96.6%
Signature Coverage:	0%
Total number of Nodes:	117
Total number of Limit Nodes:	12

Executed Functions

Function 011D9C00 Relevance: 2.8, Instructions: 2772COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf57cca1d756100e936a358b4c006b48758b792227483c9ab5d37c2d2c4be47
Instruction ID: 02151914e71a391a60cd26baa0aceab89b4483285e33566494837a965f7eb791
Opcode Fuzzy Hash: 5cf57cca1d756100e936a358b4c006b48758b792227483c9ab5d37c2d2c4be47
Instruction Fuzzy Hash: 1953F831D10B1A8ADB15EF68C8846A9F7B1FF99300F15D79AE45867121FB70AAC4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 011DCF60 Relevance: 2.3, Instructions: 2324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1997495627420b4dce315fa8e0679f99696f1fa95d2517d1ed7ef25548c66fcc
Instruction ID: 102bffdd484622422054c351298016e2c038559b75692a77ad5a1d4dbe86043a
Opcode Fuzzy Hash: 1997495627420b4dce315fa8e0679f99696f1fa95d2517d1ed7ef25548c66fcc
Instruction Fuzzy Hash: 1F333F31D1071A8ECB15DF68C8906ADF7B1FF99300F15C79AE459AB211EB70AAC5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 011D3E80 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\Vl, xrefs: 011D40CB

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: 97db795f1514c5d6505c074ffba07f3d14a37e1fde6bf1b2626157e832d38587
Instruction ID: 8ffbab87fb42fad324071ef336dde7b33e5749b7cb5ed92f3b9c4f580579b089
Opcode Fuzzy Hash: 97db795f1514c5d6505c074ffba07f3d14a37e1fde6bf1b2626157e832d38587
Instruction Fuzzy Hash: D9916FB0E10209CFDF18CFA9C9957DEBBF2BF48314F148529E415A7654EB749846CB82

Uniqueness

Uniqueness Score: -1.00%

Function 011D4A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8948e98e007f47621538d40a21d3e4516f3b347e8ca27b621429315ecd13b46
Instruction ID: c1ccdd3ff40036657f0df78f4df44ee76f26a52b479933f97b7dd3c03d489500
Opcode Fuzzy Hash: b8948e98e007f47621538d40a21d3e4516f3b347e8ca27b621429315ecd13b46
Instruction Fuzzy Hash: DAB18070E006098FDF18CFA9C8917EDBBF2AF98314F148529D819E7B54EB749845CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0125286C Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 012528EE
GetCurrentThread.KERNEL32 ref: 0125292B
GetCurrentProcess.KERNEL32 ref: 01252968
GetCurrentThreadId.KERNEL32 ref: 012529C1

Memory Dump Source

Source File: 00000002.00000002.2879009682.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_Quote.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f068256a6b02c5f9dd999c05bf19e4ab0e1c36d67508e13433c07b40d0734410
Instruction ID: df39593415c66c67687674d06bdd44d2a5c6e2855f5cc0fb07e02899d32d8d9b
Opcode Fuzzy Hash: f068256a6b02c5f9dd999c05bf19e4ab0e1c36d67508e13433c07b40d0734410
Instruction Fuzzy Hash: BC5154B4910249CFDB58DFA9D588BDEBBF1EF88314F208419E459A73A0D7349884CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01252870 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 012528EE
GetCurrentThread.KERNEL32 ref: 0125292B
GetCurrentProcess.KERNEL32 ref: 01252968
GetCurrentThreadId.KERNEL32 ref: 012529C1

Memory Dump Source

Source File: 00000002.00000002.2879009682.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_Quote.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 059753e4d19937efcb6363b2f074eddb47f804b242ef2cbce865f35d569ec290
Instruction ID: b04e45eb04eafab959b785e3e6ae469d71a3b737529ddbadf1d4df56e772e4f7
Opcode Fuzzy Hash: 059753e4d19937efcb6363b2f074eddb47f804b242ef2cbce865f35d569ec290
Instruction Fuzzy Hash: 595156B4910249CFDB58DFA9D588B9EBBF1EF88314F208419E459A73A0D7349884CF65

Uniqueness

Uniqueness Score: -1.00%

Function 011D4810 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Vl, xrefs: 011D487F
\Vl, xrefs: 011D49D2

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID: \Vl$\Vl
API String ID: 0-415357090
Opcode ID: 716f4c2e8e36228b1759570da91aa85bfd3866cefb246790820108c97a88be4b
Instruction ID: fe0dba940af2393bf4be13f1438bdacfbc7318f4e46ba2cf9f6486810434cb98
Opcode Fuzzy Hash: 716f4c2e8e36228b1759570da91aa85bfd3866cefb246790820108c97a88be4b
Instruction Fuzzy Hash: FF714FB0E00249CFDF18CFA9C9857DDBBF2AF48314F148129E419A7A54EB749846CB96

Uniqueness

Uniqueness Score: -1.00%

Function 011D4804 Relevance: 2.7, Strings: 2, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Vl, xrefs: 011D487F
\Vl, xrefs: 011D49D2

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID: \Vl$\Vl
API String ID: 0-415357090
Opcode ID: 63cd4e7d752a6b8996600524f77d1742e23f80f0e9d3b78f0e1482d804c86f27
Instruction ID: a1d29281cb5980efcf0b8f00b9eea6c727de10db2c1b5abff2caf3d691bfc3b5
Opcode Fuzzy Hash: 63cd4e7d752a6b8996600524f77d1742e23f80f0e9d3b78f0e1482d804c86f27
Instruction Fuzzy Hash: 90715AB0E00249CFDF18CFA9C9857DEBBF1BF48314F148129E419A7A54EB749846CB96

Uniqueness

Uniqueness Score: -1.00%

Function 011D6EDB Relevance: 2.6, Strings: 2, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR^q, xrefs: 011D6F93
LR^q, xrefs: 011D6F0E

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID: LR^q$LR^q
API String ID: 0-4089051495
Opcode ID: 5eadba02da2db91d3a12c39b65a2757d9e8074d63c92414fbcf8d88c2c3d7991
Instruction ID: 95acf464559ae2b8fb05f13c485a004a5cc11ec01dbbf97d7056650406ca7023
Opcode Fuzzy Hash: 5eadba02da2db91d3a12c39b65a2757d9e8074d63c92414fbcf8d88c2c3d7991
Instruction Fuzzy Hash: F351D530F006559FDB1ADF78C4507AEBBB2EF86304F14856AE405EB291DB719C46CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0125AC78 Relevance: 1.7, APIs: 1, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0125AEDE

Memory Dump Source

Source File: 00000002.00000002.2879009682.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_Quote.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f889ee1e98423a077762019c925a525f538880cd423d11ee8b9247b335e34fb3
Instruction ID: 31a717111333395bc8a9074ecbcf208db48bb211588e43550bca3d553cd7aaa0
Opcode Fuzzy Hash: f889ee1e98423a077762019c925a525f538880cd423d11ee8b9247b335e34fb3
Instruction Fuzzy Hash: FA813670A10B068FDB65DF29D0857AABBF1FF88304F008A2DD98AD7A50D775E945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0125D225 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0125D382

Memory Dump Source

Source File: 00000002.00000002.2879009682.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_Quote.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 576262e44e8b20006d130ac0397b3b4151783d4417d9124beb288c68d12abf5e
Instruction ID: 21dabf5a01828af9c45f7f4ade7b530d25adf817b7aedd98f4e8164193f8e3aa
Opcode Fuzzy Hash: 576262e44e8b20006d130ac0397b3b4151783d4417d9124beb288c68d12abf5e
Instruction Fuzzy Hash: 25510EB1C10349AFDF15CFA9C884ADEBFB1BF49314F24816AE908AB221D7719881CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0125D264 Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0125D382

Memory Dump Source

Source File: 00000002.00000002.2879009682.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_Quote.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: bb0858680059a5bcfef6e6d64e0e15d522e21becd564d136c47fec5c40397b81
Instruction ID: e419f7c642677bc4af1c3eab84f2902bfb06aaf778a0f78a3ada5f45d122fe52
Opcode Fuzzy Hash: bb0858680059a5bcfef6e6d64e0e15d522e21becd564d136c47fec5c40397b81
Instruction Fuzzy Hash: 9051C0B1D10349DFDB14CFAAC884ADEBFB5BF48310F24852AE819AB251D7719885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0125D270 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0125D382

Memory Dump Source

Source File: 00000002.00000002.2879009682.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_Quote.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ed66cc810da6a6cce43be6c02e8db1122443a5dfe235e256ed96335a0eab7999
Instruction ID: e27bf472218439c90291653416d5db6df22263306e738030a22d94e3dfc4ea70
Opcode Fuzzy Hash: ed66cc810da6a6cce43be6c02e8db1122443a5dfe235e256ed96335a0eab7999
Instruction Fuzzy Hash: DC41D2B1D103499FDB14CFAAC884ADEBBB5BF48310F24852AE819AB211D7709881CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0125C7B4 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0125F8F1

Memory Dump Source

Source File: 00000002.00000002.2879009682.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_Quote.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 6b92ab43a55cc4d8d25aff053d00fd46c087539d27548a6f70802ed4549398f3
Instruction ID: b059428665c69f56a33341642bef634fc8d82452c15671f74847902152417643
Opcode Fuzzy Hash: 6b92ab43a55cc4d8d25aff053d00fd46c087539d27548a6f70802ed4549398f3
Instruction Fuzzy Hash: 8F4138B4A10309DFDB54CF99C588AAAFBF5FB88314F24C459D919AB321D770A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01252AB0 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01252B3F

Memory Dump Source

Source File: 00000002.00000002.2879009682.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_Quote.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5ec918e4d6c3c11e2a6b34b4412a5ae5b8e81be64705b7ac2bb1711651892e6c
Instruction ID: 059665ee7ee27f10f94e5685c546f9143b858f5c3e85bfc4dc18195b69976f37
Opcode Fuzzy Hash: 5ec918e4d6c3c11e2a6b34b4412a5ae5b8e81be64705b7ac2bb1711651892e6c
Instruction Fuzzy Hash: D621E3B5D10248DFDB10CFA9D584AEEFBF8EB48310F14841AE958A7350D374A940CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01252AB8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01252B3F

Memory Dump Source

Source File: 00000002.00000002.2879009682.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_Quote.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 81c67807b67068d8a86a0a6b7f69902d28a28148e9357e57d49f4824fa78d3f2
Instruction ID: c3aa3ebeb9064aaab0836065db56b3b26f727f82b74caed4c6ea52ce8e9176bc
Opcode Fuzzy Hash: 81c67807b67068d8a86a0a6b7f69902d28a28148e9357e57d49f4824fa78d3f2
Instruction Fuzzy Hash: 2421E2B5900248DFDB10CFAAD984ADEFFF8EB48320F14841AE918A7350D374A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01259C00 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0125AF59,00000800,00000000,00000000), ref: 0125B14A

Memory Dump Source

Source File: 00000002.00000002.2879009682.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_Quote.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4c108f8f21bdb21b7814b1ff1ce86d101dba8eca955d06b22f99f825e6810f95
Instruction ID: d165ba18ea4dcbd40f2a37546986f9b15e129a5055334ceeb77fde5422d83143
Opcode Fuzzy Hash: 4c108f8f21bdb21b7814b1ff1ce86d101dba8eca955d06b22f99f825e6810f95
Instruction Fuzzy Hash: 5E1117B69103098FDB50CF9AC884BDEFBF5EB48310F10842AE919A7210C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0125B0DE Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0125AF59,00000800,00000000,00000000), ref: 0125B14A

Memory Dump Source

Source File: 00000002.00000002.2879009682.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_Quote.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6885fac47203bca3436010880b9836e99b843cc8399a03268bc121740e62784c
Instruction ID: ee8e790ed70c022031aec17315511492fb0efaf303c01bc28ba63f54b36e1962
Opcode Fuzzy Hash: 6885fac47203bca3436010880b9836e99b843cc8399a03268bc121740e62784c
Instruction Fuzzy Hash: 8811F6B6D003498FDB54CFAAD484AEEFBF5EB88310F10842ED919A7610C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0125AE78 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0125AEDE

Memory Dump Source

Source File: 00000002.00000002.2879009682.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_Quote.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f9544b1bc4d206b2daf462daf4c5aa5ee2bcd87a6aa9329fe31f926dff93bcd3
Instruction ID: 69be79e05ce4c5ea2094987b6c767173103d7a7fa64df46af726aeb50ff10f17
Opcode Fuzzy Hash: f9544b1bc4d206b2daf462daf4c5aa5ee2bcd87a6aa9329fe31f926dff93bcd3
Instruction Fuzzy Hash: 971110B6D002498FDB10CF9AC444ADEFBF4EB88324F10852AD929A7210C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 011D3E75 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

\Vl, xrefs: 011D40CB

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: e37b568273039d5f27ab3bf9969a31d80de0ff914aa6e74487562531bfa74229
Instruction ID: bd7b641e2ad83af00540ae2f8a803bd6146f42d4590b2d74f54cc9393892374e
Opcode Fuzzy Hash: e37b568273039d5f27ab3bf9969a31d80de0ff914aa6e74487562531bfa74229
Instruction Fuzzy Hash: 5D917DB0E10209CFDF18CFA9C9857DEBBF1BF48314F148129E459A7654EB749846CB92

Uniqueness

Uniqueness Score: -1.00%

Function 011DF3C5 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

PH^q, xrefs: 011DF513

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 4fe31d25f41f3e65ca26a5a0c0436bf8c7fd2bdb5d545859b8a4789bd25eee8b
Instruction ID: f08cb63640f8d6fe9ace81e9badc649c679b0a122a243a9923ba9f6326d5f72a
Opcode Fuzzy Hash: 4fe31d25f41f3e65ca26a5a0c0436bf8c7fd2bdb5d545859b8a4789bd25eee8b
Instruction Fuzzy Hash: 633100307002028FDB0A9B78D5642AE7BE2EF89214F244579D006DB399EF35DE47C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 011D6F78 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

LR^q, xrefs: 011D6F93

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 761e57e264cc3ea218f3cc05145cad0f2d46274345a798830c00a458af6b5445
Instruction ID: 4f4e6a548875b79fd85d8c0902804d8b9c44b29fae774311c57b5b2bffa6f935
Opcode Fuzzy Hash: 761e57e264cc3ea218f3cc05145cad0f2d46274345a798830c00a458af6b5445
Instruction Fuzzy Hash: 37318074E002199FDF1EDFA8C45479EB7B2FF85304F508569E905EB280EB71A846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 011D6BAF Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

LR^q, xrefs: 011D6BD7

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 6a312e6fbd74165001cae1e160309c472b042daceb9bd397a66e3884e5872fdf
Instruction ID: 227f8444ba7f8c10d0641b7d40f7e6b466e7f412c6a9714b3c03ed66e37312cf
Opcode Fuzzy Hash: 6a312e6fbd74165001cae1e160309c472b042daceb9bd397a66e3884e5872fdf
Instruction Fuzzy Hash: 072124307042515FCB0AAB3DA0946AE7BA2EFC6214F1449AAD049CB35ADF298C46C795

Uniqueness

Uniqueness Score: -1.00%

Function 011D792F Relevance: .6, Instructions: 550COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ae684422df7adb140f8d3c68aeb46422fac4ea5743fbdaf2cb051512e911ffc
Instruction ID: 2d143ac37f5a0532a7cea9742aaabee5862710216429008ae58eb8fa4687000c
Opcode Fuzzy Hash: 7ae684422df7adb140f8d3c68aeb46422fac4ea5743fbdaf2cb051512e911ffc
Instruction Fuzzy Hash: EB125E307106028FDB5AAB3CE49422DB2A2FBC5219B204E3DD115CB7E9DF75EC869785

Uniqueness

Uniqueness Score: -1.00%

Function 011D96F8 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b97aad5aa0643d8a134ba8a91686b7cdc719199a8bcbc4df9ed8ee9f72b80b9
Instruction ID: ae7275ff832c652600d723d5a9b84646361c4cbf3bcfee95c9e5627ff474517b
Opcode Fuzzy Hash: 7b97aad5aa0643d8a134ba8a91686b7cdc719199a8bcbc4df9ed8ee9f72b80b9
Instruction Fuzzy Hash: FFC19F75A002098FDB18DFACD9807AEBBB5FF88318F10856AE509EB395D770D845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 011D937C Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44017b21dd060bd05c30ca1a5a26f93142dae2de45b1a1d81f514558e80f9ef3
Instruction ID: 333651f8cdc2eb46a7dc22b5c1d5239d3890e0f928ecd29721a8a036013d57c0
Opcode Fuzzy Hash: 44017b21dd060bd05c30ca1a5a26f93142dae2de45b1a1d81f514558e80f9ef3
Instruction Fuzzy Hash: 1FB18F35A002088FDB09DF68D594AADBBB2FF88314F148469E906E73A5DB31EC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 011D4A97 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c812acbacca1c20645d70fad364548ef18f90cebe72decceb17811914f51b47
Instruction ID: bfd4d3746e3f4901db452db119206685053626ac60771d959c9e362cf822fa1b
Opcode Fuzzy Hash: 3c812acbacca1c20645d70fad364548ef18f90cebe72decceb17811914f51b47
Instruction Fuzzy Hash: 3DA18D70E006098FDF18CFA8D8957EDBBF1AF58314F148129E858EBA54EB749885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 011D6CE8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0727d357b1da8daeaf547d23cc719926cf9675a73462d1598dce62bc3431f8e1
Instruction ID: deac2ab440cbd442c92ca94f6e1988730f69161d3f71a8bbf2d50b84021d58d2
Opcode Fuzzy Hash: 0727d357b1da8daeaf547d23cc719926cf9675a73462d1598dce62bc3431f8e1
Instruction Fuzzy Hash: F6513571E002288FDB18CFA9C884B9DBBB1BF48314F14811AE859BB355D774A841CF96

Uniqueness

Uniqueness Score: -1.00%

Function 011D6CE7 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98f0700fc4d1e8c05b3f8f77491272be24035cff9ad329e9a8bc062e0914e1f4
Instruction ID: 4aad9a9a1348c1260f9e2aebbde66cb5d4a6e3d3de16ee97dc2c92b94feb07c3
Opcode Fuzzy Hash: 98f0700fc4d1e8c05b3f8f77491272be24035cff9ad329e9a8bc062e0914e1f4
Instruction Fuzzy Hash: CC510471E002288FDB18CFA9D888BDDBBB1BF48314F14812AE859BB355D774A845CF95

Uniqueness

Uniqueness Score: -1.00%

Function 011D112B Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f284c1ae0ac7f174d8e428e48ba9f1f39088e867accfbfb42e00c4d67a2b2245
Instruction ID: 897e17b5ae607a0cc01f9c053dfde7506c85fd2f5b421a42e17d4e3eb8c264b9
Opcode Fuzzy Hash: f284c1ae0ac7f174d8e428e48ba9f1f39088e867accfbfb42e00c4d67a2b2245
Instruction Fuzzy Hash: 70511A39605A628FCB1AEB6EF990A447FB1F7967053008B79D1005B73EEB20798DDB50

Uniqueness

Uniqueness Score: -1.00%

Function 011D1138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b247ba952083d8464fd38b5b1c0935c0d5c158b4fa91bb3e6b494a4c83e903cb
Instruction ID: 734aae478764bd50ef017a8cc02a39832d4c08610e44d72867e30d1cf55afbdc
Opcode Fuzzy Hash: b247ba952083d8464fd38b5b1c0935c0d5c158b4fa91bb3e6b494a4c83e903cb
Instruction Fuzzy Hash: 5351FC38605A628FCB1AFB6EF9909457BB1F7967053004B78D1005B73DEB20798DDB90

Uniqueness

Uniqueness Score: -1.00%

Function 011DF288 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6acc62710a4f04d7b71b0118c0802cc5ade21f9f8523464da4d93c93ebec9cc
Instruction ID: 10484e88114dacf00aae7d4798fa92151a765aac59cc0984439c81bd736e5345
Opcode Fuzzy Hash: b6acc62710a4f04d7b71b0118c0802cc5ade21f9f8523464da4d93c93ebec9cc
Instruction Fuzzy Hash: 8A319E35E10606ABDB09CFA9D89469EB7F2BF89300F148519E80AEB344DF70E947CB50

Uniqueness

Uniqueness Score: -1.00%

Function 011D5098 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 925395682f579138558498e176f187f8125a83ed5bbac6a3b2081d958b62c51e
Instruction ID: 2e96016869b800aa1e0321289eb63a5dc731555e284b79aa577d2cad514a06aa
Opcode Fuzzy Hash: 925395682f579138558498e176f187f8125a83ed5bbac6a3b2081d958b62c51e
Instruction Fuzzy Hash: D2317C30700256CFDB6DEB78C5506ED77B2AF4A244F200568D901EB395DB36AD0ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 011DF298 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 319b14a07ed31da849a727c5f45d6f24acc20263da2de447892cf59253cb7da0
Instruction ID: 6c27c15b769df3e4e1f2b3465f59107aea8f65f3af7bed312939e1099cd58585
Opcode Fuzzy Hash: 319b14a07ed31da849a727c5f45d6f24acc20263da2de447892cf59253cb7da0
Instruction Fuzzy Hash: AD318035E1060AABDB19CFA9D49469EB7B2FF89300F148519E80AE7344DF70AD47CB50

Uniqueness

Uniqueness Score: -1.00%

Function 011D26E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aacb9ec36fbefedaeb302c3198489e7e85a515c11580f3b4de0bcf92207accd
Instruction ID: 0d0ea3b8ab6127369d9d571b765c04c8b71f8c62e97422ba25156a9e7cba0cea
Opcode Fuzzy Hash: 4aacb9ec36fbefedaeb302c3198489e7e85a515c11580f3b4de0bcf92207accd
Instruction Fuzzy Hash: 6841EDB0D002499FDB14DFA9C584ADEBFF5FF48310F24842AE819AB254DB75A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 011D26E7 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcb15b809fbd28e052af61b81b327e1ffe4a6153d01a7773d835fe0b6488343f
Instruction ID: 5bbe2a8899be0a4d954f523947ddb048706c849b63613798bc963dc45382c8be
Opcode Fuzzy Hash: dcb15b809fbd28e052af61b81b327e1ffe4a6153d01a7773d835fe0b6488343f
Instruction Fuzzy Hash: AD41EEB0D002499FDB14CFA9C584ADEBFF5FF48310F24842AE819AB254DB759946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 011D50A8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b7592665cca1cae627aedcf6f9035d00951c8eefeacab243520078edb8141b
Instruction ID: 71a31b0bd7cb6799a2684e2a1f3a2ca3104e307f319c24b539c587c37115a91b
Opcode Fuzzy Hash: 08b7592665cca1cae627aedcf6f9035d00951c8eefeacab243520078edb8141b
Instruction Fuzzy Hash: 03316B30B00216CFDB5DEB79C5506AE77F2AF89244F200568D901EB3A5DB36EC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 011D9269 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62035fcd0dc4a992b0328a4fad5e4a172675706f42fa6c76e9bd60b2a7abdad5
Instruction ID: aed511a29bb884c9d47208781b93bcdfc06c8ec0a2e8d9406b68ed344326833a
Opcode Fuzzy Hash: 62035fcd0dc4a992b0328a4fad5e4a172675706f42fa6c76e9bd60b2a7abdad5
Instruction Fuzzy Hash: 6231D931E0064A9BDF09CFA9D48069EF7B2FF85304F148619E405EB385DB709845CB50

Uniqueness

Uniqueness Score: -1.00%

Function 011D9278 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d58fa70e51bb3aa2d2f75462c8707d2d25186e65d035ba6824e1befcbee2ac
Instruction ID: 263f3fc7ad31f00962832b8763040eb1ced48e067a5329097e38da2c52066729
Opcode Fuzzy Hash: 33d58fa70e51bb3aa2d2f75462c8707d2d25186e65d035ba6824e1befcbee2ac
Instruction Fuzzy Hash: CD21A331E0064A9BDF09CFA9D48469EF7B2FF89304F148619E805EB385DB70E846CB90

Uniqueness

Uniqueness Score: -1.00%

Function 011D16A3 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8411f7fb07a65bc61524325e2a696263e833ef1d404dcfa9a187d98c653fb0a
Instruction ID: 649a8c36f0f3827f55fd5c35b34fdefc8fff3d7e6e041b5ab36107069a4724f8
Opcode Fuzzy Hash: c8411f7fb07a65bc61524325e2a696263e833ef1d404dcfa9a187d98c653fb0a
Instruction Fuzzy Hash: EE21F8386005116FDF1BEB2CE9847697762EB45304F010B31D105C736AEB64E885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 011D17C0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a0d634d92c33ceeaf7e0d4107a3618d1ab3ccb8fced907117e157e6c84d2daa
Instruction ID: 4078bcc88cf0b5bcfcae056dbfb0454a8d604e84e6ea9c37dc0d0df213691174
Opcode Fuzzy Hash: 8a0d634d92c33ceeaf7e0d4107a3618d1ab3ccb8fced907117e157e6c84d2daa
Instruction Fuzzy Hash: 68215B32F04B52AFCF13AB78980869E7FB1AB46120F150A66DA45D7342EB348845C791

Uniqueness

Uniqueness Score: -1.00%

Function 011D9169 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15e24a9b1141910513ad8abe1f942263f0a9278d6b786d15f740b9b57fa5bc66
Instruction ID: 0b54414664fc0754cb3547272efc8d606e8363cf06b66169b927be9ce1ac7eee
Opcode Fuzzy Hash: 15e24a9b1141910513ad8abe1f942263f0a9278d6b786d15f740b9b57fa5bc66
Instruction Fuzzy Hash: A421A131E002099BDB1DCFA8D85469EFBB2BF89314F14861AEC15BB341DB70E846CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0114D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878620013.000000000114D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0114D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_114d000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3960eb2be26654d5f9e1358f2440c8148cd1ea90cba48a41692507475637813
Instruction ID: c37788a01cc7751d2f6273b454a60d68bca90301cac5c00b2fbcdbf0823910c4
Opcode Fuzzy Hash: c3960eb2be26654d5f9e1358f2440c8148cd1ea90cba48a41692507475637813
Instruction Fuzzy Hash: D7212271604200DFCF19DF98E984B26BFA5EB94B14F20C5ADD80A4B256C33AD447CA62

Uniqueness

Uniqueness Score: -1.00%

Function 011D1878 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 387ca15dc11c764f0633a52b1e94039597a32a7b60fc699c4fabf516a78c339e
Instruction ID: b599c2818e3dcbaf83557c5d9539ef69b41c615887e7583a25865f4fa9e3a48b
Opcode Fuzzy Hash: 387ca15dc11c764f0633a52b1e94039597a32a7b60fc699c4fabf516a78c339e
Instruction Fuzzy Hash: F3218C30B00256DFEF1DEB78C5157AE77B2AF4A204F2004ACD505EB695EB359D40CB61

Uniqueness

Uniqueness Score: -1.00%

Function 011D4F89 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 688fc62cb993504d578b2883d4a002a203e6bf557ca5cf4f6f9bc18388792b55
Instruction ID: 57b977adc7372d81740af6d2f12f9b8101d78cc4bb2b3dd4a9be85c0af306421
Opcode Fuzzy Hash: 688fc62cb993504d578b2883d4a002a203e6bf557ca5cf4f6f9bc18388792b55
Instruction Fuzzy Hash: FA217A30700205CFCB68EB78C558AAD7BF2AF8D344B2005A8E506EB7A5DB369D01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 011D9178 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1da7bf674036e2043c1ef2ff04665474b8f7b06cb03aaeae1f9421c4e65111e
Instruction ID: 89e0d913f462b146ad7c18e64f32703b96b2cfd34c8ffe3c88511cecfaefb724
Opcode Fuzzy Hash: d1da7bf674036e2043c1ef2ff04665474b8f7b06cb03aaeae1f9421c4e65111e
Instruction Fuzzy Hash: 86215031E0060A9BCB1DCFA8C45459EF7B6BF89314F10851AEC15BB341DB70E846CB51

Uniqueness

Uniqueness Score: -1.00%

Function 011D1888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085bb55d2c30269e1f9b5df5270386346d8ce24291395c7586bd21f24f700b76
Instruction ID: b457eb450c9fdb452409f737b8d714ad44e643f04063661abc516cb9fb4213e6
Opcode Fuzzy Hash: 085bb55d2c30269e1f9b5df5270386346d8ce24291395c7586bd21f24f700b76
Instruction Fuzzy Hash: E1215730B00216DFDB1CEB79C5157AE77F2AB89205F200468D506EB3A5EB36DD40CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 011D16B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 194bca47a03cc1aa8983aec1f77869a5987214ec1b7798a145b67b01ff42f385
Instruction ID: 328bb010c8ca6c4f1740ef28c1e7d45fba91c76adf5fedac8756345ab83dd5a2
Opcode Fuzzy Hash: 194bca47a03cc1aa8983aec1f77869a5987214ec1b7798a145b67b01ff42f385
Instruction Fuzzy Hash: 0321DF386009116FDF2AEB2DE9847597766EB45304F014B35D10ACB3AAEB60E8898B81

Uniqueness

Uniqueness Score: -1.00%

Function 011D4F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eac5d787b167208fe2c45ddcedb5cb9009eebbaeeb91e20c1b284e341e8665a5
Instruction ID: b5c4dc15103371baf7ff2ada89d7d815c2577ef08632995027602c7b7bc5da97
Opcode Fuzzy Hash: eac5d787b167208fe2c45ddcedb5cb9009eebbaeeb91e20c1b284e341e8665a5
Instruction Fuzzy Hash: 85211A30700215CFDB58EB79C558AAE7BF2AF8D344F204468E506EB3A5DB36AD40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 011D138F Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b67c3de6b04a5e138565b78efbf364f92b72880454c6affb96ec0d82b10d3bc9
Instruction ID: df4e8ab3227b2d06fc6fdab488fccd5e9f851eb17802ea3a3cf784c48dcff7e5
Opcode Fuzzy Hash: b67c3de6b04a5e138565b78efbf364f92b72880454c6affb96ec0d82b10d3bc9
Instruction Fuzzy Hash: 0F219074A44250AFEF7A673CE48436C7661E741325F100A2AD60BCB785DB288C89C741

Uniqueness

Uniqueness Score: -1.00%

Function 0114D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878620013.000000000114D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0114D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_114d000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b4918c435dcbe34b85352626e34210730f554533ff580960d0ffbd01f16abc
Instruction ID: cddce4609e38f615e84248b48a1170e9eae514333594512efa133c72df558454
Opcode Fuzzy Hash: 17b4918c435dcbe34b85352626e34210730f554533ff580960d0ffbd01f16abc
Instruction Fuzzy Hash: 5E219F755083809FCF07CF64D994B11BF71EB56614F28C5EAD8498F2A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 011D0838 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e867d77262609a1ea5f04773e34e1e492c97553e8a9401a4a8244e4b60ad22c0
Instruction ID: 46fe09cb249db8fb4ae786d14728cc861d26960be36778f854c5943d94823333
Opcode Fuzzy Hash: e867d77262609a1ea5f04773e34e1e492c97553e8a9401a4a8244e4b60ad22c0
Instruction Fuzzy Hash: 7E11C130E042049FEF2E567D984136D7BA5EB4A210F114A7AE046DB282DB65DC818BD2

Uniqueness

Uniqueness Score: -1.00%

Function 011D0848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40e829a99892477b273d275db75ec5cb5a51bb77855b0ba98a6f406a9066807f
Instruction ID: c13c911a85fd9413305871f899ad1696dfd766f622a5ec49ed12ccaff70db48b
Opcode Fuzzy Hash: 40e829a99892477b273d275db75ec5cb5a51bb77855b0ba98a6f406a9066807f
Instruction Fuzzy Hash: 2A118F30F002148FDF5DAA7DD44532E76A5EB89214F218A3AE106CB356DB61DC858BD1

Uniqueness

Uniqueness Score: -1.00%

Function 011D1498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e31c0a2ee729cefd364c36ef9400d829caec63407851fe5df8c9068ec1c41c0
Instruction ID: 73cd46fd438a09254c9951c942beeefacc32731625f869367c1d6aaa03fd7d55
Opcode Fuzzy Hash: 4e31c0a2ee729cefd364c36ef9400d829caec63407851fe5df8c9068ec1c41c0
Instruction Fuzzy Hash: 9F015231A012159FCF29EFBC84541AEBBF5EF49214F2504BAE805E7301E735E9418BA1

Uniqueness

Uniqueness Score: -1.00%

Function 011D1497 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 492e187403673059ddb5dbc51474da4649e1c4d9bae05e06cbf543328701056b
Instruction ID: 490f4d106a7abcf8f90a5b2a71ca5dd0fc7025ae608f4c8bad1453005549da26
Opcode Fuzzy Hash: 492e187403673059ddb5dbc51474da4649e1c4d9bae05e06cbf543328701056b
Instruction Fuzzy Hash: 1D118031A002159FCF29EFB884901ADBBF1EF48214F2404BAE805E7301E736D842CB91

Uniqueness

Uniqueness Score: -1.00%

Function 011D7090 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d23adc482169cc6c13f156333d55ceb4e564f551e69add97bed20d01b0b7fb8a
Instruction ID: 3927b70854e19027e9dd8788560b29ee54cce53d91505842a82dbc6f8823e94f
Opcode Fuzzy Hash: d23adc482169cc6c13f156333d55ceb4e564f551e69add97bed20d01b0b7fb8a
Instruction Fuzzy Hash: E7014B39B40214CFD719DB74D458B6C37B2EF88319F1045A8E606CB3A4CB35AC42CB41

Uniqueness

Uniqueness Score: -1.00%

Function 011D1524 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a531fd2b37e394b9795b1a26b0681d6dedffb082e3314d67aaacb39f34b331ff
Instruction ID: aec13cf9e16cc89582eab711467f396b74407bbcbb9bae8f2d57b97f572fdbd6
Opcode Fuzzy Hash: a531fd2b37e394b9795b1a26b0681d6dedffb082e3314d67aaacb39f34b331ff
Instruction Fuzzy Hash: A1F05037A04210EFD72A8BE894901ADBF71EE6911175D00D7D406DB311D735E482C712

Uniqueness

Uniqueness Score: -1.00%

Function 011D8118 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30e25c04491a59bb9165f024135d1aee78df41ba44997233e96ddc884cdbea71
Instruction ID: 6a48839f670049982674074ec470b8624120ac2000f7ad0f9cf9ef2fec811412
Opcode Fuzzy Hash: 30e25c04491a59bb9165f024135d1aee78df41ba44997233e96ddc884cdbea71
Instruction Fuzzy Hash: 60F03C34910209AFCF05FBACE98199DBBB5EB80304F504679C0099B258EF317E498B82

Uniqueness

Uniqueness Score: -1.00%

Function 011D8117 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a72df69cfc1aa1da3df8903d64f242f65073ab31fe10de2592efefcbe8be32
Instruction ID: 79d3b79d3f7649229b2dc3944c1bffa728545807a5cefeee55b46a6647248dd2
Opcode Fuzzy Hash: 65a72df69cfc1aa1da3df8903d64f242f65073ab31fe10de2592efefcbe8be32
Instruction Fuzzy Hash: 88F03C34910109AFCF05EBBCE98199CBBB1EB80304F504679C0099B258EF316E4A8B81

Uniqueness

Uniqueness Score: -1.00%

Function 011D1487 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2878889114.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11d0000_Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d2d08603c65e7bc4a90138e497a307a158e117d4019f2e94d090544d3ace48b
Instruction ID: 7462d7a0386891cc38ef29af6625fd3a47eb23ddd7f200db32c71d856606e7b0
Opcode Fuzzy Hash: 6d2d08603c65e7bc4a90138e497a307a158e117d4019f2e94d090544d3ace48b
Instruction Fuzzy Hash: 72E0C22060C7C067EB375638E4553A9BB509B82130F0448AADCC5CA942DB048841C382

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Quote.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Quote.exe.log

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
Quote.exe

Function 0122D010 Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Function 0122D020 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 085BF017 Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Function 085BF020 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 0122AD88 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Function 0122590C Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Function 012244B0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 085BED90 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Function 085BED98 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 085BE7C0 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Function 085BEE80 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 085BE7C8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre