Edit tour

Windows Analysis Report
xVcsGL5R1Nbh.exe

Overview

General Information

Sample name:	xVcsGL5R1Nbh.exe
Analysis ID:	1429973
MD5:	cbe87d6abf69bdd3877821f493e6f6b1
SHA1:	4099bc3848634a8d5ca58cd8c0fe029748b368e9
SHA256:	76bd193c0535e6109143d35950e045e03fb25c4ab8419ca6fa69c4fbea4cd085
Tags:	exenjRat
Infos:

Detection

Njrat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Snort IDS alert for network traffic

Yara detected Njrat

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

C2 URLs / IPs found in malware configuration

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Self deletion via cmd or bat file

Uses dynamic DNS services

Allocates memory with a write watch (potentially for evading sandboxes)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w10x64

xVcsGL5R1Nbh.exe (PID: 6844 cmdline: "C:\Users\user\Desktop\xVcsGL5R1Nbh.exe" MD5: CBE87D6ABF69BDD3877821F493E6F6B1)

cmd.exe (PID: 5164 cmdline: cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\user\Desktop\xVcsGL5R1Nbh.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{"Host": "patria.duckdns.org", "Port": "1994", "Campaign ID": "NYAN CAT", "Network Seprator": "@!#&^%$", "Registry": "4ee9f9af7e9"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
xVcsGL5R1Nbh.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1701540964.0000000000352000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000002.2420818601.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: xVcsGL5R1Nbh.exe PID: 6844	JoeSecurity_Njrat	Yara detected Njrat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.xVcsGL5R1Nbh.exe.350000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.4 - Destination IP: 46.246.6.20

Timestamp:	04/23/24-00:07:13.366284
SID:	2825564
Source Port:	49730
Destination Port:	1994
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 46.246.6.20

Timestamp:	04/23/24-00:06:12.129270
SID:	2033132
Source Port:	49730
Destination Port:	1994
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 46.246.6.20

Timestamp:	04/23/24-00:06:12.504132
SID:	2825563
Source Port:	49730
Destination Port:	1994
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity Sending Screenshot (CAP) - Source IP: 192.168.2.4 - Destination IP: 46.246.6.20

Timestamp:	04/23/24-00:07:13.518261
SID:	2825565
Source Port:	49730
Destination Port:	1994
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: xVcsGL5R1Nbh.exe

Avira: detected

Found malware configuration

Source: 00000000.00000000.1701540964.0000000000352000.00000002.00000001.01000000.00000003.sdmp

Malware Configuration Extractor: Njrat {"Host": "patria.duckdns.org", "Port": "1994", "Campaign ID": "NYAN CAT", "Network Seprator": "@!#&^%$", "Registry": "4ee9f9af7e9"}

Yara detected Njrat

Source: Yara match	File source: xVcsGL5R1Nbh.exe, type: SAMPLE
Source: Yara match	File source: 0.0.xVcsGL5R1Nbh.exe.350000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1701540964.0000000000352000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2420818601.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xVcsGL5R1Nbh.exe PID: 6844, type: MEMORYSTR

Machine Learning detection for sample

Source: xVcsGL5R1Nbh.exe

Joe Sandbox ML: detected

Source: xVcsGL5R1Nbh.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: xVcsGL5R1Nbh.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49730 -> 46.246.6.20:1994
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49730 -> 46.246.6.20:1994
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49730 -> 46.246.6.20:1994
Source: Traffic	Snort IDS: 2825565 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity Sending Screenshot (CAP) 192.168.2.4:49730 -> 46.246.6.20:1994

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: patria.duckdns.org

Uses dynamic DNS services

Source: unknown

DNS query: name: patria.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 46.246.6.20:1994

Source: Joe Sandbox View

ASN Name: PORTLANEwwwportlanecomSE PORTLANEwwwportlanecomSE

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: patria.duckdns.org

Source: xVcsGL5R1Nbh.exe, 00000000.00000002.2420110756.0000000000883000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.
Source: xVcsGL5R1Nbh.exe, 00000000.00000002.2420110756.0000000000883000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.LinkId=42127

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: xVcsGL5R1Nbh.exe, Keylogger.cs

.Net Code: VKCodeToUnicode

E-Banking Fraud

Yara detected Njrat

Source: Yara match	File source: xVcsGL5R1Nbh.exe, type: SAMPLE
Source: Yara match	File source: 0.0.xVcsGL5R1Nbh.exe.350000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1701540964.0000000000352000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2420818601.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xVcsGL5R1Nbh.exe PID: 6844, type: MEMORYSTR

Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe

Code function: 0_2_011B19F0

0_2_011B19F0

Source: xVcsGL5R1Nbh.exe, 00000000.00000000.1701553439.0000000000358000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameClient.exe4 vs xVcsGL5R1Nbh.exe
Source: xVcsGL5R1Nbh.exe, 00000000.00000002.2420110756.000000000081E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemscorwks.dllT vs xVcsGL5R1Nbh.exe
Source: xVcsGL5R1Nbh.exe	Binary or memory string: OriginalFilenameClient.exe4 vs xVcsGL5R1Nbh.exe

Source: xVcsGL5R1Nbh.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/1@1/1

Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Code function: 0_2_04D0255A AdjustTokenPrivileges,		0_2_04D0255A
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Code function: 0_2_04D02523 AdjustTokenPrivileges,		0_2_04D02523

Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\xVcsGL5R1Nbh.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Mutant created: \Sessions\1\BaseNamedObjects\4ee9f9af7e9
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7064:120:WilError_03

Source: xVcsGL5R1Nbh.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: xVcsGL5R1Nbh.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe "C:\Users\user\Desktop\xVcsGL5R1Nbh.exe"
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\user\Desktop\xVcsGL5R1Nbh.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\user\Desktop\xVcsGL5R1Nbh.exe"	Jump to behavior

Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: xVcsGL5R1Nbh.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: xVcsGL5R1Nbh.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: xVcsGL5R1Nbh.exe, Program.cs

.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process created: cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\user\Desktop\xVcsGL5R1Nbh.exe"
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process created: cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\user\Desktop\xVcsGL5R1Nbh.exe"			Jump to behavior

Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Memory allocated: DE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Memory allocated: 2B30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Memory allocated: FE0000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Window / User API: threadDelayed 1333	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Window / User API: threadDelayed 3777	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Window / User API: threadDelayed 4383	Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe	Window / User API: foregroundWindowGot 1767	Jump to behavior

Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe TID: 6860	Thread sleep time: -1333000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe TID: 6860	Thread sleep time: -4383000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: xVcsGL5R1Nbh.exe, 00000000.00000002.2420110756.0000000000883000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllontextBindingCollectionElement, System.WorkflowServices, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/>

Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: xVcsGL5R1Nbh.exe, Program.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, cbName, ref lpszVer, 100)
Source: xVcsGL5R1Nbh.exe, Keylogger.cs	Reference to suspicious API methods: MapVirtualKey(a, 0u)
Source: xVcsGL5R1Nbh.exe, Keylogger.cs	Reference to suspicious API methods: GetAsyncKeyState(num2)

Source: xVcsGL5R1Nbh.exe, 00000000.00000002.2420818601.0000000002BA9000.00000004.00000800.00020000.00000000.sdmp, xVcsGL5R1Nbh.exe, 00000000.00000002.2420818601.0000000002C05000.00000004.00000800.00020000.00000000.sdmp, xVcsGL5R1Nbh.exe, 00000000.00000002.2420818601.0000000002C25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: xVcsGL5R1Nbh.exe, 00000000.00000002.2420818601.0000000002BA9000.00000004.00000800.00020000.00000000.sdmp, xVcsGL5R1Nbh.exe, 00000000.00000002.2420818601.0000000002C05000.00000004.00000800.00020000.00000000.sdmp, xVcsGL5R1Nbh.exe, 00000000.00000002.2420818601.0000000002C25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@9

Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\xVcsGL5R1Nbh.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Njrat

Source: Yara match	File source: xVcsGL5R1Nbh.exe, type: SAMPLE
Source: Yara match	File source: 0.0.xVcsGL5R1Nbh.exe.350000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1701540964.0000000000352000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2420818601.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xVcsGL5R1Nbh.exe PID: 6844, type: MEMORYSTR

Remote Access Functionality

Yara detected Njrat

Source: Yara match	File source: xVcsGL5R1Nbh.exe, type: SAMPLE
Source: Yara match	File source: 0.0.xVcsGL5R1Nbh.exe.350000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1701540964.0000000000352000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2420818601.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xVcsGL5R1Nbh.exe PID: 6844, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 Input Capture	1 Security Software Discovery	Remote Services	1 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	2 Process Injection	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Disable or Modify Tools	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	21 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Process Injection	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
xVcsGL5R1Nbh.exe	100%	Avira	TR/Dropper.Gen7
xVcsGL5R1Nbh.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://go.microsoft.	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
patria.duckdns.org	46.246.6.20	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
patria.duckdns.org	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://go.microsoft.	xVcsGL5R1Nbh.exe, 00000000.00000002.2420110756.0000000000883000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://go.microsoft.LinkId=42127	xVcsGL5R1Nbh.exe, 00000000.00000002.2420110756.0000000000883000.00000004.00000020.00020000.00000000.sdmp	false		low

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
46.246.6.20	patria.duckdns.org	Sweden		42708	PORTLANEwwwportlanecomSE	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429973
Start date and time:	2024-04-23 00:05:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	xVcsGL5R1Nbh.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/1@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 89 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: xVcsGL5R1Nbh.exe

Simulations

Behavior and APIs

Time	Type	Description
00:06:40	API Interceptor	22062x Sleep call for process: xVcsGL5R1Nbh.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
46.246.6.20	xyyDAUDPeYEH.exe	Get hash	malicious	Njrat	Browse
	xde47dUIgZDh.exe	Get hash	malicious	AsyncRAT	Browse
	x7CwEiB9bHEP.exe	Get hash	malicious	Njrat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
patria.duckdns.org	bUBD.exe	Get hash	malicious	Njrat	Browse	46.246.14.22
	x5gJuYmvL7m2.exe	Get hash	malicious	Njrat	Browse	46.246.82.18
	bTFU.exe	Get hash	malicious	Njrat	Browse	46.246.14.2
	bTDk.exe	Get hash	malicious	Njrat	Browse	46.246.80.3
	bT6H.exe	Get hash	malicious	Njrat	Browse	46.246.12.4
	bT6q.exe	Get hash	malicious	Njrat	Browse	46.246.12.14
	bT5A.exe	Get hash	malicious	Njrat	Browse	46.246.80.9
	bT57.exe	Get hash	malicious	Njrat	Browse	46.246.80.9
	bT5b.exe	Get hash	malicious	Njrat	Browse	46.246.80.9
	bT3v.exe	Get hash	malicious	Njrat	Browse	46.246.84.15

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PORTLANEwwwportlanecomSE	xyyDAUDPeYEH.exe	Get hash	malicious	Njrat	Browse	46.246.6.20
	xzcQo6GenFVf.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	46.246.14.5
	tajma.x86-20240422-0535.elf	Get hash	malicious	Mirai, Okiru	Browse	188.126.69.245
	x7RZVIWaDKb5.exe	Get hash	malicious	Njrat	Browse	46.246.14.17
	x7RZVIWaDKb5.exe	Get hash	malicious	Njrat	Browse	46.246.14.17
	bUBL.exe	Get hash	malicious	Njrat	Browse	46.246.14.17
	bUBD.exe	Get hash	malicious	Njrat	Browse	46.246.14.22
	xutnF2gKGTTy.exe	Get hash	malicious	AsyncRAT	Browse	46.246.4.3
	8ubQTzsAqG.exe	Get hash	malicious	Unknown	Browse	185.117.88.39
	8ubQTzsAqG.exe	Get hash	malicious	Unknown	Browse	185.117.88.39

Process:	C:\Users\user\Desktop\xVcsGL5R1Nbh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	907
Entropy (8bit):	5.243019596074263
Encrypted:	false
SSDEEP:	24:MLF2CpI329Iz52VMzffup26KTnKoO2+b2hHAa/:MwQd9IzoaXuY6Ux+SF/
MD5:	48A0572426885EBDE53CA62C7F2E194E
SHA1:	035628CDF6276367F6C83E9F4AA2172933850AA8
SHA-256:	4C68E10691304CAC8DA65A05CF2580728EC0E294104F267840712AF1C46A6538
SHA-512:	DEFE728C2312918D94BD43C98908C08CCCA5EBFB77F873779DCA784F14C607B33A4E29AC5ECB798F2F741668B7692F72BCB60DEFD536EA86B296B64FA359C42D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\53992d421e2c7ecf6609c62b3510a6f0\System.Configuration.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\74774597e319a738b792e6a6c06d3559\System.Xml.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\1bd56c432cb9ff27e335d97f404caf8f\System.Management.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	3.79842206282092
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	xVcsGL5R1Nbh.exe
File size:	32'768 bytes
MD5:	cbe87d6abf69bdd3877821f493e6f6b1
SHA1:	4099bc3848634a8d5ca58cd8c0fe029748b368e9
SHA256:	76bd193c0535e6109143d35950e045e03fb25c4ab8419ca6fa69c4fbea4cd085
SHA512:	3c762fe9283dea8e9b007d477e0e979dd157bc271e8da4b68e5af8762245d0335283284eeec90246c767e9c31f8e456871ecfe392b350c6236be83819dcb4a5a
SSDEEP:	384:h0bUe5XB4e0XvOb7w0Q0mS03AWTxtTUFQqzFzObbt:6T9Bum455dRbt
TLSH:	69E218467BE94215D6BC1AFC8CB313214772E3838532EB6F9CDC98CA4B676D00245EE9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....&f.................P... ......ng... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40676e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6626DA9A [Mon Apr 22 21:46:02 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6714	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8000	0x2a0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x4774	0x5000	b00b74176e982e3c39043b9036e20959	False	0.474853515625	data	5.288956411742384	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x8000	0x2a0	0x1000	72e29550a9764ae2ca0bc9263e829114	False	0.07666015625	data	0.6655850551657312	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa000	0xc	0x1000	34585954bedb30c5084980db7d41ad8f	False	0.0087890625	data	0.013126943721219527	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x8058	0x244	data			0.46379310344827585

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/23/24-00:07:13.366284	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49730	1994	192.168.2.4	46.246.6.20
04/23/24-00:06:12.129270	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49730	1994	192.168.2.4	46.246.6.20
04/23/24-00:06:12.504132	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49730	1994	192.168.2.4	46.246.6.20
04/23/24-00:07:13.518261	TCP	2825565	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity Sending Screenshot (CAP)	49730	1994	192.168.2.4	46.246.6.20

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 00:06:11.752430916 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:06:12.026603937 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:06:12.026868105 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:06:12.129270077 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:06:12.503940105 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:06:12.504132032 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:06:13.003900051 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:06:17.612581968 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:06:18.106451035 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:06:20.896636963 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:06:20.900985956 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:06:21.315797091 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:06:39.006707907 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:06:39.007106066 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:06:39.407672882 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:06:56.483587980 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:06:56.483974934 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:06:56.815632105 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:05.753369093 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:06.119800091 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:07.269557953 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:07.606569052 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:10.333960056 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:10.377898932 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:10.412349939 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:10.817898035 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:11.972057104 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:12.315212965 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:12.315299034 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:12.707153082 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:13.128427982 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:13.366101980 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:13.366283894 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:13.518167973 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:13.518260956 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:13.719157934 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:13.719350100 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:13.920140028 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:13.920216084 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:14.107163906 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:14.107275963 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:14.297291040 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:14.384402037 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:14.384676933 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:14.587399006 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:14.587798119 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:14.768400908 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:14.818304062 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:14.818516970 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:14.993105888 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:15.019443035 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:15.019602060 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:15.051496983 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:15.051826000 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:15.206361055 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:15.206583977 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:15.267344952 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:15.267471075 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:15.349406004 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:15.349543095 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:15.518618107 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:15.518821955 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:15.565484047 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:15.626679897 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:15.626913071 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:15.796655893 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:15.796674967 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:15.796782970 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:16.061517954 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:16.073595047 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:16.114614010 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:16.114707947 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:16.143233061 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:16.338680029 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:16.338699102 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:16.338756084 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:16.338757038 CEST	49730	1994	192.168.2.4	46.246.6.20
Apr 23, 2024 00:07:16.401595116 CEST	1994	49730	46.246.6.20	192.168.2.4
Apr 23, 2024 00:07:16.401660919 CEST	49730	1994	192.168.2.4	46.246.6.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 00:06:11.604895115 CEST	56979	53	192.168.2.4	1.1.1.1
Apr 23, 2024 00:06:11.749433041 CEST	53	56979	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 23, 2024 00:06:11.604895115 CEST	192.168.2.4	1.1.1.1	0x3a9a	Standard query (0)	patria.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 23, 2024 00:06:11.749433041 CEST	1.1.1.1	192.168.2.4	0x3a9a	No error (0)	patria.duckdns.org		46.246.6.20	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	00:06:03
Start date:	23/04/2024
Path:	C:\Users\user\Desktop\xVcsGL5R1Nbh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\xVcsGL5R1Nbh.exe"
Imagebase:	0x350000
File size:	32'768 bytes
MD5 hash:	CBE87D6ABF69BDD3877821F493E6F6B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.1701540964.0000000000352000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.2420818601.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:07:14
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\user\Desktop\xVcsGL5R1Nbh.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:07:14
Start date:	23/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	16%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.1%
Total number of Nodes:	144
Total number of Limit Nodes:	7

Executed Functions

Function 011B19F0 Relevance: 3.9, Strings: 2, Instructions: 1396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 011B26A6
, xrefs: 011B269C

Memory Dump Source

Source File: 00000000.00000002.2420781100.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11b0000_xVcsGL5R1Nbh.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: fde3ef65356cb098e279e0d77ddba1d9aa0f4c99193250fc574896f8ea76275c
Instruction ID: 4e6fefd2e4abe46c9f540da4576afac1d129ec9873947dff5eee6177a3f05c6a
Opcode Fuzzy Hash: fde3ef65356cb098e279e0d77ddba1d9aa0f4c99193250fc574896f8ea76275c
Instruction Fuzzy Hash: CDC29D30B002249FDB18EB29C994BED77E6AF88308F1180A9E5099B7A5DF35DD45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04D02523 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 04D025A3

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 329ed2822097e6f0325c17bff757981be7bf8051a6f9bdde2f7b693786a72379
Instruction ID: 75883514b6966948ed62ce24830bb40dfdf9b8bf6354ba6327ef9e3fa5d0da83
Opcode Fuzzy Hash: 329ed2822097e6f0325c17bff757981be7bf8051a6f9bdde2f7b693786a72379
Instruction Fuzzy Hash: 35219F755097809FDB228F25DC58B52BFF4EF06310F0884DAE9858F5A3D275E908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04D0255A Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 04D025A3

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: d8a9f048c09f63c8be1a6b979930d85cb3bc10bf3c58c3697d3bc60d7ebf60a0
Instruction ID: b6cbf88bfa5c3429171f8f4259b6b2e97c98e01d8c1d6c86021a68d931603ec5
Opcode Fuzzy Hash: d8a9f048c09f63c8be1a6b979930d85cb3bc10bf3c58c3697d3bc60d7ebf60a0
Instruction Fuzzy Hash: 511173756012049FDB20CF55D948B56FBE4FF18320F08C4AADD458BA95D375E814DF61

Uniqueness

Uniqueness Score: -1.00%

Function 011B03E8 Relevance: 1.6, APIs: 1, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 011B041F

Memory Dump Source

Source File: 00000000.00000002.2420781100.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11b0000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 19441b97515637d07f634651410d1108a64f756e4c05598223449adc9a8e95a9
Instruction ID: 2ddd392513db6caae28398d2e6bf543872b9bd4275aebe48cbd7e3cf23eb3c8f
Opcode Fuzzy Hash: 19441b97515637d07f634651410d1108a64f756e4c05598223449adc9a8e95a9
Instruction Fuzzy Hash: 13319371A002018FDB18DF39C9C55DEB7F6EF88214B548069E809DB79ADB38DD46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 011B03F8 Relevance: 1.6, APIs: 1, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 011B041F

Memory Dump Source

Source File: 00000000.00000002.2420781100.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11b0000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: aa398d341969aa277f6e678147b5b04b658b7d4e922ad8daf76656cb7a499c2e
Instruction ID: d04dc60947a0bfc07f0fa748d21a8d5b6505d4afc6ac22979b0c3027401245f0
Opcode Fuzzy Hash: aa398d341969aa277f6e678147b5b04b658b7d4e922ad8daf76656cb7a499c2e
Instruction Fuzzy Hash: 6D318D71A002008FCB18DF79C9C45DEB7F6EF88214B588069E809DB79ADB38DD45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B1B5DE Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00B1B69D

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1faff24e8affed70fae36168f619e19d796832284ddf48ff0604fc0db63b1f9b
Instruction ID: 3a97598f686e0e4e46d584a8c709a529de845a72b303833ce8c0c33f9051636c
Opcode Fuzzy Hash: 1faff24e8affed70fae36168f619e19d796832284ddf48ff0604fc0db63b1f9b
Instruction Fuzzy Hash: 6731C3B1504780AFE712CF65CC44FA2BFE8EF16314F08849AE9848B652D335E809DB71

Uniqueness

Uniqueness Score: -1.00%

Function 04D0202E Relevance: 1.6, APIs: 1, Instructions: 99
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(?,00000E24), ref: 04D020F5

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a636459a89549ddd2075c9d057161fa3b42c88e9e7b70dab7c91f596d5536251
Instruction ID: 01cd3cdcce5830ac6faf3470749462729e3ecfda35d5225a091e305aba1e8f4c
Opcode Fuzzy Hash: a636459a89549ddd2075c9d057161fa3b42c88e9e7b70dab7c91f596d5536251
Instruction Fuzzy Hash: 65315072504744AFE7228F65CC44FA6BBFCEF15310F08859AE9459B692D324E908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B1BB4B Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 00B1BC12

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 732eb3595b95f9f5578ebd7ebfbf0641f952c931a82f28c0749fee675944f7d6
Instruction ID: 7b155efae500e0084fc75bf3dfd2b2e37e0428318e580938f7f3646a38b010a5
Opcode Fuzzy Hash: 732eb3595b95f9f5578ebd7ebfbf0641f952c931a82f28c0749fee675944f7d6
Instruction Fuzzy Hash: E3317E6510E7C06FD3138B358C61A62BFB4EF47610B0E85CBD8C49F6A3D219A909C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00B1A7C7 Relevance: 1.6, APIs: 1, Instructions: 95
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 00B1A879

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 33dd52d6321f35b3e34d86ade6b2bce0dbef192e7d7670f47ec26c0ccf249eeb
Instruction ID: dfdd1f6762b166db0053e651d384030b1d5302d11770028a811cbe15df1a8818
Opcode Fuzzy Hash: 33dd52d6321f35b3e34d86ade6b2bce0dbef192e7d7670f47ec26c0ccf249eeb
Instruction Fuzzy Hash: 7331B5B14083806FE7228B51CC44FA7BFE8EF16310F08849AE9848B693D264E909C771

Uniqueness

Uniqueness Score: -1.00%

Function 04D0099C Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 04D00A63

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 7d54de7bf9cad54ce472467827e39068d3ed24be02ddf500f3d7f997b44341de
Instruction ID: 21fb3a1de900346013b14d29e41bf4d5f477a38eb7263e67ed8a02e7e31ab05f
Opcode Fuzzy Hash: 7d54de7bf9cad54ce472467827e39068d3ed24be02ddf500f3d7f997b44341de
Instruction Fuzzy Hash: B831C2B2500340AFE721CF51DD44FA6FBACEF44314F04889AFA499B682D374A948CB71

Uniqueness

Uniqueness Score: -1.00%

Function 04D00894 Relevance: 1.6, APIs: 1, Instructions: 92
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessTimes.KERNELBASE(?,00000E24,D366EE2A,00000000,00000000,00000000,00000000), ref: 04D00931

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: ee0c075b6a5af14a0d5d06e1399b738fcdaa0b64d9911587cfd181ef3d1c9c0f
Instruction ID: f5bdb6372efa010a29c29f1ad676571c5e2251b61fba5fc1962d6d0c22f4a4af
Opcode Fuzzy Hash: ee0c075b6a5af14a0d5d06e1399b738fcdaa0b64d9911587cfd181ef3d1c9c0f
Instruction Fuzzy Hash: 7731C8725057806FE7228F21DC44B96BFB8EF57324F09C4DAE9849F193D225A909C771

Uniqueness

Uniqueness Score: -1.00%

Function 04D00190 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 04D00227

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: e5d076ddd1615537731cd7c761b0676266bd4d2daa4a0c171dc721449b0a3fdf
Instruction ID: d75c8df9dd9062357f0482ee3c9215c4f62f8683cac20b0bb53f1eaaa7e4be16
Opcode Fuzzy Hash: e5d076ddd1615537731cd7c761b0676266bd4d2daa4a0c171dc721449b0a3fdf
Instruction Fuzzy Hash: 64319172504384AFEB22CF65DC45FA7BBE8EF45210F08849AE944DB692D324E948CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00B1A612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 00B1A6B9

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 24924953df064d5cf84ce9c030bd9636ce6bcdad7fdc08d95e8e691e31e8bf0e
Instruction ID: 2b2ecc7097f5f46103af6c6573822897da40d832545770af3d5f54877423b289
Opcode Fuzzy Hash: 24924953df064d5cf84ce9c030bd9636ce6bcdad7fdc08d95e8e691e31e8bf0e
Instruction Fuzzy Hash: A031AFB15097806FE712CB25CC85B96BFF8EF16310F08849AE984DB292D374E909C762

Uniqueness

Uniqueness Score: -1.00%

Function 04D0205A Relevance: 1.6, APIs: 1, Instructions: 86
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(?,00000E24), ref: 04D020F5

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ff10bde0a5bc63613653e95700766afbc27561610c156df6a4499d8ecaa919bf
Instruction ID: 8aad6d21b8fe13b459fd3fb2e1ce80f8fbf797eb5f0c5343b576aad28ad9eb19
Opcode Fuzzy Hash: ff10bde0a5bc63613653e95700766afbc27561610c156df6a4499d8ecaa919bf
Instruction Fuzzy Hash: AB217EB2600704AEEB219E55CC44FA7BBECEF18714F04C45AE945D7A91E324F948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04D009BE Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 04D00A63

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: dda1987d300236e4d0327527c6435860cc0c97471b4719ef0e841d97d2308ae5
Instruction ID: ddbbb8fff1c15475961b9212799072b705e05297d17d58fec8ab46c97098909b
Opcode Fuzzy Hash: dda1987d300236e4d0327527c6435860cc0c97471b4719ef0e841d97d2308ae5
Instruction Fuzzy Hash: 3121BFB2100200AEEB219F51DD84FAAF7ECEB14314F04885AFA499B681D774E5488B71

Uniqueness

Uniqueness Score: -1.00%

Function 04D00FC0 Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNELBASE(?,00000E24,?,?), ref: 04D01066

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 0fea6dcbfb5ee35ce7d5c9a9378feb18dcf037b954a310cb8b12353fd4ccecc0
Instruction ID: 5b9e0842da4904d199e1a326c3cbb9b3209045fb56fec662ef9e604616bca637
Opcode Fuzzy Hash: 0fea6dcbfb5ee35ce7d5c9a9378feb18dcf037b954a310cb8b12353fd4ccecc0
Instruction Fuzzy Hash: D631917150D3C16FD3128B258C55B62BFB8EF87610F0980DBE884DF693D225A948C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 04D022CD Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 04D0235C

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: e386c2e25e83ac759aafc82865a913504409a14a069060298bc78864ea07ddc9
Instruction ID: 9d93330a73ff4e7b6530b7ff5509af65a64809cb066979a6144b63dddbae07fd
Opcode Fuzzy Hash: e386c2e25e83ac759aafc82865a913504409a14a069060298bc78864ea07ddc9
Instruction Fuzzy Hash: 74216B715093849FDB22CF25DC44B52BFF8EF0A310F0884DAE984CF1A2D264A909CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00B1A370 Relevance: 1.6, APIs: 1, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,D366EE2A,00000000,00000000,00000000,00000000), ref: 00B1A40C

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 9a6e0978bd7201b54dc630c57d861dce8e4c84927b5e1a0f34fbab1f18bdbf0f
Instruction ID: 1b9e0207907968e66132c65e233cd36a8c0e0f7cbb78dd0c941247e45d622b47
Opcode Fuzzy Hash: 9a6e0978bd7201b54dc630c57d861dce8e4c84927b5e1a0f34fbab1f18bdbf0f
Instruction Fuzzy Hash: 26217AB1605740AFD721CF15DC84FA6BBF8EF15620F08849AE985DB292D364F948CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00B1B6F4 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,D366EE2A,00000000,00000000,00000000,00000000), ref: 00B1B789

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 9870b047160dab0b48834b8d2edcd2e38f0876805b26c2009e62dcaf67482456
Instruction ID: ec014f6b5c5d104f19df067bf97b9bb0940abf2d7e908c9fe7c76e0fca15efad
Opcode Fuzzy Hash: 9870b047160dab0b48834b8d2edcd2e38f0876805b26c2009e62dcaf67482456
Instruction Fuzzy Hash: F921F8B55097806FE7128B25DC81BA2BFACEF57720F0980D6ED849B293D264AD09C771

Uniqueness

Uniqueness Score: -1.00%

Function 04D026A5 Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E24,D366EE2A,00000000,00000000,00000000,00000000), ref: 04D0272C

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 5181e9631946277f3abea66b7f8137df8e9f9b60c8065cb686ed6f3dac22d4ec
Instruction ID: 7ebee4d481a9bf84b97c84a8b74ba5a4144e8e990ac11f780928d8246651ef2c
Opcode Fuzzy Hash: 5181e9631946277f3abea66b7f8137df8e9f9b60c8065cb686ed6f3dac22d4ec
Instruction Fuzzy Hash: 1821C1B15093806FE712CB24DC44B96BFA8EF46320F0884DAE944DF292D264A908C771

Uniqueness

Uniqueness Score: -1.00%

Function 04D00346 Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 04D003DA

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: d0d3526f2f3a9c1c09a4d1a4118e84d06672e91f91fcbf2a77ff0ab5537d0eaf
Instruction ID: 6de27596a1204217d4d3bd541ecb05d500afacd470107b85d9377541f2ada943
Opcode Fuzzy Hash: d0d3526f2f3a9c1c09a4d1a4118e84d06672e91f91fcbf2a77ff0ab5537d0eaf
Instruction Fuzzy Hash: 2C21ADB1504384AFE722CF55DC44F96FBF8EF19224F08849AE9849B692D375F508CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B1BC3E Relevance: 1.6, APIs: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 00B1BCCA

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: fa5df2441bfd38e360ea46490613ebac405be2082b864da0cf42501574f55c0b
Instruction ID: f40e047245708678dc07db98b8ab703e89a727d355071fabdd628422e8efd7db
Opcode Fuzzy Hash: fa5df2441bfd38e360ea46490613ebac405be2082b864da0cf42501574f55c0b
Instruction Fuzzy Hash: 6E21D071505380AFE722CF51DC44F96FFF8EF05220F08889EE9858B692C375A808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B1A462 Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,D366EE2A,00000000,00000000,00000000,00000000), ref: 00B1A4F8

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: c3b87455d3d155f4a6db11950429488e2ed589004606ac8de0638620b7a81bab
Instruction ID: dfcf68eb6e5fe81b0c6904a20a25903622cd8f29d1105dfe805e0edb43b53301
Opcode Fuzzy Hash: c3b87455d3d155f4a6db11950429488e2ed589004606ac8de0638620b7a81bab
Instruction Fuzzy Hash: 3B21B2B25057806FE7228F11CC44FA7BFF8EF56220F08849AE945DB692D264E848C771

Uniqueness

Uniqueness Score: -1.00%

Function 04D0239C Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 04D02422

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 08cafeb6291d745e58ff05ae5423799f95ccf5d9a03a73de34e85114d666f70b
Instruction ID: 599f66edc6d4d18cb32a17ad3ed8021294372d77f31f3e12a6a73a0c91652838
Opcode Fuzzy Hash: 08cafeb6291d745e58ff05ae5423799f95ccf5d9a03a73de34e85114d666f70b
Instruction Fuzzy Hash: 422165B15093805FD7128F25DC55B52BFA8AF56314F09C4DAED49CF293D225E809C761

Uniqueness

Uniqueness Score: -1.00%

Function 04D001B6 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 04D00227

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 2a9d2ac1dca726ddc2d2062cd38b534ef602dafb319986f96eec4e4366c1a658
Instruction ID: b86c4f84cb11ce7c596ae36a87b21d412d9f7346d0ecb93ab2da32d7b7274c13
Opcode Fuzzy Hash: 2a9d2ac1dca726ddc2d2062cd38b534ef602dafb319986f96eec4e4366c1a658
Instruction Fuzzy Hash: A621D172600204AFEB21DF65DD44FAABBECEF14214F04C46AED48DB681D374E5088B71

Uniqueness

Uniqueness Score: -1.00%

Function 00B1B61E Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00B1B69D

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7d02863969c1b7df2fa9e6e6b6408b3ca29e9d57dc9edd44e6008a4043c1fb43
Instruction ID: 6771011f4d19b1438f4b330cd85298bb4d643330c827e6cb00d41f780983ebbb
Opcode Fuzzy Hash: 7d02863969c1b7df2fa9e6e6b6408b3ca29e9d57dc9edd44e6008a4043c1fb43
Instruction Fuzzy Hash: B3219071600600AFE721CF65CD85FA6FBE8EF28324F0884A9E9499B651D375E848CB71

Uniqueness

Uniqueness Score: -1.00%

Function 04D000AA Relevance: 1.6, APIs: 1, Instructions: 75registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,D366EE2A,00000000,00000000,00000000,00000000), ref: 04D0013C

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 2034cac66d4cfb4d6b18ca2b1b2b77d4864223b0c092ba99e5f9ff0282cfc01c
Instruction ID: 6d5e608d212783593ed58bba58a35fd19b56cbb04f5259fad4bf0f8aca47b041
Opcode Fuzzy Hash: 2034cac66d4cfb4d6b18ca2b1b2b77d4864223b0c092ba99e5f9ff0282cfc01c
Instruction Fuzzy Hash: 42219AB2504744AFD722CF11DC84FA7BBF8EF15620F08849AE945DB692D364F908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00B1BD23 Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,?,?,?,?), ref: 00B1BDA0

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: b32a6222fb9d7e9996b39907e462656afae5ece92e0d40fbce99c9e566a52054
Instruction ID: e7a9c8fa101c3373935071f97d4ff041322f41828ee3e38f726aa8bd115b4e52
Opcode Fuzzy Hash: b32a6222fb9d7e9996b39907e462656afae5ece92e0d40fbce99c9e566a52054
Instruction Fuzzy Hash: DD217E755493C09FDB228F619C84B96BFB0EF17320F0D84DAD9848F563D2299958CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00B1A7FA Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 00B1A879

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 9a1745a6bf7eaa97bdb9ced92e9158cbd69f751fea94815982bb669c8edf7702
Instruction ID: f400e89fcd4d85acc24c6bf2524d190ccb94941f4d206eed70e3a1f180421ccd
Opcode Fuzzy Hash: 9a1745a6bf7eaa97bdb9ced92e9158cbd69f751fea94815982bb669c8edf7702
Instruction Fuzzy Hash: 7E21D1B2500204AEE7218F51CC84FABFBECEF24314F04845AED459B641D364F8498BB2

Uniqueness

Uniqueness Score: -1.00%

Function 04D0278F Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,D366EE2A,00000000,00000000,00000000,00000000), ref: 04D0280B

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: eb87f893c4716ef27812f93f1d615f76b1c95a43a9f761fb0caa4fa7df578542
Instruction ID: 970ff74f673b8d6d42c5c601527e64112e92f2d41f66801c6ef5bea6fe48e9b2
Opcode Fuzzy Hash: eb87f893c4716ef27812f93f1d615f76b1c95a43a9f761fb0caa4fa7df578542
Instruction Fuzzy Hash: 5C21C2B15053806FE722CF21CC44FA7BFA8EF45220F08C49AE944DB292D264E908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04D02873 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,D366EE2A,00000000,00000000,00000000,00000000), ref: 04D028EF

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: eb87f893c4716ef27812f93f1d615f76b1c95a43a9f761fb0caa4fa7df578542
Instruction ID: 6b9072402d3777212d11b33bb1ef438c8a469ef8741176b0b9ce2f3ec891c143
Opcode Fuzzy Hash: eb87f893c4716ef27812f93f1d615f76b1c95a43a9f761fb0caa4fa7df578542
Instruction Fuzzy Hash: 2D21C2B15053806FE712CF21DC44FA6BFA8EF46220F08C49AE944DB292D264E908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B1A646 Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 00B1A6B9

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 6053af03004080cfd158533e8b5f4ad9346d4e3e0e84a608722a23c16f804b32
Instruction ID: fb616415987cebced37d99b61c964ca516ca9755166f6117e505c06f2d5be9d2
Opcode Fuzzy Hash: 6053af03004080cfd158533e8b5f4ad9346d4e3e0e84a608722a23c16f804b32
Instruction Fuzzy Hash: D42180B16012009FE710DF65CD85BA6FBE8EF15324F0884AAE948DB681D375F949CB62

Uniqueness

Uniqueness Score: -1.00%

Function 04D03796 Relevance: 1.6, APIs: 1, Instructions: 71registryCOMMON

Download Yara Rule

APIs

RegDeleteKeyW.ADVAPI32(?,00000E24,D366EE2A,00000000,00000000,00000000,00000000), ref: 04D0381C

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: Delete
String ID:
API String ID: 1035893169-0
Opcode ID: 85c5de2b79361f8deb713c06aeb7d90429b0826589aa13dae84edb40c2c0f60c
Instruction ID: f0cbc36e0b44ed12e056c5f87f46bd1895de31203f6951dc0af563c5d7251c00
Opcode Fuzzy Hash: 85c5de2b79361f8deb713c06aeb7d90429b0826589aa13dae84edb40c2c0f60c
Instruction Fuzzy Hash: F721A1B15093806FD7228B51DC45FA6BFA8EF46220F08C0DBE9449B692D264F908C761

Uniqueness

Uniqueness Score: -1.00%

Function 00B1B9D6 Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,D366EE2A,00000000,00000000,00000000,00000000), ref: 00B1BA55

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: e28435b25a859fdd2298399e33e3543e84e900194e259b9fad5f9d1bb9dd5f56
Instruction ID: d1ab49c378ad54efb74b5ca610cda1126eb5e27902d47873f8179522e5141ea3
Opcode Fuzzy Hash: e28435b25a859fdd2298399e33e3543e84e900194e259b9fad5f9d1bb9dd5f56
Instruction Fuzzy Hash: 27219F71505780AFDB22CF51DC44FA7BFB8EF55320F08849AE9859B652D225A908CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00B1A140 Relevance: 1.6, APIs: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 00B1A1C1

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 48fe0aa1cb92268fbb172e3a8302ac30bbaf00760eaae2237e1ec5e2309609ac
Instruction ID: 3ff054450a047a6facc1da904b125dfd2244acca3cbb803340780ce4c9d5a1dd
Opcode Fuzzy Hash: 48fe0aa1cb92268fbb172e3a8302ac30bbaf00760eaae2237e1ec5e2309609ac
Instruction Fuzzy Hash: E821BA3150D3C09FD7128B61CC54A92BFB0EF47220F0A84DBD9848F5A3D229A919CB62

Uniqueness

Uniqueness Score: -1.00%

Function 04D02207 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,D366EE2A,00000000,00000000,00000000,00000000), ref: 04D02283

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 6f6a415218493b7d6428f6a93ae2c648ae858893de598b588ef1e94b162aa149
Instruction ID: 0de410ab13c2c47a52451e453c6872efb09075de624a1cd6fdb0858a456ee431
Opcode Fuzzy Hash: 6f6a415218493b7d6428f6a93ae2c648ae858893de598b588ef1e94b162aa149
Instruction Fuzzy Hash: C321A1B15097806FD722CF51CC44FA6BFA8EF55320F08C49AE9449B692D274A908C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 00B1A392 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,D366EE2A,00000000,00000000,00000000,00000000), ref: 00B1A40C

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: de8ffdbee4527716cb658626266d79c81ee48004cbdc77408ffb8d8453e7762f
Instruction ID: 4583e813a06d4a3a90524135298f0bec79d89ad7d0f18feabb18b1e0d53e63b8
Opcode Fuzzy Hash: de8ffdbee4527716cb658626266d79c81ee48004cbdc77408ffb8d8453e7762f
Instruction Fuzzy Hash: 7621AEB16006009FE720CE15DC84FA6B7ECEF14710F48C4AAE945DB791D360F948CA72

Uniqueness

Uniqueness Score: -1.00%

Function 04D00366 Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 04D003DA

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 8d0ce4bff46edebf354d14c33efd12729928157a0f49e1d2ce799f7e7e5de36c
Instruction ID: 98cea06f179b2787cb71446765f1395306c85be66961d84a9d0034f26f6ecc90
Opcode Fuzzy Hash: 8d0ce4bff46edebf354d14c33efd12729928157a0f49e1d2ce799f7e7e5de36c
Instruction Fuzzy Hash: 7B21F0B1500204AFEB22CF15DD84FA6FBE8EF28224F04C45AE9459B681E375F408CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B1BC5E Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 00B1BCCA

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: e0660edcbbbb5770633e5831da69421311265b1a7339bf05b9e589fedb5968f3
Instruction ID: d95dd047585638722db19cf14ffc4384c735d056d438f26a16dbea7d24828cb9
Opcode Fuzzy Hash: e0660edcbbbb5770633e5831da69421311265b1a7339bf05b9e589fedb5968f3
Instruction Fuzzy Hash: F621D171500600AFEB21CF55DD84FA6FBE8EF18320F1488AAE9458B691D375E408CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 04D01282 Relevance: 1.6, APIs: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E24), ref: 04D0130B

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 30ae0805912f6a7a80dca6ced1075d9f61caf3bee3de08768c30f07190b5566f
Instruction ID: 4aa23d9f99b657cc498f53c05271dda9af624c1f3be99e9df08dced57edcc277
Opcode Fuzzy Hash: 30ae0805912f6a7a80dca6ced1075d9f61caf3bee3de08768c30f07190b5566f
Instruction Fuzzy Hash: 5A11B1715043406FE721CF11DC85FA6FBA8EF46720F08809AF9449B692D265B948CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00B1A710 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00B1A780

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 1528c38994cea46809309f942d6a0cae9ebca836c3f7c0776bab08d0cf12fa0d
Instruction ID: 64e91e7cb573cca21a6cf868e6354f297ae03ffa8412090158de58587b4c9455
Opcode Fuzzy Hash: 1528c38994cea46809309f942d6a0cae9ebca836c3f7c0776bab08d0cf12fa0d
Instruction Fuzzy Hash: 4021D2B59053809FD7118F15DD85B92BFB4EF02324F0884EAEC458B693D335AA09DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 04D000CA Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,D366EE2A,00000000,00000000,00000000,00000000), ref: 04D0013C

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 0f3f007d93a6e186990f8e54f84202bfa79b24368acf2f5fffc07db63032f38d
Instruction ID: 13eebb0554e3a7c4849480eaeaac1532cd3ef326707804a2046c1b317306e68c
Opcode Fuzzy Hash: 0f3f007d93a6e186990f8e54f84202bfa79b24368acf2f5fffc07db63032f38d
Instruction Fuzzy Hash: 78116D72600604AEE722CE15DC85FA7B7E8EF14620F08C45AE945DB692D364F508CA62

Uniqueness

Uniqueness Score: -1.00%

Function 04D02E09 Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

LoadLibraryShim.MSCOREE(?,?,?,?), ref: 04D02E85

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: LibraryLoadShim
String ID:
API String ID: 1475914169-0
Opcode ID: c94ce3df336a6d7e0aa5fdfaae231cd5de6564e46b26ccf6ffae25e2d18326fb
Instruction ID: b2218ea92276bc589a7589322c8d86aae60d9fc08da5a1a2c127b1027a75a8d5
Opcode Fuzzy Hash: c94ce3df336a6d7e0aa5fdfaae231cd5de6564e46b26ccf6ffae25e2d18326fb
Instruction Fuzzy Hash: 61218EB15093809FD7228E15DC44B62BFF8EF46314F0980CAED848B293D265A908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B1A486 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,D366EE2A,00000000,00000000,00000000,00000000), ref: 00B1A4F8

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b8b82662667df609aef3b7090762a49c607719b9dbaa8604d651ff68c1acd43e
Instruction ID: bc1c7ea0b839ac47116fc7c7861e5fc2d3a41cd2e25f2facfd9ca106ad255136
Opcode Fuzzy Hash: b8b82662667df609aef3b7090762a49c607719b9dbaa8604d651ff68c1acd43e
Instruction Fuzzy Hash: 6A1181B6600600AFE7218E15DC45FA7BBECEF24724F04849AED45DA791D374F948CA72

Uniqueness

Uniqueness Score: -1.00%

Function 04D008D2 Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNELBASE(?,00000E24,D366EE2A,00000000,00000000,00000000,00000000), ref: 04D00931

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: df066e68ce5e6f61f29d19a0d6f4a3c8a4c3ebf766fb6b7d4fe53fa7fe54b1d8
Instruction ID: ac6211f0fcb7922e514122722ebd044b4f73d0871d071795de630b410a698d53
Opcode Fuzzy Hash: df066e68ce5e6f61f29d19a0d6f4a3c8a4c3ebf766fb6b7d4fe53fa7fe54b1d8
Instruction Fuzzy Hash: C7119672600600AFE7218F55EC44FA6B7E8EF15324F08C45AEA459B691D375F508CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 04D03ADD Relevance: 1.6, APIs: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 04D03B51

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 48e82f6cf7ae421330adabb35c0dd83838207dcc70f93f4c7a53113db0c4a036
Instruction ID: 32cbaeeac194ede3913d09cc652dda7ba99a79be4f6fc9efccd452624f76024e
Opcode Fuzzy Hash: 48e82f6cf7ae421330adabb35c0dd83838207dcc70f93f4c7a53113db0c4a036
Instruction Fuzzy Hash: 70219A715093C09FDB238F25CC44A52BFB4EF17224F0984DBED848F5A3D225A818DB62

Uniqueness

Uniqueness Score: -1.00%

Function 04D02896 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,D366EE2A,00000000,00000000,00000000,00000000), ref: 04D028EF

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 3ea0b35430bfc3ea984a918e4735423e845e0fd376a1f1d4a77ec70bac7a2d89
Instruction ID: e2f6418dd419fc4b3b8d6cc271c511c555210ce38a2e582105357359e06e7b6f
Opcode Fuzzy Hash: 3ea0b35430bfc3ea984a918e4735423e845e0fd376a1f1d4a77ec70bac7a2d89
Instruction Fuzzy Hash: 7711C4B16012049FEB21CF55DC44BAAB7A8EF15324F08C4AAED45DB681D374F908CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 04D027B2 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,D366EE2A,00000000,00000000,00000000,00000000), ref: 04D0280B

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 3ea0b35430bfc3ea984a918e4735423e845e0fd376a1f1d4a77ec70bac7a2d89
Instruction ID: 84f222dbcfee4899fa1a9d5e5068f9f9f9347d3b28e2ab459f08202c49884633
Opcode Fuzzy Hash: 3ea0b35430bfc3ea984a918e4735423e845e0fd376a1f1d4a77ec70bac7a2d89
Instruction Fuzzy Hash: 5111C4756002009FE721CF55DC84BAAF7A8EF14324F04C4AAED45DB681D374F9088BB1

Uniqueness

Uniqueness Score: -1.00%

Function 04D026D6 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E24,D366EE2A,00000000,00000000,00000000,00000000), ref: 04D0272C

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 6d22eb2741e1f2a39266f2049044687d6515545b13c7a7e2f697bc950f6b07ef
Instruction ID: 790b2d015aea8c9b28d8e06b4565a41d56421b325efee703d1278ae11bb432f7
Opcode Fuzzy Hash: 6d22eb2741e1f2a39266f2049044687d6515545b13c7a7e2f697bc950f6b07ef
Instruction Fuzzy Hash: 6011E371600200AFEB118F15DC48BAAB7ECEF54324F04C4AAED45DB685E374F9088BB1

Uniqueness

Uniqueness Score: -1.00%

Function 04D00007 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000E24,?,?), ref: 04D00082

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 0db785b0e3b2eca2dac3b88230c43d2d328e846dc977382a102903d54a945312
Instruction ID: dc4fa6ea3b9f15b23d42778a56c0241745eec09826aab9fbe237897d58edbc0a
Opcode Fuzzy Hash: 0db785b0e3b2eca2dac3b88230c43d2d328e846dc977382a102903d54a945312
Instruction Fuzzy Hash: 2511B6715097806FD3118B25CC45B66BFB4EF86610F1981CFE8489B693D225B919CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00B1AC03 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00B1AC6E

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7c615285f44c9d4869ff64c3d7d3cbdf7cfbbba026845c1ef76f5e8514a37f7e
Instruction ID: e4459895d7858387767713a926af24828ae2a50dfcc57ccd242ad2660d7dd2f3
Opcode Fuzzy Hash: 7c615285f44c9d4869ff64c3d7d3cbdf7cfbbba026845c1ef76f5e8514a37f7e
Instruction Fuzzy Hash: 17118471509380AFDB228F51DC44B62FFF4EF4A320F0884DAED858B562D275A918DB61

Uniqueness

Uniqueness Score: -1.00%

Function 04D00E2C Relevance: 1.6, APIs: 1, Instructions: 60networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 04D00E9A

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 4f9e4ea0b2595c4f02062ee45c102c81d45ac4d09faf85fcec1203ad2df6d1f0
Instruction ID: 8d5676862f63747f661e03791482ece32d8f12c56fc47988ba9c3c9a8d5f7097
Opcode Fuzzy Hash: 4f9e4ea0b2595c4f02062ee45c102c81d45ac4d09faf85fcec1203ad2df6d1f0
Instruction Fuzzy Hash: D8219D71504380AFDB22CF61DC84B52FFF4FF09220F08889AED898B562D375A918CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B1B9F6 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,D366EE2A,00000000,00000000,00000000,00000000), ref: 00B1BA55

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b07d61d82f330d74419c63e200854e3f701ce04480750977c29dd21b0042f142
Instruction ID: 71bb51619dcbafba14271159c0dc509b0a57f96720a5c71e09e4b900731551fc
Opcode Fuzzy Hash: b07d61d82f330d74419c63e200854e3f701ce04480750977c29dd21b0042f142
Instruction Fuzzy Hash: 6D11B271500600AFEB21CF51DC44FA6FBE8EF24324F14849AE9459A651D775E5488BB1

Uniqueness

Uniqueness Score: -1.00%

Function 04D0222A Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,D366EE2A,00000000,00000000,00000000,00000000), ref: 04D02283

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 62bfad2d2714342ff581fb75374ed1839a75ab08adca179ab6eb9b948ea1f6ae
Instruction ID: 0033175a93359b09e7d8553397d03087f85980ea369384e1c202d7f81dd7c498
Opcode Fuzzy Hash: 62bfad2d2714342ff581fb75374ed1839a75ab08adca179ab6eb9b948ea1f6ae
Instruction Fuzzy Hash: A211A371500600AFEB21CF51DD44BA6FBA8EF65324F14C89AED459B685D374F9088BB1

Uniqueness

Uniqueness Score: -1.00%

Function 04D037BE Relevance: 1.6, APIs: 1, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegDeleteKeyW.ADVAPI32(?,00000E24,D366EE2A,00000000,00000000,00000000,00000000), ref: 04D0381C

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: Delete
String ID:
API String ID: 1035893169-0
Opcode ID: 953bafab987c24f9307bd2ecfaeb31c13ab3c6acff47f866dbc0f87225ece2ae
Instruction ID: 517ee24a7f14e7a95ca9d2a64f4e38989a8e88f4b14a4e6718d06a4c8fe617e7
Opcode Fuzzy Hash: 953bafab987c24f9307bd2ecfaeb31c13ab3c6acff47f866dbc0f87225ece2ae
Instruction Fuzzy Hash: EF1182B1600600AEE7218F16DC45BA6BBDCEF55624F08C09AED459B681E764F508CAB5

Uniqueness

Uniqueness Score: -1.00%

Function 04D03EDD Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 04D03F3D

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: bda65719a506692749e533ffefdb35b6bee72226c1a6553a16d73f13ca84c6a9
Instruction ID: 76f0ee34428e51c553bf6afa3f2f4dacd41cdb9cb6ae0cc661d36831d317e086
Opcode Fuzzy Hash: bda65719a506692749e533ffefdb35b6bee72226c1a6553a16d73f13ca84c6a9
Instruction Fuzzy Hash: F411C475509780AFDB228F15DC44B52FFB4EF16220F08849EED858B5A3D275A818CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04D012A2 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E24), ref: 04D0130B

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a8e73c9bed01d9fbf855e3b1e04c5b9f6f3c823645427de5a77ba04f1a3290bd
Instruction ID: 391434873f96ae8236265b5c8afea759833d3fd8146221aa5e71b9e137a8b8d9
Opcode Fuzzy Hash: a8e73c9bed01d9fbf855e3b1e04c5b9f6f3c823645427de5a77ba04f1a3290bd
Instruction Fuzzy Hash: 0111E571600200AEEB20CF11DD41FAAF7A8DF15724F14C09AFE445BBD1D2B5F548CA65

Uniqueness

Uniqueness Score: -1.00%

Function 00B1A2AE Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00B1A30C

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 84dcca6981d6f6137e51b596be2c05817f1a3d8e6fdf651d39c4bec1ba30fde9
Instruction ID: 4f381ed4ee06a12a253bc5aca3edf840e545ae7bb694d78df92b14078618e7e8
Opcode Fuzzy Hash: 84dcca6981d6f6137e51b596be2c05817f1a3d8e6fdf651d39c4bec1ba30fde9
Instruction Fuzzy Hash: 1A118F715093C06FDB228B25DC54BA2BFB4DF57224F0980CBED848F6A3D265A958C762

Uniqueness

Uniqueness Score: -1.00%

Function 04D02306 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 04D0235C

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: b8263aee4b01473c4dfcc2a7d3ab16a869b78e68a029b0e791b9f239889d4d9b
Instruction ID: 423e341ee2222a98134b77785019890bb2f168a0e625329b2ec7516e15d4b79c
Opcode Fuzzy Hash: b8263aee4b01473c4dfcc2a7d3ab16a869b78e68a029b0e791b9f239889d4d9b
Instruction Fuzzy Hash: C8116D716012448FEB20CF55D888B56F7E8EF18320F08C4AADD49CB6A2D334F948CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00B1AD9F Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 00B1AE00

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: e18abf1654d8a8f3bb404028b46a4c3e1699c6802cf699d66396fd5e6e2c7546
Instruction ID: 44468d80b9df531cd53bc18599a2e825920a24721c16ca644d05a13d296b575f
Opcode Fuzzy Hash: e18abf1654d8a8f3bb404028b46a4c3e1699c6802cf699d66396fd5e6e2c7546
Instruction Fuzzy Hash: 07119D715493809FDB128F11DC44B52BFB4EF46224F1884DAED858F293D279A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 04D023DA Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 04D02422

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: d0612235cc3d239f5ab1fff3b6b0ff5c5c22b640650af296483233abb49db55b
Instruction ID: 5b0b1539de0553ea70f2286ed3690ca744df3559eba96db57ca7138c62691ef2
Opcode Fuzzy Hash: d0612235cc3d239f5ab1fff3b6b0ff5c5c22b640650af296483233abb49db55b
Instruction Fuzzy Hash: BE1165716012008FEB50CF15DC89766FBD8FF25720F08C4AADD49CB792E274E904CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00B1B736 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,D366EE2A,00000000,00000000,00000000,00000000), ref: 00B1B789

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: c58485ea36d1c4821cfd7b3315b0bfce58ca693c550b1c9aa60cde37cd66677e
Instruction ID: a13bd84b0a69f27f1ae7255d2e0aada8129347406f1413255c2446de50f59f18
Opcode Fuzzy Hash: c58485ea36d1c4821cfd7b3315b0bfce58ca693c550b1c9aa60cde37cd66677e
Instruction Fuzzy Hash: 2D01C071500600AEE720CB15DD84FA6FBE8DF65724F18C096EE059B781D374E9488BA2

Uniqueness

Uniqueness Score: -1.00%

Function 04D03D90 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?), ref: 04D03DE4

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: aade4b1df44516a05aa663df9f9dae0058cfd434d900dc0c3f7b6e92f154d72f
Instruction ID: e2ce7ccdb49eca279e122f006df155b5843df5051e861abb1305837b0bf6b521
Opcode Fuzzy Hash: aade4b1df44516a05aa663df9f9dae0058cfd434d900dc0c3f7b6e92f154d72f
Instruction Fuzzy Hash: 63116171509384AFD7128F15DC44B62FFB4EF46624F0880DAED858F693D275A948CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 04D00E4E Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 04D00E9A

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 6f332f61c4673fbe7bed44a38424101424381d139af7d957c51624a208707520
Instruction ID: 7248089485bb2c70741cb8bd2886cf8f6bb19a99dd14c31592f06ec213026031
Opcode Fuzzy Hash: 6f332f61c4673fbe7bed44a38424101424381d139af7d957c51624a208707520
Instruction Fuzzy Hash: 87117C75600200AFEB21CF55D844B66FBE4FF18320F08C8AADD899B6A2D375E518DB61

Uniqueness

Uniqueness Score: -1.00%

Function 04D01016 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNELBASE(?,00000E24,?,?), ref: 04D01066

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 5f899a359e450ac4992bfb22ea3cf1a2614e8c55dd02760559a03884fbba5cf3
Instruction ID: 40fd090fa0086df97d66b6da9f99664aec1a58fc99bf923fc37a73e6b1496189
Opcode Fuzzy Hash: 5f899a359e450ac4992bfb22ea3cf1a2614e8c55dd02760559a03884fbba5cf3
Instruction Fuzzy Hash: FB01B171600600AFD310DF16CC46B66FBE8FB88A20F14855AED089BB41D731F915CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 04D02E3A Relevance: 1.5, APIs: 1, Instructions: 46libraryCOMMON

Download Yara Rule

APIs

LoadLibraryShim.MSCOREE(?,?,?,?), ref: 04D02E85

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: LibraryLoadShim
String ID:
API String ID: 1475914169-0
Opcode ID: 20cf6d13fc8c4ac98b7377feeba00bf0ebb6a995ee7bdea9c91a890b57e785a1
Instruction ID: 33adefd5f3424931c79001a03402545e31d3eb715530a81707ba066b10799864
Opcode Fuzzy Hash: 20cf6d13fc8c4ac98b7377feeba00bf0ebb6a995ee7bdea9c91a890b57e785a1
Instruction Fuzzy Hash: C40140716412409FDB60CE15D949B56FBE8FF15720F08C09ADD498B792D375F808CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00B1AC2A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00B1AC6E

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5424f9e5f0d9ce255089ab190d623efafb42fcc2a065303e141b41bfb7579893
Instruction ID: 3dc64749e99ddae05a338e8c7c3c5ae6e11cedd4ffac02677d4a1b3b5374a424
Opcode Fuzzy Hash: 5424f9e5f0d9ce255089ab190d623efafb42fcc2a065303e141b41bfb7579893
Instruction Fuzzy Hash: 18016D329006009FDB218F55DD84B66FBE4EF58720F08889ADD498AA52D375E458DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 04D00032 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000E24,?,?), ref: 04D00082

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 7881755690d82a24aa56e054225f6ffbc2e295395f22a13bc61a95f15a18b6c5
Instruction ID: fc6a5395e73bd4a8ec953dd813f29cba22e1bbf2eae6b65bca2311f50d90c550
Opcode Fuzzy Hash: 7881755690d82a24aa56e054225f6ffbc2e295395f22a13bc61a95f15a18b6c5
Instruction Fuzzy Hash: 4E01AD71600600AFD310DF16CC86B66FBE8FB88A20F14815AED089BB41E731F915CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 00B1BD62 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,?,?,?,?), ref: 00B1BDA0

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 1e61c4be5df0538d431c26fba55f6ef7a5aae6fae62979f7cfc0d8e92a91eb37
Instruction ID: f7d4ee1bdcd8fe7af900169577376938003279018b203502c7af12194cc27365
Opcode Fuzzy Hash: 1e61c4be5df0538d431c26fba55f6ef7a5aae6fae62979f7cfc0d8e92a91eb37
Instruction Fuzzy Hash: 7C019E325002009FEB20CF55E984BA6FBE4EF18320F0884AADD898B656D375E458DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00B1BBC2 Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 00B1BC12

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: b125afecb2f58f8beb5eaf9bcce5a57c6c39748da40212156fdf3e558b906761
Instruction ID: 00974b7aed3d113037183905fa599dfe477af9100594b1d20187b31acecbcfc7
Opcode Fuzzy Hash: b125afecb2f58f8beb5eaf9bcce5a57c6c39748da40212156fdf3e558b906761
Instruction Fuzzy Hash: F0018F71600600AFD310DF16CC46B66FBE8FB88A20F14815AED089BB41D771F915CAE5

Uniqueness

Uniqueness Score: -1.00%

Function 00B1A74E Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00B1A780

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 35d38afececdcffc46cc79d2d77d1b58b58a0df3369ce5634f60a1ff9feaa0a8
Instruction ID: b57dbc6bff7c8032eca5f7b1afd7bd8d66c83bd5c357127c3342b5fbdee8188c
Opcode Fuzzy Hash: 35d38afececdcffc46cc79d2d77d1b58b58a0df3369ce5634f60a1ff9feaa0a8
Instruction Fuzzy Hash: 0A01D4716012008FEB108F55D9847A6FBE4DF15320F08C4EBDC498F786D274E944CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 04D03F02 Relevance: 1.5, APIs: 1, Instructions: 42windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 04D03F3D

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: d5fdcd827b82d23a4fb35e8b11ac09b9ebd408e45848a8c60eb03d8b2ef31abd
Instruction ID: d5b65713918a7f7e01fcdf7af154f2ef5cf87341f3c74e1b10cf81059000e0e2
Opcode Fuzzy Hash: d5fdcd827b82d23a4fb35e8b11ac09b9ebd408e45848a8c60eb03d8b2ef31abd
Instruction Fuzzy Hash: 1A0171756006409FDB208F16D884B66FFE4EF15620F08C49EDD468B6A2D375E458DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B1A186 Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 00B1A1C1

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 420055ce1768bcfcaa1ec6c5f6bc32042cd63f189e19a37b15d8fa59281fbb8f
Instruction ID: 86e5ed4bbaf060625be3112d113af9d4b583289090c4690fa52ff8407754c141
Opcode Fuzzy Hash: 420055ce1768bcfcaa1ec6c5f6bc32042cd63f189e19a37b15d8fa59281fbb8f
Instruction Fuzzy Hash: D701F1329002409FEB20CF55D884BA2FBE0FF19320F08C49ADD498F652C375E858CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00B1ADCE Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 00B1AE00

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: cf2cb4a699d130ae9fb43861835262d531873362b334ac7a2b51532ac51c5f06
Instruction ID: c8467a8615e6c7f05a12a34d638e60f51e39ad375304a64163a9397078fd23de
Opcode Fuzzy Hash: cf2cb4a699d130ae9fb43861835262d531873362b334ac7a2b51532ac51c5f06
Instruction Fuzzy Hash: 1501D1719012408FEB10CF15D9847A6FBE4EF54320F58C4EADD498F756D279E988CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 04D03B16 Relevance: 1.5, APIs: 1, Instructions: 38windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 04D03B51

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: dde50d954b71a53cdd55c87b14c6d8f43960804ea6d496e9468ea794ab7528d9
Instruction ID: 65d2b9812d474f5503c96ba884929d72a078c6a4abffad66762c1ec3d03bbd30
Opcode Fuzzy Hash: dde50d954b71a53cdd55c87b14c6d8f43960804ea6d496e9468ea794ab7528d9
Instruction Fuzzy Hash: F6018F315046049FDB208F06D984B65FBE0EF18224F08C09ADD490B6A2D375E418DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 04D03DB2 Relevance: 1.5, APIs: 1, Instructions: 35windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?), ref: 04D03DE4

Memory Dump Source

Source File: 00000000.00000002.2421885024.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 4f56009d68e27cda7a33182222753d991ab71d68329acaed24c23b8e314a50b6
Instruction ID: b0297f08680b83b9a86046f684d90a14eb307e827f68607a3c3ed3761e1a37e7
Opcode Fuzzy Hash: 4f56009d68e27cda7a33182222753d991ab71d68329acaed24c23b8e314a50b6
Instruction Fuzzy Hash: 26F0AF35A002409FEB108F06D985765FBE4EF15224F08C19ADD494F792E279F448CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 00B1A2DA Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00B1A30C

Memory Dump Source

Source File: 00000000.00000002.2420315517.0000000000B1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: d2ec78ee0b96bbcc5b6c4e3262e7e9bc32a47ade0b408f39db6982a222140f95
Instruction ID: 01b2fd6f5ad6d7fac7146830dcb016040715d9f2cf48a06b07fb3d480b1cc06d
Opcode Fuzzy Hash: d2ec78ee0b96bbcc5b6c4e3262e7e9bc32a47ade0b408f39db6982a222140f95
Instruction Fuzzy Hash: 12F08C359052408FEB208F06E9847A6FBE4EF15720F58C0DADD094F752D379E948DAA2

Uniqueness

Uniqueness Score: -1.00%

Function 05101F4C Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2422003047.0000000005100000.00000040.00000800.00020000.00000000.sdmp, Offset: 05100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5100000_xVcsGL5R1Nbh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d7fa50bd6c97ec648a6f835897b2d57a744894774d83a05be26a617fabcc4e8
Instruction ID: e609aae85626c9079f38eab976107a6aeac48f3dbb2f4518ad4b4a09c0c0a9a2
Opcode Fuzzy Hash: 4d7fa50bd6c97ec648a6f835897b2d57a744894774d83a05be26a617fabcc4e8
Instruction Fuzzy Hash: C411BAB5A08341AFD340CF19D840A5BFBE4FB98664F04895EF998D7311D235E9148FA2

Uniqueness

Uniqueness Score: -1.00%

Function 00FD07C4 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420639508.0000000000FD0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_xVcsGL5R1Nbh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad150d8956dc4c8efa7372dd7570e3bca53c311014264e2ac4edb2014d1cfaec
Instruction ID: 328f57a5279e2429701475fe8d5ace9a86a1f00615029f252f512cca2bc79594
Opcode Fuzzy Hash: ad150d8956dc4c8efa7372dd7570e3bca53c311014264e2ac4edb2014d1cfaec
Instruction Fuzzy Hash: D4110631604280DFD315CB10D540F15F796EB89718F28C5AEE8491BB93CB7BD803EA91

Uniqueness

Uniqueness Score: -1.00%

Function 00B2B0A4 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420357256.0000000000B2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b2a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ca4c28c531179ec98658edf85f035ef00cf71113bda18d036ebb8c6eab3ea98
Instruction ID: 07c87417b4cd17e25da82e77040394e4262411bf8d18a51348c1ef0a62b61ec1
Opcode Fuzzy Hash: 5ca4c28c531179ec98658edf85f035ef00cf71113bda18d036ebb8c6eab3ea98
Instruction Fuzzy Hash: 5B11CCB5A48301AFD350CF09DC41E5BFBE8EB98660F04895EF95997711D271E908CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00FD07AF Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420639508.0000000000FD0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_xVcsGL5R1Nbh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50ad9bdd71b84053d7b94d808bdac088b321021701233f6e798d3bd9f5f11fad
Instruction ID: 062fc6dde16a914abd4411b37f12e2fcf6793d72eb9d8cd18924d665679d4689
Opcode Fuzzy Hash: 50ad9bdd71b84053d7b94d808bdac088b321021701233f6e798d3bd9f5f11fad
Instruction Fuzzy Hash: 3A1151356492C0DFC712CB14D940B15BBA2EF8A728F2C85DED8894B753C736D816EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FD05DF Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420639508.0000000000FD0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_xVcsGL5R1Nbh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61cc1f30f50030f4a9719171364b7b2a5ddcf8d9503aa70da3d29d539646ee35
Instruction ID: 980748c0904f76302a12a3f9f65b1225eff13fd950b206390ab5d7775ce85d71
Opcode Fuzzy Hash: 61cc1f30f50030f4a9719171364b7b2a5ddcf8d9503aa70da3d29d539646ee35
Instruction Fuzzy Hash: 0101F9B51493806FD7118F16EC50893BFF8EF8623070984ABEC898B612D135B918CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00FD0880 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420639508.0000000000FD0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_xVcsGL5R1Nbh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b6e4d9588c8b3b536dc49aa3ff0406202024c598795a04b4f4794c20a664ee6
Instruction ID: f18405ec876ddf85dac7778f8bee45721fc35c4d2b059654968f8d75d888e4cf
Opcode Fuzzy Hash: 0b6e4d9588c8b3b536dc49aa3ff0406202024c598795a04b4f4794c20a664ee6
Instruction Fuzzy Hash: 42F01D35544684DFC316CF00D540B15FBA2EB89718F28CAADE9491BB62C737E813EB81

Uniqueness

Uniqueness Score: -1.00%

Function 00FD0606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420639508.0000000000FD0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_xVcsGL5R1Nbh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b54fbb2a988e610bbcfd4a8d050664726d91a6e0e16d6f841c83bab183eeb1
Instruction ID: aed5705038a392ea3e7308936a33fca5077b97716031265fa641d3617a606219
Opcode Fuzzy Hash: 68b54fbb2a988e610bbcfd4a8d050664726d91a6e0e16d6f841c83bab183eeb1
Instruction Fuzzy Hash: D3E092B66006004FD750CF0AEC41452F7D8EB98630B08C07FDC0D8B701E276B508CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 00B2B0F3 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420357256.0000000000B2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b2a000_xVcsGL5R1Nbh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8bf5f00a848e26476da919c71252917859ce0953d6339e28357d9df28932dd3
Instruction ID: a068986d105db666d452c75ea7896ef1e95abe3772beb3151c8ab3e4e0aac42b
Opcode Fuzzy Hash: a8bf5f00a848e26476da919c71252917859ce0953d6339e28357d9df28932dd3
Instruction Fuzzy Hash: 1AE0DFB2A402046BD2109E06EC46F63FB98EB64A71F08C56BED095B752E172B6048AF1

Uniqueness

Uniqueness Score: -1.00%

Function 05101863 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2422003047.0000000005100000.00000040.00000800.00020000.00000000.sdmp, Offset: 05100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5100000_xVcsGL5R1Nbh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18f050eb151d7106bf435a878bc93e1f9e0c4a71e0e8f1e5595e7bce645d42ef
Instruction ID: 3a3fd2d601e6b64a5ac3957e5dd16850f6939b85b0707f80534a37ce6cbb345d
Opcode Fuzzy Hash: 18f050eb151d7106bf435a878bc93e1f9e0c4a71e0e8f1e5595e7bce645d42ef
Instruction Fuzzy Hash: E3E0D8B26402006BD2109E06DC45F53FB98DB54971F08C457ED0D1B742E172B514CAE1

Uniqueness

Uniqueness Score: -1.00%

Function 05101FB7 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2422003047.0000000005100000.00000040.00000800.00020000.00000000.sdmp, Offset: 05100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5100000_xVcsGL5R1Nbh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60119fdc0772e05615a66b044d42c3c722abec673e1f7dbd1f8b6c21c9868c49
Instruction ID: 8caa1501f412bdeb09b7092e3a431452e99611ae32e37ae14812495aa256d5e8
Opcode Fuzzy Hash: 60119fdc0772e05615a66b044d42c3c722abec673e1f7dbd1f8b6c21c9868c49
Instruction Fuzzy Hash: 01E0D8B26402046BD3108E06DC45F53FB98DB64971F08C467ED081B742E176B5148AE1

Uniqueness

Uniqueness Score: -1.00%

Function 00B123F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420302143.0000000000B12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b12000_xVcsGL5R1Nbh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e6b18b957b4e152c16f381207fb8dca6fd092406a329c45ec9f85add17b0b15
Instruction ID: bbec2597d772ce79351ed08973746be62914f8d96b50e56d10339620bb170f74
Opcode Fuzzy Hash: 2e6b18b957b4e152c16f381207fb8dca6fd092406a329c45ec9f85add17b0b15
Instruction Fuzzy Hash: BED05E792056C18FD3169B1CC1A5BD537D4AB65714F8A44F9A8008B763C768E9D1D600

Uniqueness

Uniqueness Score: -1.00%

Function 00B123BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420302143.0000000000B12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b12000_xVcsGL5R1Nbh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0493120d92c022a8dc1a95d6457451f861a16f96c575bc953cb7a9c3772caf0
Instruction ID: a9dc39a4d39b9b1eb401d0336d010187302bee5a7d15ab8940674e739d1a688e
Opcode Fuzzy Hash: d0493120d92c022a8dc1a95d6457451f861a16f96c575bc953cb7a9c3772caf0
Instruction Fuzzy Hash: 11D05E342002814FD715DB0CD6D4F9937D4AB54B14F4A44E8AC208B762C7A8D8D0DA00

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report xVcsGL5R1Nbh.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\xVcsGL5R1Nbh.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
xVcsGL5R1Nbh.exe

Function 011B19F0 Relevance: 3.9, Strings: 2, Instructions: 1396
COMMON

Function 011B03E8 Relevance: 1.6, APIs: 1, Instructions: 105
COMMON

Function 011B03F8 Relevance: 1.6, APIs: 1, Instructions: 104
COMMON

Function 00B1B5DE Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Function 04D0202E Relevance: 1.6, APIs: 1, Instructions: 99
registryCOMMON

Function 00B1BB4B Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Function 00B1A7C7 Relevance: 1.6, APIs: 1, Instructions: 95
registryCOMMON

Function 04D0099C Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Function 04D00894 Relevance: 1.6, APIs: 1, Instructions: 92
timeCOMMON

Function 04D00190 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Function 00B1A612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Function 04D0205A Relevance: 1.6, APIs: 1, Instructions: 86
registryCOMMON