Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe
Analysis ID:	1428436
MD5:	ac38083ad80ab0bf6a26b827a73f87d4
SHA1:	59fc220585cb07d200779c2b99ec8113dedd1a5a
SHA256:	e17a068785f148d68c2fa2e6fd3e943e692da2ac9bee0c9f7a5ffe220035e26e
Tags:	exe
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Contains functionality to retrieve information about pressed keystrokes

PE file contains more sections than normal

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Classification

Analysis Advice

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample has functionality to log and monitor keystrokes, analyze it with the 'Simulates keyboard and window changes' cookbook

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe (PID: 7496 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe" MD5: AC38083AD80AB0BF6A26B827A73F87D4)

conhost.exe (PID: 7504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe

Code function: 0_2_00402C5C Sleep,GetAsyncKeyState,

0_2_00402C5C

Source: SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe

Static PE information: Number of sections : 16 > 10

Source: classification engine

Classification label: clean2.winEXE@2/0@0/0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe

Code function: 0_2_00401656 CreateToolhelp32Snapshot,strcmp,_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc,_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc,_ZNSolsEPFRSoS_E,exit,

0_2_00401656

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7504:120:WilError_03

Source: SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe	Section loaded: libgcc_s_sjlj-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe	Section loaded: libstdc++-6.dll	Jump to behavior

Source: SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe	Static PE information: section name: .xdata
Source: SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe	Static PE information: section name: /4
Source: SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe	Static PE information: section name: /19
Source: SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe	Static PE information: section name: /31
Source: SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe	Static PE information: section name: /45
Source: SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe	Static PE information: section name: /57
Source: SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe	Static PE information: section name: /70

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe	Code function: 0_2_00403420 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	0_2_00403420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe	Code function: 0_2_004048A1 SetUnhandledExceptionFilter,	0_2_004048A1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe	Code function: 0_2_0040C3E8 SetUnhandledExceptionFilter,Sleep,	0_2_0040C3E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe	Code function: 0_2_00401180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,_initterm,GetStartupInfoA,	0_2_00401180

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe

Code function: 0_2_00403340 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00403340

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Process Injection	11 Input Capture	1 System Time Discovery	Remote Services	11 Input Capture	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe	3%	ReversingLabs

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428436
Start date and time:	2024-04-18 23:31:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe
Detection:	CLEAN
Classification:	clean2.winEXE@2/0@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 21
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe, PID 7496 because there are no executed function
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	5.327228997724114
TrID:	Win64 Executable Console (202006/5) 92.64% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% VXD Driver (31/22) 0.01%
File name:	SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe
File size:	385'306 bytes
MD5:	ac38083ad80ab0bf6a26b827a73f87d4
SHA1:	59fc220585cb07d200779c2b99ec8113dedd1a5a
SHA256:	e17a068785f148d68c2fa2e6fd3e943e692da2ac9bee0c9f7a5ffe220035e26e
SHA512:	03d0491ba04d4a3e1380b89583227fc098710fe139b59a4c7c94e29489ae0832997ac42ffaff77cf2cb2ba7ff8359a531f2b4b21686f931404532efd79df5407
SSDEEP:	6144:PDWWy9TPBLZ6M0W3Iv/uMgPYHQHOgoq5oopMpPDxO3qG17php8S/IVw1cdDwLfW:Pk9TPBLZ6M0W3Iv/uMgPYHyOgoq5ojKu
TLSH:	0F84E781B668489AD341333BD99293A01739BECD5B96C383533CFDA63A139B35D4E9C4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....E!f..........'......V...z................@..............................`................ ............................

File Icon


Icon Hash:	2b2b6dc9e88e4d33

Static PE Info

General

Entrypoint:	0x4014e0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LARGE_ADDRESS_AWARE
DLL Characteristics:
Time Stamp:	0x662145C2 [Thu Apr 18 16:09:38 2024 UTC]
TLS Callbacks:	0x403550
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2997e474ec31171014384ac167c8f196

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00007155h]
mov dword ptr [eax], 00000000h
call 00007F6824F6751Fh
call 00007F6824F6535Ah
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax+00h]
nop word ptr [eax+eax+00000000h]
dec eax
sub esp, 28h
call 00007F6824F6895Ch
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F6824F656A9h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 20h
dec eax
lea edx, dword ptr [00006AB1h]
dec eax
mov ecx, dword ptr [00006F6Ah]
call 00007F6824F6736Ah
mov eax, 00000000h
dec eax
add esp, 20h
pop ebp
ret
push ebp
dec eax
sub esp, 00000160h
dec eax
lea ebp, dword ptr [esp+00000080h]
dec eax
mov dword ptr [ebp+000000F0h], ecx
mov edx, 00000000h
mov ecx, 00000002h
call 00007F6824F68A91h
dec eax
mov dword ptr [ebp+000000D0h], eax
mov dword ptr [ebp-60h], 00000130h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc000	0xd8c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf000	0x3f0f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x9000	0x8ac	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x8200	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc318	0x2a0	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x55d0	0x5600	16ce55d568fb2dde6c65c4dbcb7d74cc	False	0.3971656976744186	data	5.762934534157348	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x7000	0xd0	0x200	f3b6b510451c55e9d4c752057190f673	False	0.134765625	data	0.8172318696332888	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x8000	0x7cc	0x800	ebb9f94b3b11575840ca751fe5c3ca4c	False	0.46484375	Matlab v4 mat-file (little endian) 00MuchDevilish v.1.0 hack by BinaryRiper for Cuphead v1.3.2, numeric, rows 2, columns 0	4.44810177484071	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0x9000	0x8ac	0xa00	0d602b7b16808042bb0851349fa50d59	False	0.437890625	data	3.943657814384145	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0xa000	0xadc	0xc00	6de6452925c5b8a224887412e067d840	False	0.205078125	data	4.43728339972844	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0xb000	0x9a0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc000	0xd8c	0xe00	0018c2cb5be68ca36824064a8ac5d4ff	False	0.36328125	data	4.384119895583725	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0xd000	0x68	0x200	59ecaba280758304e557db0589366c9b	False	0.0703125	data	0.2709192282599745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xe000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf000	0x3f0f8	0x3f200	a097a9b3cefd8d9a1e379aec828c6216	False	0.4132387066831683	data	4.935816276780646	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
/4	0x4f000	0x50	0x200	3ab638c1893c52a9bd0bc0e4f7d22156	False	0.0703125	data	0.2162069074398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/19	0x50000	0x1f09	0x2000	711fb91affb5c2e3f3da9f5ce5cb2a90	False	0.4599609375	data	5.826133809694022	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/31	0x52000	0x149	0x200	5d291f74219487bffd06356d36f3a0e4	False	0.375	data	3.2872917906726884	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/45	0x53000	0x223	0x400	5833179874b46bd7a25a939f545850e5	False	0.2900390625	data	3.2414615028552927	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/57	0x54000	0x48	0x200	83a56323a7304b1c63aa44f8f4cd1c83	False	0.119140625	data	0.6931503241542495	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/70	0x55000	0x9c	0x200	0ae560308f3cfcfe4df88bb761d7cca9	False	0.26171875	data	2.3338418313380362	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf0b8	0x3f028	Device independent bitmap graphic, 244 x 512 x 32, image size 249856	English	United States	0.4136418585908682
RT_GROUP_ICON	0x4e0e0	0x14	data	English	United States	1.2

Imports

DLL	Import
libgcc_s_sjlj-1.dll	_Unwind_SjLj_Register, _Unwind_SjLj_Resume, _Unwind_SjLj_Unregister
KERNEL32.dll	CreateToolhelp32Snapshot, DeleteCriticalSection, EnterCriticalSection, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetLastError, GetStartupInfoA, GetSystemTimeAsFileTime, GetTickCount, InitializeCriticalSection, LeaveCriticalSection, Module32Next, OpenProcess, Process32Next, QueryPerformanceCounter, ReadProcessMemory, RtlAddFunctionTable, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetConsoleTitleA, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TlsGetValue, UnhandledExceptionFilter, VirtualProtect, VirtualQuery, WriteProcessMemory
msvcrt.dll	__C_specific_handler, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _cexit, _fmode, _initterm, _onexit, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, memmove, signal, strcmp, strlen, strncmp, vfprintf
USER32.dll	GetAsyncKeyState
libstdc++-6.dll	_ZNSolsEPFRSoS_E, _ZNSt6thread15_M_start_threadESt10unique_ptrINS_6_StateESt14default_deleteIS1_EEPFvvE, _ZNSt6thread6_StateD2Ev, _ZNSt6thread6detachEv, _ZNSt8ios_base4InitC1Ev, _ZNSt8ios_base4InitD1Ev, _ZSt17__throw_bad_allocv, _ZSt4cout, _ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_, _ZSt9terminatev, _ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc, _ZTVN10__cxxabiv117__class_type_infoE, _ZTVN10__cxxabiv120__si_class_type_infoE, _ZTVNSt6thread6_StateE, _ZdlPv, _ZdlPvy, _Znwy, __gxx_personality_sj0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	23:31:53
Start date:	18/04/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe"
Imagebase:	0x400000
File size:	385'306 bytes
MD5 hash:	AC38083AD80AB0BF6A26B827A73F87D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	23:31:53
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Function 00401180 Relevance: 13.7, APIs: 9, Instructions: 198sleepstringCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 004011E1
SetUnhandledExceptionFilter.KERNEL32 ref: 00401253
malloc.MSVCRT ref: 00401329
strlen.MSVCRT ref: 00401354
malloc.MSVCRT ref: 00401360
memcpy.MSVCRT ref: 00401378
_cexit.MSVCRT ref: 004013E5
GetStartupInfoA.KERNEL32 ref: 00401473

Memory Dump Source

Source File: 00000000.00000002.2883092759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2883078310.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883107605.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883121255.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883134409.000000000040F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled_cexitmemcpystrlen
String ID:
API String ID: 1640792405-0
Opcode ID: 523f22edc225c242108c5a705f0726922c74425bc309cbc0c1eb56062061843b
Instruction ID: 17779c18d4e607c1fd956484a40fde5f9e74ffe61d389f7004e22c4fdb857af0
Opcode Fuzzy Hash: 523f22edc225c242108c5a705f0726922c74425bc309cbc0c1eb56062061843b
Instruction Fuzzy Hash: 5A8169B5610B4485EB24AF56E99076A33A1F785B88F84803ADF48B73A1DF3DC844C74D

Uniqueness

Uniqueness Score: -1.00%

Function 00401656 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0040167E
strcmp.MSVCRT ref: 004016CA
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 004016F6
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 00401708
_ZNSolsEPFRSoS_E.LIBSTDC++-6 ref: 00401717
exit.MSVCRT ref: 00401721

Strings

Can't find , xrefs: 004016E8

Memory Dump Source

Source File: 00000000.00000002.2883092759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2883078310.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883107605.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883121255.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883134409.000000000040F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: St11char_traitsSt13basic_ostreamStls$CreateSnapshotSolsToolhelp32exitstrcmp
String ID: Can't find
API String ID: 4251689068-1249587998
Opcode ID: 40422fb562a2141cfb74a0a18ad0113d49c5ab2a1885c96d013c96f4d28219e7
Instruction ID: 681499786372c53e807bc13c377a4c9310e6c6afea1230c0bc04212131482ffe
Opcode Fuzzy Hash: 40422fb562a2141cfb74a0a18ad0113d49c5ab2a1885c96d013c96f4d28219e7
Instruction Fuzzy Hash: DC11FB75600BC589EB60EF62D8883DD3769F78578CF40412ADE5C6B799DF38C6458344

Uniqueness

Uniqueness Score: -1.00%

Function 00403420 Relevance: 12.0, APIs: 8, Instructions: 50COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00403434
RtlLookupFunctionEntry.KERNEL32 ref: 0040344B
RtlVirtualUnwind.KERNEL32 ref: 0040348D
SetUnhandledExceptionFilter.KERNEL32 ref: 004034D1
UnhandledExceptionFilter.KERNEL32 ref: 004034DE
GetCurrentProcess.KERNEL32 ref: 004034E4
TerminateProcess.KERNEL32 ref: 004034F2
abort.MSVCRT ref: 004034F8

Memory Dump Source

Source File: 00000000.00000002.2883092759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2883078310.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883107605.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883121255.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883134409.000000000040F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtualabort
String ID:
API String ID: 4278921479-0
Opcode ID: ac17ba45f649af75d62cc750b07ed58363b34b1b37e5f112007082125e69934c
Instruction ID: cae3f20262dbcaef82f0fefc7750af4b8b336a925b4d3e4bb22d105e09a0a7cc
Opcode Fuzzy Hash: ac17ba45f649af75d62cc750b07ed58363b34b1b37e5f112007082125e69934c
Instruction Fuzzy Hash: 4421E2B5620B04D5EB009B65FC9479937B4F708B84F448226DF8EA77A4EF38C155C348

Uniqueness

Uniqueness Score: -1.00%

Function 00403340 Relevance: 7.6, APIs: 5, Instructions: 56timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00403385
GetCurrentProcessId.KERNEL32 ref: 00403390
GetCurrentThreadId.KERNEL32 ref: 00403399
GetTickCount.KERNEL32 ref: 004033A1
QueryPerformanceCounter.KERNEL32 ref: 004033AE

Memory Dump Source

Source File: 00000000.00000002.2883092759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2883078310.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883107605.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883121255.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883134409.000000000040F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 0ccfc8d0a8ffa76d78cd3f8399408ec735672eba2aa09b4dd615f20de3288857
Instruction ID: 1542b7fd4dbf78755f4df576bfe1d3b31265d3ed6214f96e591ab1a0a5902565
Opcode Fuzzy Hash: 0ccfc8d0a8ffa76d78cd3f8399408ec735672eba2aa09b4dd615f20de3288857
Instruction Fuzzy Hash: FE119EA6765B5081FB214B25FC483166760B748BB5F084731DF9C637E4DA3CD585C308

Uniqueness

Uniqueness Score: -1.00%

Function 00402C5C Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2883092759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2883078310.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883107605.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883121255.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883134409.000000000040F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: RegisterUnwind_
String ID:
API String ID: 2850641417-0
Opcode ID: 4f1c01132b8236330c3ddb2b6f1fbc191d9a2b99d20ad343a6110f031d4567b9
Instruction ID: c8f62845a858838b716375c2c7d1d244cc52b7a054fcde9f39fbee2eb132f139
Opcode Fuzzy Hash: 4f1c01132b8236330c3ddb2b6f1fbc191d9a2b99d20ad343a6110f031d4567b9
Instruction Fuzzy Hash: 5BF03AC4214780C8FB259729E8A83132B51D351788F084065CB683B3E3CF7DC549839D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C3E8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2883121255.000000000040C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2883078310.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883092759.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883107605.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883134409.000000000040F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4be6e8c02e2a49c4f42c6aea0b609462bc6a224a0d31e6b07996b6894733365
Instruction ID: db8a02d798d42cbfaddee82f965080e8709f308b480203087d1aab40a5f9ffcc
Opcode Fuzzy Hash: a4be6e8c02e2a49c4f42c6aea0b609462bc6a224a0d31e6b07996b6894733365
Instruction Fuzzy Hash: 50E0B78B90EBC06AE3032A20A8342487F7056A6A05B8BC18786C0C63DBE25C08088322

Uniqueness

Uniqueness Score: -1.00%

Function 004048A1 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2883092759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2883078310.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883107605.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883121255.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883134409.000000000040F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f397a301694c9624366f62f20e9f62a457d48aa0b5fa785d56b72560ed43fabf
Instruction ID: 9c4dc73c8bafad0494abd1047880a09ef30d471a7e298c0bb4f4c5e4483e6d19
Opcode Fuzzy Hash: f397a301694c9624366f62f20e9f62a457d48aa0b5fa785d56b72560ed43fabf
Instruction Fuzzy Hash: 60A00262C9DD00C0E2000B04E891361A128D306600F44B1208618A10D29A3C90404259

Uniqueness

Uniqueness Score: -1.00%

Function 00403940 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 283memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(0040B630,0000C7F6,?,?,?,00000001,0040124C), ref: 00403A6D

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00403BEE
Unknown pseudo relocation bit size %d., xrefs: 00403BDA

Memory Dump Source

Source File: 00000000.00000002.2883092759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2883078310.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883107605.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883121255.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883134409.000000000040F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 0974f5ebd1be562d119a3007c9699e1f9cb3db27355b940d88944a396a82acfb
Instruction ID: c9f8ed843258241777969ff5df36ba4cee9653c8cfba5cb333f2084a88969eff
Opcode Fuzzy Hash: 0974f5ebd1be562d119a3007c9699e1f9cb3db27355b940d88944a396a82acfb
Instruction Fuzzy Hash: 099199B1B0054046EB24DF7AD84071E6B69B7857AAF50883BCF49B77D5DA3DCA82830C

Uniqueness

Uniqueness Score: -1.00%

Function 00403E90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00403EE9
signal.MSVCRT ref: 00403F42
signal.MSVCRT ref: 00403F9E
signal.MSVCRT ref: 00404053

Strings

CCG , xrefs: 00403EA5

Memory Dump Source

Source File: 00000000.00000002.2883092759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2883078310.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883107605.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883121255.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883134409.000000000040F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: fcc64e9d4ca2efe7e76b85ff0621b71c9480ac8d95f5d2d4279f648ad19c99fc
Instruction ID: 6311645d50d6e33fd6169ea0a1915b5f18ca8af34efbf3f1d7bf303c936dc7c3
Opcode Fuzzy Hash: fcc64e9d4ca2efe7e76b85ff0621b71c9480ac8d95f5d2d4279f648ad19c99fc
Instruction Fuzzy Hash: C3317660F0000245EE386A7E545473A08195BCA73AF298A3BD739AB3E5CE7D9EC5421E

Uniqueness

Uniqueness Score: -1.00%

Function 00402CD2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 186COMMON

Download Yara Rule

APIs

_ZNSt6thread6detachEv.LIBSTDC++-6 ref: 00402DE3
_ZNSt6thread6detachEv.LIBSTDC++-6 ref: 00402E49
_ZNSt6thread6detachEv.LIBSTDC++-6 ref: 00402EAF
_ZNSt6thread6detachEv.LIBSTDC++-6 ref: 00402F15
_ZNSt6thread6detachEv.LIBSTDC++-6 ref: 00402F7B
_ZNSt6thread6detachEv.LIBSTDC++-6 ref: 00402FE9

Strings

N0tT00MUCH DEVILISH !!!, xrefs: 00402D70

Memory Dump Source

Source File: 00000000.00000002.2883092759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2883078310.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883107605.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883121255.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883134409.000000000040F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: St6thread6detach
String ID: N0tT00MUCH DEVILISH !!!
API String ID: 2713843329-4251447766
Opcode ID: 79e9a22e782185b07e17f259dca91e2e6d0b7ae19618e83a512d9745526aa996
Instruction ID: ecde1d2fec230e651b5af076fa1e42854fa7b49840d21401abe51c88d0d245d2
Opcode Fuzzy Hash: 79e9a22e782185b07e17f259dca91e2e6d0b7ae19618e83a512d9745526aa996
Instruction Fuzzy Hash: E181CFA5200BC198EB11DFA5D8583D93B65FB453ACF840226EE592B3E1EF7DC249C358

Uniqueness

Uniqueness Score: -1.00%

Function 00401576 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 0040160B
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 0040161A
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 00401629
_ZNSolsEPFRSoS_E.LIBSTDC++-6 ref: 00401638
exit.MSVCRT ref: 00401642

Strings

Can't find , xrefs: 004015FD
on the running processes, xrefs: 0040161F

Memory Dump Source

Source File: 00000000.00000002.2883092759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2883078310.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883107605.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883121255.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883134409.000000000040F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: St11char_traitsSt13basic_ostreamStls$Solsexit
String ID: on the running processes$Can't find
API String ID: 644619695-1736597619
Opcode ID: 33a0a3d23b9b86bcb914987e9cbcd74592eaac8e2e7d8b5d06f11b83e53a3f28
Instruction ID: e8ec1e8e3b9ee951894894b3679c741b8a39acde642b5dba4cd79ce70d03bc58
Opcode Fuzzy Hash: 33a0a3d23b9b86bcb914987e9cbcd74592eaac8e2e7d8b5d06f11b83e53a3f28
Instruction Fuzzy Hash: 12116D756007868DEB20EFA2D8453EA2369F784388F40403E9A0C6F78AEF38C604C754

Uniqueness

Uniqueness Score: -1.00%

Function 00403770 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 148memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 0040381B
VirtualProtect.KERNEL32 ref: 004038C2
GetLastError.KERNEL32 ref: 004038D0

Strings

VirtualProtect failed with code 0x%x, xrefs: 004038D6
VirtualQuery failed for %d bytes at address %p, xrefs: 00403917
Address %p has no image-section, xrefs: 0040392D

Memory Dump Source

Source File: 00000000.00000002.2883092759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2883078310.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883107605.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883121255.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883134409.000000000040F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuery
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 637304234-2123141913
Opcode ID: 802c976096940044824180d52ba86392553901bd97041955b652dcc19e3c8d4d
Instruction ID: ff8ba4e790f4f7987a2f207ca492c487d9bd8be908676e6e681c5077e31e913a
Opcode Fuzzy Hash: 802c976096940044824180d52ba86392553901bd97041955b652dcc19e3c8d4d
Instruction Fuzzy Hash: BB5100B3701A5086DB108F26E84075A7BA8F799BA5F44C526EF4D633D4EB3CC681C348

Uniqueness

Uniqueness Score: -1.00%

Function 00403006 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

_Unwind_SjLj_Resume.LIBGCC_S_SJLJ-1 ref: 00403058
_Unwind_SjLj_Resume.LIBGCC_S_SJLJ-1 ref: 0040307B
_Unwind_SjLj_Resume.LIBGCC_S_SJLJ-1 ref: 0040309E
_Unwind_SjLj_Resume.LIBGCC_S_SJLJ-1 ref: 004030C1
_Unwind_SjLj_Resume.LIBGCC_S_SJLJ-1 ref: 004030E4
_Unwind_SjLj_Resume.LIBGCC_S_SJLJ-1 ref: 00403107

Memory Dump Source

Source File: 00000000.00000002.2883092759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2883078310.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883107605.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883121255.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883134409.000000000040F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ResumeUnwind_
String ID:
API String ID: 1645692194-0
Opcode ID: 7afbacbcefeacf6d9aebb308d0ad84443f2b5a91009f919d7cbd7154bfd26914
Instruction ID: e2f3d3001da92d0d67b9cd19895eb4e419d3ea0fff541e30ecd193c551ae8535
Opcode Fuzzy Hash: 7afbacbcefeacf6d9aebb308d0ad84443f2b5a91009f919d7cbd7154bfd26914
Instruction Fuzzy Hash: FC219271B02B859DCB10EFB6D48919D3761E7427ACB90432ABE6D2F7D8EE38C1418744

Uniqueness

Uniqueness Score: -1.00%

Function 00403640 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004036B9

Strings

Unknown error, xrefs: 00403730
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 004036A9

Memory Dump Source

Source File: 00000000.00000002.2883092759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2883078310.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883107605.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883121255.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883134409.000000000040F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 486d42412066dfe36fd8c65bc634c884022d5e7a075667f445c7b5da5346c9ac
Instruction ID: 3f5dd45110ae978a4b1751d87de2dcbbe57bc2e0c24f33e2f5f1acda69cc3f31
Opcode Fuzzy Hash: 486d42412066dfe36fd8c65bc634c884022d5e7a075667f445c7b5da5346c9ac
Instruction Fuzzy Hash: 4C0165A2504E8485D6168F1CE8013DA7375FF9AB5AF545316EF8836220DB3AC653C704

Uniqueness

Uniqueness Score: -1.00%

Function 004036E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004036B9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 004036A9
Argument singularity (SIGN), xrefs: 004036E0

Memory Dump Source

Source File: 00000000.00000002.2883092759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2883078310.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883107605.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883121255.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883134409.000000000040F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: c2a0238b4cf4995e011fb2804938a8bb7f027c1ca22399b7ac030efcc084ca56
Instruction ID: 86cd726c7501e661e610d39518c09280b879233fd3c524eafe30fd04c95d080b
Opcode Fuzzy Hash: c2a0238b4cf4995e011fb2804938a8bb7f027c1ca22399b7ac030efcc084ca56
Instruction Fuzzy Hash: BFF09066404F8482C202CF1CA8003ABB374FF9EB99F28531AEF893A125DF39C6478704

Uniqueness

Uniqueness Score: -1.00%

Function 004036F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004036B9

Strings

Overflow range error (OVERFLOW), xrefs: 004036F0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 004036A9

Memory Dump Source

Source File: 00000000.00000002.2883092759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2883078310.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883107605.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883121255.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883134409.000000000040F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: e1ea431322100007d46f2ec6e89f7314b6fdbb9caa5613402f93e11c8225a73e
Instruction ID: 3711e7a45d4315c62acd611f5919a889b3669df17a6b532eeee99d721d1920ac
Opcode Fuzzy Hash: e1ea431322100007d46f2ec6e89f7314b6fdbb9caa5613402f93e11c8225a73e
Instruction Fuzzy Hash: 79F09662404F8481C201CF1CA8003ABB374FF9EB99F18531AEF8936164DF39C6478704

Uniqueness

Uniqueness Score: -1.00%

Function 00403700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004036B9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 004036A9
The result is too small to be represented (UNDERFLOW), xrefs: 00403700

Memory Dump Source

Source File: 00000000.00000002.2883092759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2883078310.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883107605.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883121255.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883134409.000000000040F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: ccc6003af409921ed666c0cebce391262b9feb4fb2c888a16239dec61d2546b4
Instruction ID: 5dceb83f4ad9a0b26f3d602ea2e599a426436d76f19871f105afad2a02b08c59
Opcode Fuzzy Hash: ccc6003af409921ed666c0cebce391262b9feb4fb2c888a16239dec61d2546b4
Instruction Fuzzy Hash: 02F06262404E8481C2018F1CA8003AAB374FF8EB99F18531AEF8936165DB39C6439704

Uniqueness

Uniqueness Score: -1.00%

Function 00403710 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004036B9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 004036A9
Total loss of significance (TLOSS), xrefs: 00403710

Memory Dump Source

Source File: 00000000.00000002.2883092759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2883078310.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883107605.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883121255.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883134409.000000000040F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 0d58f466b1dc8e4c40fad885a45965a57db5c75e3a50420cf13e0ca18821ca1b
Instruction ID: 0239114c4565ab1f9b17abd7804982663a02289b7cde2741d7d0142a7c82caef
Opcode Fuzzy Hash: 0d58f466b1dc8e4c40fad885a45965a57db5c75e3a50420cf13e0ca18821ca1b
Instruction Fuzzy Hash: 8EF09666404F8481C201CF1CA8003ABB374FF9EB99F18531AEF8936524DF39C6438704

Uniqueness

Uniqueness Score: -1.00%

Function 00403720 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004036B9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 004036A9
Partial loss of significance (PLOSS), xrefs: 00403720

Memory Dump Source

Source File: 00000000.00000002.2883092759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2883078310.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883107605.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883121255.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883134409.000000000040F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: 19f7b2af8315e8240d29d5dae525daf5e94ba136a161cf52c46fece87cabb503
Instruction ID: 601372891a3f8e0ed7d957b96f0024012629195a34d30cce3fcb4ed76f0947fa
Opcode Fuzzy Hash: 19f7b2af8315e8240d29d5dae525daf5e94ba136a161cf52c46fece87cabb503
Instruction Fuzzy Hash: B6F06D62404E8482C2028F1CA8003AAB374FF8EB99F68531AEF893A164DB39C6438704

Uniqueness

Uniqueness Score: -1.00%

Function 00403671 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004036B9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 004036A9
Argument domain error (DOMAIN), xrefs: 00403671

Memory Dump Source

Source File: 00000000.00000002.2883092759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2883078310.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883107605.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883121255.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883134409.000000000040F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: c67392067925c2f2a1947b355b1f8daaf50af670d5c77fce86e71350f048b2e5
Instruction ID: bb9cf15040cb9ba806488dec52cc41afe657a4a4d4186ffcc7fd701d512fc2f7
Opcode Fuzzy Hash: c67392067925c2f2a1947b355b1f8daaf50af670d5c77fce86e71350f048b2e5
Instruction Fuzzy Hash: 78F03666504F8481D201CF1DA80039BB375FF9EB99F15531AEF8936525DF39C5438704

Uniqueness

Uniqueness Score: -1.00%

Function 00404170 Relevance: 5.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00404197
free.MSVCRT ref: 004041E8
LeaveCriticalSection.KERNEL32 ref: 004041F4

Memory Dump Source

Source File: 00000000.00000002.2883092759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2883078310.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883107605.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883121255.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883134409.000000000040F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2883164871.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: 638f7b8c3d862b9ac2d0fc46d34ab6b30efce844e0f000aa8254e30ea05c18ab
Instruction ID: 572be3473069f05d43c56f0e28807a8f3c58663a203f662dcc531e911fa3cba9
Opcode Fuzzy Hash: 638f7b8c3d862b9ac2d0fc46d34ab6b30efce844e0f000aa8254e30ea05c18ab
Instruction Fuzzy Hash: 57011EF1711608C6EA08CB55EC8432623A1F7E8B40F558436DB19AB3A0DB7CD991838C

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exePID: 7496, Parent PID: 2580

General

Chronological Activities

Analysis Process: conhost.exePID: 7504, Parent PID: 7496

General

Chronological Activities

Disassembly

Analysis Process: SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exePID: 7496, Parent PID: 2580COMMON

Non-executed Functions

Function 00401180 Relevance: 13.7, APIs: 9, Instructions: 198sleepstringCOMMON

Function 00401656 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46processstringCOMMON

Function 00403420 Relevance: 12.0, APIs: 8, Instructions: 50COMMON

Function 00403340 Relevance: 7.6, APIs: 5, Instructions: 56timethreadCOMMON

Windows Analysis Report
SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997.exe