Edit tour

Windows Analysis Report
New DHL Shipment Document Arrival Notice.pdf.exe

Overview

General Information

Sample name:	New DHL Shipment Document Arrival Notice.pdf.exe
Analysis ID:	1430784
MD5:	189b8ac3c0f8d840f30f4897b2d89773
SHA1:	e6e6c3bd752cde7cf0677575d9268fc2a2070331
SHA256:	7fee503438f90d0206012674566587b5ecef1d040935809ae308b12842dc6196
Tags:	AgentTeslaDHLexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: RegAsm connects to smtp port

Sigma detected: Suspicious Double Extension File Execution

Snort IDS alert for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected UAC Bypass using CMSTP

.NET source code references suspicious native API functions

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (double extension)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

New DHL Shipment Document Arrival Notice.pdf.exe (PID: 6500 cmdline: "C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe" MD5: 189B8AC3C0F8D840F30F4897B2D89773)

conhost.exe (PID: 6620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 4068 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

AddInProcess32.exe (PID: 3372 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

RegAsm.exe (PID: 4028 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 4724 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 1772 cmdline: C:\Windows\system32\WerFault.exe -u -p 6500 -s 1092 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.prestamp.in", "Username": "plant.ps2@prestamp.in", "Password": "Gds@123"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2184155849.00000161645D8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000005.00000002.3254981544.000000000318C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.3254981544.0000000003194000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.3252878938.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.3252878938.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2184155849.0000016164089000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000005.00000002.3254981544.0000000003161000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.3254981544.0000000003161000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2187402638.0000016174037000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2187402638.0000016174037000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: New DHL Shipment Document Arrival Notice.pdf.exe PID: 6500	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: New DHL Shipment Document Arrival Notice.pdf.exe PID: 6500	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: New DHL Shipment Document Arrival Notice.pdf.exe PID: 6500	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: New DHL Shipment Document Arrival Notice.pdf.exe PID: 6500	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: RegAsm.exe PID: 4028	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 4028	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3310b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3317d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33207:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33299:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33303:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33375:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3340b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3349b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.New DHL Shipment Document Arrival Notice.pdf.exe.16174076940.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.New DHL Shipment Document Arrival Notice.pdf.exe.16174076940.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.New DHL Shipment Document Arrival Notice.pdf.exe.16174076940.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3310b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3317d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33207:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33299:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33303:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33375:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3340b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3349b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.RegAsm.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.RegAsm.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34f0b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34f7d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35007:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35099:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35103:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35175:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3520b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3529b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34f0b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34f7d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35007:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35099:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35103:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35175:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3520b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3529b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.New DHL Shipment Document Arrival Notice.pdf.exe.16174076940.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.New DHL Shipment Document Arrival Notice.pdf.exe.16174076940.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.New DHL Shipment Document Arrival Notice.pdf.exe.16174076940.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34f0b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x71553:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34f7d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x715c5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35007:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x7164f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35099:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x716e1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35103:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x7174b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35175:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x717bd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3520b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x71853:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3529b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x718e3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 10 entries

Sigma Signatures

Networking

Sigma detected: RegAsm connects to smtp port

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 8.38.89.60, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, Initiated: true, ProcessId: 4028, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49710

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe", CommandLine: "C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe", CommandLine|base64offset|contains: r, Image: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe, NewProcessName: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe, OriginalFileName: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 5824, ProcessCommandLine: "C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe", ProcessId: 6500, ProcessName: New DHL Shipment Document Arrival Notice.pdf.exe

Snort Signatures

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.5 - Destination IP: 8.38.89.60

Timestamp:	04/24/24-07:15:17.148129
SID:	2030171
Source Port:	49710
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.5 - Destination IP: 8.38.89.60

Timestamp:	04/24/24-07:15:19.418719
SID:	2855542
Source Port:	49712
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.5 - Destination IP: 8.38.89.60

Timestamp:	04/24/24-07:15:19.418719
SID:	2840032
Source Port:	49712
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 8.38.89.60

Timestamp:	04/24/24-07:15:19.418719
SID:	2851779
Source Port:	49712
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 8.38.89.60

Timestamp:	04/24/24-07:15:17.148183
SID:	2851779
Source Port:	49710
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.5 - Destination IP: 8.38.89.60

Timestamp:	04/24/24-07:15:17.148183
SID:	2840032
Source Port:	49710
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.5 - Destination IP: 8.38.89.60

Timestamp:	04/24/24-07:15:19.414322
SID:	2030171
Source Port:	49712
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.5 - Destination IP: 8.38.89.60

Timestamp:	04/24/24-07:15:17.148183
SID:	2855542
Source Port:	49710
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Exfil via SMTP - Source IP: 192.168.2.5 - Destination IP: 8.38.89.60

Timestamp:	04/24/24-07:15:17.148183
SID:	2855245
Source Port:	49710
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 5.2.RegAsm.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.prestamp.in", "Username": "plant.ps2@prestamp.in", "Password": "Gds@123"}

Multi AV Scanner detection for submitted file

Source: New DHL Shipment Document Arrival Notice.pdf.exe

Virustotal: Detection: 14%

Perma Link

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.2184155849.00000161645D8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2184155849.0000016164089000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New DHL Shipment Document Arrival Notice.pdf.exe PID: 6500, type: MEMORYSTR

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49724 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49704 version: TLS 1.2

Source: New DHL Shipment Document Arrival Notice.pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER592E.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdbp^ source: WER592E.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdb source: WER592E.tmp.dmp.9.dr
Source:	Binary string: System.ni.pdbRSDS source: WER592E.tmp.dmp.9.dr
Source:	Binary string: mscorlib.ni.pdb source: WER592E.tmp.dmp.9.dr
Source:	Binary string: System.Core.pdb source: WER592E.tmp.dmp.9.dr
Source:	Binary string: Microsoft.VisualBasic.pdb- source: WER592E.tmp.dmp.9.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER592E.tmp.dmp.9.dr
Source:	Binary string: System.pdbP source: WER592E.tmp.dmp.9.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER592E.tmp.dmp.9.dr
Source:	Binary string: System.ni.pdb source: WER592E.tmp.dmp.9.dr
Source:	Binary string: System.pdb source: WER592E.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER592E.tmp.dmp.9.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER592E.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdb source: WER592E.tmp.dmp.9.dr

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.5:49710 -> 8.38.89.60:587
Source: Traffic	Snort IDS: 2855245 ETPRO TROJAN Agent Tesla Exfil via SMTP 192.168.2.5:49710 -> 8.38.89.60:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49710 -> 8.38.89.60:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.5:49710 -> 8.38.89.60:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49710 -> 8.38.89.60:587
Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.5:49712 -> 8.38.89.60:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49712 -> 8.38.89.60:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.5:49712 -> 8.38.89.60:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49712 -> 8.38.89.60:587

Source: global traffic

TCP traffic: 192.168.2.5:49710 -> 8.38.89.60:587

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: CLOUD-SOUTHUS CLOUD-SOUTHUS

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.5:49710 -> 8.38.89.60:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49724 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: RegAsm.exe, 00000005.00000002.3254981544.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000005.00000002.3254981544.000000000331D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3254981544.000000000318C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.prestamp.in
Source: Amcache.hve.9.dr	String found in binary or memory: http://upx.sf.net
Source: New DHL Shipment Document Arrival Notice.pdf.exe, 00000000.00000002.2187402638.0000016174037000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3252878938.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: New DHL Shipment Document Arrival Notice.pdf.exe, 00000000.00000002.2187402638.0000016174037000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3252878938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3254981544.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegAsm.exe, 00000005.00000002.3254981544.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegAsm.exe, 00000005.00000002.3254981544.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49704 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.raw.unpack, cPKWk.cs	.Net Code: eHsXU2
Source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.16174076940.2.raw.unpack, cPKWk.cs	.Net Code: eHsXU2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.16174076940.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.16174076940.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample	Static PE information: Filename: New DHL Shipment Document Arrival Notice.pdf.exe
Source: initial sample	Static PE information: Filename: New DHL Shipment Document Arrival Notice.pdf.exe

Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Code function: 0_2_00007FF848F21D88	0_2_00007FF848F21D88
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Code function: 0_2_00007FF848F129A1	0_2_00007FF848F129A1
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Code function: 0_2_00007FF848F1EBF8	0_2_00007FF848F1EBF8
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Code function: 0_2_00007FF848F14309	0_2_00007FF848F14309
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Code function: 0_2_00007FF848F11218	0_2_00007FF848F11218
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Code function: 0_2_00007FF848F1CE19	0_2_00007FF848F1CE19
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Code function: 0_2_00007FF848F1246D	0_2_00007FF848F1246D
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Code function: 0_2_00007FF849000E29	0_2_00007FF849000E29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_013841C8	5_2_013841C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0138E2B1	5_2_0138E2B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0138A970	5_2_0138A970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_01384A98	5_2_01384A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0138ADE7	5_2_0138ADE7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_01383E80	5_2_01383E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06A7CA10	5_2_06A7CA10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06A7F158	5_2_06A7F158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06A71C9B	5_2_06A71C9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06A718D8	5_2_06A718D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06A9B620	5_2_06A9B620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06A95590	5_2_06A95590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06A965C8	5_2_06A965C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06A9B208	5_2_06A9B208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06A93050	5_2_06A93050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06A9C168	5_2_06A9C168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06A97D60	5_2_06A97D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06A97680	5_2_06A97680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06A9E390	5_2_06A9E390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06A90040	5_2_06A90040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06A95CBB	5_2_06A95CBB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06A90333	5_2_06A90333
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06A90006	5_2_06A90006

Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6500 -s 1092

Source: New DHL Shipment Document Arrival Notice.pdf.exe

Static PE information: No import functions for PE file found

Source: New DHL Shipment Document Arrival Notice.pdf.exe, 00000000.00000000.1996563825.00000161622A6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAxeputagecuyitigagikoB vs New DHL Shipment Document Arrival Notice.pdf.exe
Source: New DHL Shipment Document Arrival Notice.pdf.exe, 00000000.00000002.2187402638.0000016174037000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameabfb950a-2f96-4f7b-b318-2fe778e635b4.exe4 vs New DHL Shipment Document Arrival Notice.pdf.exe
Source: New DHL Shipment Document Arrival Notice.pdf.exe, 00000000.00000002.2187402638.0000016174037000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUjeruziruxitohacepapL vs New DHL Shipment Document Arrival Notice.pdf.exe
Source: New DHL Shipment Document Arrival Notice.pdf.exe	Binary or memory string: OriginalFilenameAxeputagecuyitigagikoB vs New DHL Shipment Document Arrival Notice.pdf.exe

Source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.16174076940.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.16174076940.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: New DHL Shipment Document Arrival Notice.pdf.exe, getParentblockseFixedBuffer.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.raw.unpack, cPs8D.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.raw.unpack, 72CF8egH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.raw.unpack, G5CXsdn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.raw.unpack, 3uPsILA6U.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.raw.unpack, 6oQOw74dfIt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.raw.unpack, aMIWm.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.winEXE@11/5@3/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6500
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6620:120:WilError_03

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\c3aa3a0c-06aa-4a3f-8324-25af856d069b

Jump to behavior

Source: New DHL Shipment Document Arrival Notice.pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: New DHL Shipment Document Arrival Notice.pdf.exe

Static file information: TRID: Win64 Executable Console Net Framework (206006/5) 48.58%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: New DHL Shipment Document Arrival Notice.pdf.exe

Virustotal: Detection: 14%

Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe

File read: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe "C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe"
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6500 -s 1092
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: New DHL Shipment Document Arrival Notice.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: New DHL Shipment Document Arrival Notice.pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: New DHL Shipment Document Arrival Notice.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER592E.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdbp^ source: WER592E.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdb source: WER592E.tmp.dmp.9.dr
Source:	Binary string: System.ni.pdbRSDS source: WER592E.tmp.dmp.9.dr
Source:	Binary string: mscorlib.ni.pdb source: WER592E.tmp.dmp.9.dr
Source:	Binary string: System.Core.pdb source: WER592E.tmp.dmp.9.dr
Source:	Binary string: Microsoft.VisualBasic.pdb- source: WER592E.tmp.dmp.9.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER592E.tmp.dmp.9.dr
Source:	Binary string: System.pdbP source: WER592E.tmp.dmp.9.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER592E.tmp.dmp.9.dr
Source:	Binary string: System.ni.pdb source: WER592E.tmp.dmp.9.dr
Source:	Binary string: System.pdb source: WER592E.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER592E.tmp.dmp.9.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER592E.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdb source: WER592E.tmp.dmp.9.dr

Source: New DHL Shipment Document Arrival Notice.pdf.exe

Static PE information: 0x9EA20D34 [Sun May 3 11:25:40 2054 UTC]

Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Code function: 0_2_00007FF848F1B0F8 push es; ret	0_2_00007FF848F1B107
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Code function: 0_2_00007FF84900026B push esp; retf 4810h	0_2_00007FF849000312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0138E76F push ecx; retf	5_2_0138E787
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_01380C3D push edi; ret	5_2_01380CC2

Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	File created: \new dhl shipment document arrival notice.pdf.exe
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	File created: \new dhl shipment document arrival notice.pdf.exe
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	File created: \new dhl shipment document arrival notice.pdf.exe
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	File created: \new dhl shipment document arrival notice.pdf.exe
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	File created: \new dhl shipment document arrival notice.pdf.exe
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	File created: \new dhl shipment document arrival notice.pdf.exe
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	File created: \new dhl shipment document arrival notice.pdf.exe	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	File created: \new dhl shipment document arrival notice.pdf.exe	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	File created: \new dhl shipment document arrival notice.pdf.exe	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	File created: \new dhl shipment document arrival notice.pdf.exe	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.exe

Static PE information: New DHL Shipment Document Arrival Notice.pdf.exe

Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: New DHL Shipment Document Arrival Notice.pdf.exe PID: 6500, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: New DHL Shipment Document Arrival Notice.pdf.exe, 00000000.00000002.2184155849.00000161645D8000.00000004.00000800.00020000.00000000.sdmp, New DHL Shipment Document Arrival Notice.pdf.exe, 00000000.00000002.2184155849.0000016164089000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: New DHL Shipment Document Arrival Notice.pdf.exe, 00000000.00000002.2184155849.00000161645D8000.00000004.00000800.00020000.00000000.sdmp, New DHL Shipment Document Arrival Notice.pdf.exe, 00000000.00000002.2184155849.0000016164089000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Memory allocated: 161625D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Memory allocated: 1617C030000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 1360000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 3110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2E70000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 7641			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 2208			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -35971150943733603s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6052	Thread sleep count: 7641 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6052	Thread sleep count: 2208 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -99219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -99094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -98981s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -197718s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -98749s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -98640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -197062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -196844s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -196624s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -196406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -98093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -195968s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -97875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -97765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -97656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -97547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -97422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -97312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -97203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -97094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -96969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -96859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -96750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -96640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -99953s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -99844s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -99734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -99625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -99515s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -99406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -99297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -99187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -99078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -98969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -98750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -98641s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5060	Thread sleep time: -98094s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98981	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98094	Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: VMware
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.
Source: New DHL Shipment Document Arrival Notice.pdf.exe, 00000000.00000002.2184155849.0000016164089000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.9.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: New DHL Shipment Document Arrival Notice.pdf.exe, 00000000.00000002.2184155849.0000016164089000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: New DHL Shipment Document Arrival Notice.pdf.exe, 00000000.00000002.2184155849.0000016164089000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.9.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: New DHL Shipment Document Arrival Notice.pdf.exe, 00000000.00000002.2184155849.0000016164089000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: New DHL Shipment Document Arrival Notice.pdf.exe, 00000000.00000002.2184155849.0000016164089000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.9.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: RegAsm.exe, 00000005.00000002.3260577063.000000000633C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.9.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: New DHL Shipment Document Arrival Notice.pdf.exe, 00000000.00000002.2184155849.0000016164089000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin`
Source: New DHL Shipment Document Arrival Notice.pdf.exe, 00000000.00000002.2184155849.0000016164089000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Amcache.hve.9.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: New DHL Shipment Document Arrival Notice.pdf.exe, 00000000.00000002.2184155849.0000016164089000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: New DHL Shipment Document Arrival Notice.pdf.exe, 00000000.00000002.2184155849.0000016164089000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.9.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.9.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: New DHL Shipment Document Arrival Notice.pdf.exe, 00000000.00000002.2184155849.0000016164089000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: New DHL Shipment Document Arrival Notice.pdf.exe, 00000000.00000002.2184155849.0000016164089000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.9.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.9.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.9.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: New DHL Shipment Document Arrival Notice.pdf.exe, getParentblockseFixedBuffer.cs	Reference to suspicious API methods: ((StartFileMode)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibrary(getMethodLdelemU2(CopyUtf8Formatter.FileReparsePointInformationMultiplySubtractByScalar)), getMethodLdelemU2(CopyUtf8Formatter.EndWriteBlt)), typeof(StartFileMode)))("Pointer", out var _)
Source: New DHL Shipment Document Arrival Notice.pdf.exe, getParentblockseFixedBuffer.cs	Reference to suspicious API methods: ((StartFileMode)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibrary(getMethodLdelemU2(CopyUtf8Formatter.FileReparsePointInformationMultiplySubtractByScalar)), getMethodLdelemU2(CopyUtf8Formatter.EndWriteBlt)), typeof(StartFileMode)))("Pointer", out var _)
Source: New DHL Shipment Document Arrival Notice.pdf.exe, getParentblockseFixedBuffer.cs	Reference to suspicious API methods: VirtualProtect(procAddress, (uint)array.Length, 64u, out var IsMetricTYPEFLAGFOLEAUTOMATION)
Source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.raw.unpack, Ljq6xD21ACX.cs	Reference to suspicious API methods: OZkujShDCVG.OpenProcess(aPNZ30.DuplicateHandle, bInheritHandle: true, (uint)snUp2.ProcessID)

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: FC1008	Jump to behavior

Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe	Queries volume information: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.16174076940.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.16174076940.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3254981544.000000000318C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3254981544.0000000003194000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3252878938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3254981544.0000000003161000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2187402638.0000016174037000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New DHL Shipment Document Arrival Notice.pdf.exe PID: 6500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4028, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.16174076940.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.16174076940.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3252878938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3254981544.0000000003161000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2187402638.0000016174037000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New DHL Shipment Document Arrival Notice.pdf.exe PID: 6500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4028, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.16174076940.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.161740b2f88.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New DHL Shipment Document Arrival Notice.pdf.exe.16174076940.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3254981544.000000000318C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3254981544.0000000003194000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3252878938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3254981544.0000000003161000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2187402638.0000016174037000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New DHL Shipment Document Arrival Notice.pdf.exe PID: 6500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4028, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	211 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Obfuscated Files or Information	1 Credentials in Registry	231 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	151 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
New DHL Shipment Document Arrival Notice.pdf.exe	11%	ReversingLabs	Win64.Infostealer.Generic
New DHL Shipment Document Arrival Notice.pdf.exe	14%	Virustotal		Browse

Source	Detection	Scanner	Link
smtp.prestamp.in	0%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
windowsupdatebg.s.llnwi.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://smtp.prestamp.in	0%	Avira URL Cloud	safe
http://smtp.prestamp.in	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false		high
smtp.prestamp.in	8.38.89.60	true	true	0%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown
windowsupdatebg.s.llnwi.net	68.142.107.4	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	New DHL Shipment Document Arrival Notice.pdf.exe, 00000000.00000002.2187402638.0000016174037000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3252878938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3254981544.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.9.dr	false		high
https://account.dyn.com/	New DHL Shipment Document Arrival Notice.pdf.exe, 00000000.00000002.2187402638.0000016174037000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3252878938.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.ipify.org/t	RegAsm.exe, 00000005.00000002.3254981544.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false		high
http://smtp.prestamp.in	RegAsm.exe, 00000005.00000002.3254981544.000000000331D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3254981544.000000000318C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000005.00000002.3254981544.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
8.38.89.60	smtp.prestamp.in	United States		13886	CLOUD-SOUTHUS	true
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430784
Start date and time:	2024-04-24 07:14:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	New DHL Shipment Document Arrival Notice.pdf.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.expl.evad.winEXE@11/5@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 77% Number of executed functions: 69 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.126.62.132, 40.126.62.131, 20.190.190.131, 40.126.62.130, 20.190.190.195, 40.126.62.129, 20.190.190.193, 20.190.190.196, 68.142.107.4, 192.229.211.108, 20.189.173.22, 40.68.123.157, 199.232.214.172, 13.95.31.18, 52.165.164.15
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, blobcollector.events.data.trafficmanager.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:15:13	API Interceptor	51x Sleep call for process: RegAsm.exe modified
07:15:26	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.13.205	SecuriteInfo.com.Trojan.DownLoaderNET.960.9931.28151.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	ArenaWarSetup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.RATX-gen.31127.4101.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	Reconfirm Details.vbs	Get hash	malicious	AgentTesla	Browse	192.229.211.108
	http://rum.browser-intake-foxbusiness.com:443	Get hash	malicious	Unknown	Browse	192.229.211.108
	http://42.193.223.169/extensioncompabilitynode.exe	Get hash	malicious	Unknown	Browse	192.229.211.108
	SecuriteInfo.com.Win32.CrypterX-gen.1582.25294.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	192.229.211.108
	ScreenConnect.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	192.229.211.108
	ScreenConnect.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	192.229.211.108
	SecuriteInfo.com.Python.Stealer.1437.14994.32063.exe	Get hash	malicious	Python Stealer	Browse	192.229.211.108
	https://www.longin-eki.co.jp.cduhzkc.cn/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://www.longin-eki.co.jp.nebxshr.cn/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://www.admin-longin.co.jp.mc3lva.cn/	Get hash	malicious	Unknown	Browse	192.229.211.108
api.ipify.org	hesaphareketi_1.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	DHL Shipping doc.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	purchase order pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	PO 23JC0704-Rollease-B.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	BARSYL SHIPPING Co (VIETNAM).exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	SecuriteInfo.com.Python.Stealer.1437.14994.32063.exe	Get hash	malicious	Python Stealer	Browse	172.67.74.152
	https://wmicrosouab-4ba8.udydzj.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	CR-FEDEX_TN-775720741041.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	BARSYL SHIPPING Co (VIETNAM).exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	copy#10476235.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
windowsupdatebg.s.llnwi.net	GHY7L7VaOL.exe	Get hash	malicious	Unknown	Browse	68.142.107.4
	https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.html	Get hash	malicious	TechSupportScam	Browse	68.142.107.4
	4BfhCycV4B.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	69.164.42.0
	https://caringhearts.foundation/wp-includes/widgets/ogk25/ogk/index.php&c=E,1,PBioTuoqxXxVmzOkxu8MYhWQ9ZbRNVLGpsstSuC0GQ2jNcQlIpYbU0K6d3lwsaeoT17vAF7VpKXs0qg9O-hGnfKxM3skSa-Jn2VJH7kX1A,,&typo=1	Get hash	malicious	Unknown	Browse	68.142.107.4
	https://caringhearts.foundation/wp-includes/widgets/ogk25/ogk/index.php&c=E,1,PBioTuoqxXxVmzOkxu8MYhWQ9ZbRNVLGpsstSuC0GQ2jNcQlIpYbU0K6d3lwsaeoT17vAF7VpKXs0qg9O-hGnfKxM3skSa-Jn2VJH7kX1A,,&typo=1	Get hash	malicious	Unknown	Browse	69.164.46.128
	CR-FEDEX_TN-775537409198_Doc.vbs	Get hash	malicious	Unknown	Browse	69.164.46.0
	copy_76499Kxls.vbs	Get hash	malicious	Remcos, GuLoader	Browse	69.164.46.0
	Purchase Inquiry.vbs	Get hash	malicious	AgentTesla	Browse	69.164.46.128
	szamla_sorszam_8472.xlsm	Get hash	malicious	Unknown	Browse	69.164.42.0
	https://tom19-secondary.z15.web.core.windows.net/werrx01USAHTML/?bcda=+1-888-289-1419	Get hash	malicious	TechSupportScam	Browse	69.164.42.0

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	hesaphareketi_1.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Payment MT103.xls	Get hash	malicious	Unknown	Browse	104.21.15.201
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	New Order .doc	Get hash	malicious	Unknown	Browse	172.67.134.136
	orden de compra.vbs	Get hash	malicious	AgentTesla	Browse	104.21.84.67
	DHL Shipping doc.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	Reconfirm Details.vbs	Get hash	malicious	AgentTesla	Browse	172.67.215.45
	Remittance-Advice.doc	Get hash	malicious	Unknown	Browse	172.67.175.222
	shipping docs.doc	Get hash	malicious	Unknown	Browse	104.21.74.191
	Invoice.doc	Get hash	malicious	AgentTesla	Browse	172.67.134.136
CLOUD-SOUTHUS	zGAzL2T5Kp.elf	Get hash	malicious	Mirai	Browse	104.233.72.109
	JeNG2S9wKC.exe	Get hash	malicious	Raccoon Stealer v2	Browse	192.227.94.170
	z1kaJtWtK0.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	154.27.70.229
	381o9buew9.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	154.27.70.229
	O5Mn2N8yHv.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	154.27.70.229
	VC42xEPNd4.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	154.27.70.229
	BSgFkXHc9t.exe	Get hash	malicious	PureLog Stealer	Browse	154.27.70.229
	05Gv8RwQ6G.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	154.27.70.229
	SecuriteInfo.com.Program.Unwanted.5176.1954.19726.exe	Get hash	malicious	HawkEye, PureLog Stealer, Xmrig	Browse	154.27.69.89
	SecuriteInfo.com.Program.Unwanted.5176.1954.19726.exe	Get hash	malicious	HawkEye, Gocoder, PureLog Stealer, Xmrig	Browse	154.27.69.89

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	Reconfirm Details.vbs	Get hash	malicious	AgentTesla	Browse	23.1.237.91
	https://www.admin-longin.co.jp.mc3lva.cn/	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://www.longin.co.jp.wiibhaq.cn/	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://emv1.3rujia.cn/	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://wmicrosouab-4ba8.udydzj.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://uqgekpc20qn1.azureedge.net/6466/	Get hash	malicious	TechSupportScam	Browse	23.1.237.91
	https://magnisteel.lk/4765445b-32c6-49b0-83e6-1d93765276ca.php	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://netorg442802-my.sharepoint.com/:b:/g/personal/darek_daronto_com/EeXtnEaZ3XJBqGk13it6odUB-K9vuYAC7zp7SfyciZ3BpQ?e=nkKu2w	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://lithiuimvalley.com/ssd	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	23.1.237.91
	https://u44056869.ct.sendgrid.net/ls/click?upn=u001.nH1ryR-2Btr2av-2Bkfc8quLEXKlGRKFonctFf3nB-2FAP-2Bjae3IsQgCoKtK-2FQ57cEEmmhZzRyd07G16kQ6rsc4EaJT6S7Rh48kOVsBPHV-2Fkkk9Vfz7cojLOCLuj4sUGVMM7pbdmwtinmtiLhfYkhEkgve628OiJsccHyeYc3lkmkn6epsOmmj4-2Fi-2BWjxfm73m7vUzCOGnDWnQJBmmd6DmkDcfIw-3D-3DlLb9_7VBE-2BPKrWdDFE8TeQU0FNoYmRNt3BbsAfHCQfpyMVcUv91cWM1GbR6tMnpfVZqwoeCii1Z-2FHB6Wp4CGi-2FJ4Nq2flvhbRyRKwbWUqyssDslf87wBQZbBQ0EZsTXlvzjuj1ZnarL4QCJJlvUup-2FiM-2F9GPG6X3nhhKKp6sQ0v-2BBs5Jrrpzc3e5B2aUKKEJUx1Hjrx3xc16wmpK1HmM2sLiNIweMaJlJ9frDis7-2BK565mLw-3D	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
3b5074b1b5d032e5620f69f9f700ff0e	hesaphareketi_1.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	e-dekont.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse	104.26.13.205
	DAIKIN AC SPAIN 2024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	transferencia.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	1000901 LIQUIDACION.vbs	Get hash	malicious	FormBook, GuLoader	Browse	104.26.13.205
	Zapytanie ofertowe (7427-23 ROCKFIN).vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	Factura240413227178.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	JUSTIFICANTE DE PAGO.vbs	Get hash	malicious	Unknown	Browse	104.26.13.205
	JUSTIFICANTE DE PAGO.vbs	Get hash	malicious	Unknown	Browse	104.26.13.205

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_New DHL Shipment_2fb9a779aae7560f97a236ac8a8e38ee4627e80_832b6b58_d4673f3b-6d65-4ce4-a848-6247b28a8c7d\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.029907973686532
Encrypted:	false
SSDEEP:	192:726r35/slT8gY5Q0UnUlaWxHa11zuiF2Z24lO8QWc:hrhslY1UnUlaGHa/zuiF2Y4lO8QWc
MD5:	F484EB5A381EE22AA3F8796CA1F1B69F
SHA1:	5F8F925631649817DECA972C788B52429DED4607
SHA-256:	E5780C16E2DF0F55D1538AD9608EDBADC9BBD9BAA530AFE49037758B1FBA0F99
SHA-512:	0F1AAED52CB213FA096477C52FABBA5EB02C118493434CB9694DC898623D305F639BEA76DA1634C91C502BB14BEEEEE02313AC6C9B3BE98B6DE1224A823B26B2
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.4.0.9.3.1.2.0.7.2.1.0.6.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.4.0.9.3.1.2.8.2.2.1.0.3.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.4.6.7.3.f.3.b.-.6.d.6.5.-.4.c.e.4.-.a.8.4.8.-.6.2.4.7.b.2.8.a.8.c.7.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.2.8.a.6.7.1.0.-.d.d.0.e.-.4.e.5.b.-.a.6.0.a.-.d.f.d.b.3.b.d.c.f.2.a.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.N.e.w. .D.H.L. .S.h.i.p.m.e.n.t. .D.o.c.u.m.e.n.t. .A.r.r.i.v.a.l. .N.o.t.i.c.e...p.d.f...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.A.x.e.p.u.t.a.g.e.c.u.y.i.t.i.g.a.g.i.k.o.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.6.4.-.0.0.0.1.-.0.0.1.4.-.6.2.3.5.-.0.2.6.0.0.6.9.6.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.1.5.6.6.9.c.2.b.1.2.e.6.6.6.3.c.b.8.4.f.f.e.9.9.b.1.7.d.1.b.8.0.0.0.0.0.0.0.0.!.0.0.0.0.e.6.e.6.c.3.b.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER592E.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Wed Apr 24 05:15:12 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	437761
Entropy (8bit):	3.2804251603357217
Encrypted:	false
SSDEEP:	3072:7pindLET+4Y/cSy51CCq/fAc3+v7nYc5eAMLJNHXyi:7pindlN4qnAc3Q7F5e3t
MD5:	4F6A940849345252F442B69A54203E19
SHA1:	70CA54E7F2B08D771899DADE475E27EBC23FA2AF
SHA-256:	C2BB6C8AC7C6AED6AB9A1C49C946845D97DBC9DFBD402D9333C1E3E7693273C0
SHA-512:	4EC775592D13F86BEDCFC9211037ACF4A163FD2216D4EF26D7FD22B35D6B8AC91240D4985C034A29D8D6D37B4EFBCE1E379C9E4EA8A0EC7B296BB8FEC981B50D
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......`.(f............D...............d.......$...d........ ...........O..H...........l.......8...........T............+..............P=..........<?..............................................................................eJ.......?......Lw......................T.......d...\.(f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5B03.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8744
Entropy (8bit):	3.713737988781394
Encrypted:	false
SSDEEP:	192:R6l7wVeJc5nW6YEIzcLW4gmfJ4nprA89bGJjffoCm:R6lXJ6W6YEccLW4gmfJ4HGdf0
MD5:	10BB970A5DB255D102C55CDF8183497D
SHA1:	FB7AE2496AA118309AB50575681EAEF3A7F0C419
SHA-256:	A7C76A8FCFA333C1584D14250614091AA55E72895997E229ED279A6F2E90DDAB
SHA-512:	B7B5D08EB53C0BA6C5F6088794F4D3EBBE7AD4FDD9B200BF4837D2319A70FF7DE23D31C8FAD8383AB9A0F6C3E43EB82327BF78C7C988C7DF06FAB962699699E5
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5B33.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4941
Entropy (8bit):	4.566361375879203
Encrypted:	false
SSDEEP:	48:cvIwWl8zslJg771I9FaWpW8VY/Ym8M4Jym+FStyq85uXdoTWTmd:uIjf/I7Wb7VjJR8TWTmd
MD5:	AC8530AEC6E8253C29B22C97EBBE1329
SHA1:	A0199E13371C71958FA99638A9D80CA553A5DCE8
SHA-256:	8296BDEF957E8C5DE9E128C7E2D290A05FDE71227112FF24277FE7983E85532A
SHA-512:	B8D4EF09A863F28B904D723D310C7DA3E603AC225DF7EC6556B2A0AA97E0DDF462001931BCE46C87CC13A6CE99790F989719F2A4C6298A1805EFF899FB8463E3
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="293537" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.422258965197262
Encrypted:	false
SSDEEP:	6144:RSvfpi6ceLP/9skLmb0OTmWSPHaJG8nAgeMZMMhA2fX4WABlEnNL0uhiTw:ovloTmW+EZMM6DFyl03w
MD5:	36B16EEE3618A5C541120C323CF75610
SHA1:	8B547F044D59E44108B43CAF080F832D3EBB3FBD
SHA-256:	CF66E28DE3A61508FC7CB936833A9F69EAD571ABDA594FF267D9B58675236AD9
SHA-512:	D9CC6E5037C425639222FD58E0CC2C0474843C6E8F9CD3F7A52B429B5CB19C880CC9FAEA494F09EF4404C6F4C98B2330E919E29DE1A265F709DDEE6F3BCBC6DF
Malicious:	false
Reputation:	low
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...a................................................................................................................................................................................................................................................................................................................................................b..U........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.431363023200837
TrID:	Win64 Executable Console Net Framework (206006/5) 48.58% Win64 Executable Console (202006/5) 47.64% Win64 Executable (generic) (12005/4) 2.83% Generic Win/DOS Executable (2004/3) 0.47% DOS Executable Generic (2002/1) 0.47%
File name:	New DHL Shipment Document Arrival Notice.pdf.exe
File size:	1'015'405 bytes
MD5:	189b8ac3c0f8d840f30f4897b2d89773
SHA1:	e6e6c3bd752cde7cf0677575d9268fc2a2070331
SHA256:	7fee503438f90d0206012674566587b5ecef1d040935809ae308b12842dc6196
SHA512:	052b3ccd16b840ff50fecc83229a0e9b432629084ef1a43af02d794debfc95a0aa054840feb3a82631176b08a3fcc8c5542c8052811ba6434e416e339dccbf16
SSDEEP:	24576:o0QxK82SgCUzIQTTzhp11LP059ncTAG6Ox23:om8lgDIv59nXQ23
TLSH:	7025BF6273F8056AF7FB4B78A87466445DF6FED22A01FA5C4854C10E0862F809A793F7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...4............."...0..-............... ....@...... ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x9EA20D34 [Sun May 3 11:25:40 2054 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x66000	0xb84	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x64cce	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x62d84	0x62e00	4623d0b561ecedf83778d96681816c71	False	0.3354856392225032	data	5.514455644985598	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x66000	0xb84	0xc00	faa2ea400892017b819c8061c3001afb	False	0.2913411458333333	data	4.187924224257089	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x660b8	0x470	data			0.477112676056338
RT_VERSION	0x66528	0x470	data	English	United States	0.4788732394366197
RT_MANIFEST	0x66998	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/24/24-07:15:17.148129	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49710	587	192.168.2.5	8.38.89.60
04/24/24-07:15:19.418719	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	49712	587	192.168.2.5	8.38.89.60
04/24/24-07:15:19.418719	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49712	587	192.168.2.5	8.38.89.60
04/24/24-07:15:19.418719	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49712	587	192.168.2.5	8.38.89.60
04/24/24-07:15:17.148183	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49710	587	192.168.2.5	8.38.89.60
04/24/24-07:15:17.148183	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49710	587	192.168.2.5	8.38.89.60
04/24/24-07:15:19.414322	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49712	587	192.168.2.5	8.38.89.60
04/24/24-07:15:17.148183	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	49710	587	192.168.2.5	8.38.89.60
04/24/24-07:15:17.148183	TCP	2855245	ETPRO TROJAN Agent Tesla Exfil via SMTP	49710	587	192.168.2.5	8.38.89.60

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 07:15:06.800882101 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 24, 2024 07:15:06.800893068 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 24, 2024 07:15:06.894632101 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 24, 2024 07:15:12.608851910 CEST	49704	443	192.168.2.5	104.26.13.205
Apr 24, 2024 07:15:12.608894110 CEST	443	49704	104.26.13.205	192.168.2.5
Apr 24, 2024 07:15:12.609241009 CEST	49704	443	192.168.2.5	104.26.13.205
Apr 24, 2024 07:15:12.616242886 CEST	49704	443	192.168.2.5	104.26.13.205
Apr 24, 2024 07:15:12.616271019 CEST	443	49704	104.26.13.205	192.168.2.5
Apr 24, 2024 07:15:12.951363087 CEST	443	49704	104.26.13.205	192.168.2.5
Apr 24, 2024 07:15:12.951430082 CEST	49704	443	192.168.2.5	104.26.13.205
Apr 24, 2024 07:15:12.954471111 CEST	49704	443	192.168.2.5	104.26.13.205
Apr 24, 2024 07:15:12.954485893 CEST	443	49704	104.26.13.205	192.168.2.5
Apr 24, 2024 07:15:12.954830885 CEST	443	49704	104.26.13.205	192.168.2.5
Apr 24, 2024 07:15:13.003967047 CEST	49704	443	192.168.2.5	104.26.13.205
Apr 24, 2024 07:15:13.028053045 CEST	49704	443	192.168.2.5	104.26.13.205
Apr 24, 2024 07:15:13.068126917 CEST	443	49704	104.26.13.205	192.168.2.5
Apr 24, 2024 07:15:13.399000883 CEST	443	49704	104.26.13.205	192.168.2.5
Apr 24, 2024 07:15:13.399070024 CEST	443	49704	104.26.13.205	192.168.2.5
Apr 24, 2024 07:15:13.399434090 CEST	49704	443	192.168.2.5	104.26.13.205
Apr 24, 2024 07:15:13.405838013 CEST	49704	443	192.168.2.5	104.26.13.205
Apr 24, 2024 07:15:15.366183043 CEST	49710	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:15.578584909 CEST	587	49710	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:15.578680992 CEST	49710	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:15.800605059 CEST	587	49710	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:15.800870895 CEST	49710	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:16.016680956 CEST	587	49710	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:16.017509937 CEST	49710	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:16.229746103 CEST	587	49710	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:16.230575085 CEST	49710	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:16.410206079 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 24, 2024 07:15:16.410206079 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 24, 2024 07:15:16.444758892 CEST	587	49710	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:16.445002079 CEST	49710	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:16.503952980 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 24, 2024 07:15:16.659507036 CEST	587	49710	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:16.659703016 CEST	49710	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:16.872674942 CEST	587	49710	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:16.873049021 CEST	49710	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:17.145792007 CEST	587	49710	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:17.148128986 CEST	49710	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:17.148183107 CEST	49710	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:17.148241043 CEST	49710	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:17.148258924 CEST	49710	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:17.360531092 CEST	587	49710	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:17.361645937 CEST	587	49710	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:17.410176992 CEST	49710	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:17.423260927 CEST	49710	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:17.635735989 CEST	587	49710	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:17.635755062 CEST	587	49710	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:17.635814905 CEST	49710	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:17.635890961 CEST	49710	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:17.636962891 CEST	49712	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:17.848174095 CEST	587	49710	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:17.849184036 CEST	587	49712	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:17.849297047 CEST	49712	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:17.882128954 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 24, 2024 07:15:17.882332087 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 24, 2024 07:15:18.071455002 CEST	587	49712	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:18.071738958 CEST	49712	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:18.287717104 CEST	587	49712	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:18.288036108 CEST	49712	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:18.503779888 CEST	587	49712	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:18.504293919 CEST	49712	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:18.716854095 CEST	587	49712	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:18.717022896 CEST	49712	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:18.931410074 CEST	587	49712	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:18.931572914 CEST	49712	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:19.144268036 CEST	587	49712	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:19.144501925 CEST	49712	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:19.406491041 CEST	587	49712	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:19.410901070 CEST	587	49712	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:19.414267063 CEST	49712	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:19.414321899 CEST	49712	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:19.418719053 CEST	49712	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:19.418754101 CEST	49712	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:19.418787956 CEST	49712	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:19.418816090 CEST	49712	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:19.418848038 CEST	49712	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:19.418869972 CEST	49712	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:19.418888092 CEST	49712	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:19.418903112 CEST	49712	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:19.626877069 CEST	587	49712	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:19.631241083 CEST	587	49712	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:19.631277084 CEST	587	49712	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:19.631310940 CEST	587	49712	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:19.631344080 CEST	587	49712	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:19.631814003 CEST	587	49712	8.38.89.60	192.168.2.5
Apr 24, 2024 07:15:19.676345110 CEST	49712	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:15:28.392074108 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 24, 2024 07:15:28.392185926 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 24, 2024 07:15:28.429510117 CEST	49724	443	192.168.2.5	23.1.237.91
Apr 24, 2024 07:15:28.429608107 CEST	443	49724	23.1.237.91	192.168.2.5
Apr 24, 2024 07:15:28.429728031 CEST	49724	443	192.168.2.5	23.1.237.91
Apr 24, 2024 07:15:28.469125986 CEST	49724	443	192.168.2.5	23.1.237.91
Apr 24, 2024 07:15:28.469165087 CEST	443	49724	23.1.237.91	192.168.2.5
Apr 24, 2024 07:15:28.552714109 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 24, 2024 07:15:28.552736044 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 24, 2024 07:15:28.799385071 CEST	443	49724	23.1.237.91	192.168.2.5
Apr 24, 2024 07:15:28.799495935 CEST	49724	443	192.168.2.5	23.1.237.91
Apr 24, 2024 07:15:48.006088018 CEST	443	49724	23.1.237.91	192.168.2.5
Apr 24, 2024 07:15:48.006159067 CEST	49724	443	192.168.2.5	23.1.237.91
Apr 24, 2024 07:16:54.019680977 CEST	49712	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:16:54.237237930 CEST	587	49712	8.38.89.60	192.168.2.5
Apr 24, 2024 07:16:54.237270117 CEST	587	49712	8.38.89.60	192.168.2.5
Apr 24, 2024 07:16:54.237353086 CEST	49712	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:16:54.237561941 CEST	49712	587	192.168.2.5	8.38.89.60
Apr 24, 2024 07:16:54.451049089 CEST	587	49712	8.38.89.60	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 07:15:12.447891951 CEST	59423	53	192.168.2.5	1.1.1.1
Apr 24, 2024 07:15:12.601500988 CEST	53	59423	1.1.1.1	192.168.2.5
Apr 24, 2024 07:15:13.992084026 CEST	56428	53	192.168.2.5	1.1.1.1
Apr 24, 2024 07:15:15.007616043 CEST	56428	53	192.168.2.5	1.1.1.1
Apr 24, 2024 07:15:15.365432024 CEST	53	56428	1.1.1.1	192.168.2.5
Apr 24, 2024 07:15:15.365447044 CEST	53	56428	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 24, 2024 07:15:12.447891951 CEST	192.168.2.5	1.1.1.1	0xd336	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:15:13.992084026 CEST	192.168.2.5	1.1.1.1	0xf39c	Standard query (0)	smtp.prestamp.in	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:15:15.007616043 CEST	192.168.2.5	1.1.1.1	0xf39c	Standard query (0)	smtp.prestamp.in	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 24, 2024 07:15:12.601500988 CEST	1.1.1.1	192.168.2.5	0xd336	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:15:12.601500988 CEST	1.1.1.1	192.168.2.5	0xd336	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:15:12.601500988 CEST	1.1.1.1	192.168.2.5	0xd336	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:15:14.482464075 CEST	1.1.1.1	192.168.2.5	0xe71c	No error (0)	windowsupdatebg.s.llnwi.net		68.142.107.4	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:15:15.008364916 CEST	1.1.1.1	192.168.2.5	0x3a80	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 07:15:15.008364916 CEST	1.1.1.1	192.168.2.5	0x3a80	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:15:15.365432024 CEST	1.1.1.1	192.168.2.5	0xf39c	No error (0)	smtp.prestamp.in		8.38.89.60	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:15:15.365447044 CEST	1.1.1.1	192.168.2.5	0xf39c	No error (0)	smtp.prestamp.in		8.38.89.60	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:16:16.749797106 CEST	1.1.1.1	192.168.2.5	0xcec5	No error (0)	windowsupdatebg.s.llnwi.net		68.142.107.4	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.26.13.205	443	4028	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:15:13 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-24 05:15:13 UTC	211	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 05:15:13 GMT Content-Type: text/plain Content-Length: 13 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87939d3fa96d092a-LAX
2024-04-24 05:15:13 UTC	13	IN	Data Raw: 31 35 34 2e 31 36 2e 31 30 35 2e 33 36 Data Ascii: 154.16.105.36

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 24, 2024 07:15:15.800605059 CEST	587	49710	8.38.89.60	192.168.2.5	220 cs9.nethostingpoint.com
Apr 24, 2024 07:15:15.800870895 CEST	49710	587	192.168.2.5	8.38.89.60	EHLO 093954
Apr 24, 2024 07:15:16.016680956 CEST	587	49710	8.38.89.60	192.168.2.5	250-cs9.nethostingpoint.com Hello [154.16.105.36] 250-SIZE 41943040 250-AUTH LOGIN CRAM-MD5 250-8BITMIME 250-DSN 250 OK
Apr 24, 2024 07:15:16.017509937 CEST	49710	587	192.168.2.5	8.38.89.60	AUTH login cGxhbnQucHMyQHByZXN0YW1wLmlu
Apr 24, 2024 07:15:16.229746103 CEST	587	49710	8.38.89.60	192.168.2.5	334 UGFzc3dvcmQ6
Apr 24, 2024 07:15:16.444758892 CEST	587	49710	8.38.89.60	192.168.2.5	235 Authentication successful
Apr 24, 2024 07:15:16.445002079 CEST	49710	587	192.168.2.5	8.38.89.60	MAIL FROM:<plant.ps2@prestamp.in>
Apr 24, 2024 07:15:16.659507036 CEST	587	49710	8.38.89.60	192.168.2.5	250 OK <plant.ps2@prestamp.in> Sender ok
Apr 24, 2024 07:15:16.659703016 CEST	49710	587	192.168.2.5	8.38.89.60	RCPT TO:<sjohne@yandex.com>
Apr 24, 2024 07:15:16.872674942 CEST	587	49710	8.38.89.60	192.168.2.5	250 OK <sjohne@yandex.com> Recipient ok
Apr 24, 2024 07:15:16.873049021 CEST	49710	587	192.168.2.5	8.38.89.60	DATA
Apr 24, 2024 07:15:17.145792007 CEST	587	49710	8.38.89.60	192.168.2.5	354 Start mail input; end with <CRLF>.<CRLF>
Apr 24, 2024 07:15:17.148258924 CEST	49710	587	192.168.2.5	8.38.89.60	.
Apr 24, 2024 07:15:17.361645937 CEST	587	49710	8.38.89.60	192.168.2.5	250 OK
Apr 24, 2024 07:15:17.423260927 CEST	49710	587	192.168.2.5	8.38.89.60	QUIT
Apr 24, 2024 07:15:17.635735989 CEST	587	49710	8.38.89.60	192.168.2.5	221 Service closing transmission channel
Apr 24, 2024 07:15:18.071455002 CEST	587	49712	8.38.89.60	192.168.2.5	220 cs9.nethostingpoint.com
Apr 24, 2024 07:15:18.071738958 CEST	49712	587	192.168.2.5	8.38.89.60	EHLO 093954
Apr 24, 2024 07:15:18.287717104 CEST	587	49712	8.38.89.60	192.168.2.5	250-cs9.nethostingpoint.com Hello [154.16.105.36] 250-SIZE 41943040 250-AUTH LOGIN CRAM-MD5 250-8BITMIME 250-DSN 250 OK
Apr 24, 2024 07:15:18.288036108 CEST	49712	587	192.168.2.5	8.38.89.60	AUTH login cGxhbnQucHMyQHByZXN0YW1wLmlu
Apr 24, 2024 07:15:18.503779888 CEST	587	49712	8.38.89.60	192.168.2.5	334 UGFzc3dvcmQ6
Apr 24, 2024 07:15:18.716854095 CEST	587	49712	8.38.89.60	192.168.2.5	235 Authentication successful
Apr 24, 2024 07:15:18.717022896 CEST	49712	587	192.168.2.5	8.38.89.60	MAIL FROM:<plant.ps2@prestamp.in>
Apr 24, 2024 07:15:18.931410074 CEST	587	49712	8.38.89.60	192.168.2.5	250 OK <plant.ps2@prestamp.in> Sender ok
Apr 24, 2024 07:15:18.931572914 CEST	49712	587	192.168.2.5	8.38.89.60	RCPT TO:<sjohne@yandex.com>
Apr 24, 2024 07:15:19.144268036 CEST	587	49712	8.38.89.60	192.168.2.5	250 OK <sjohne@yandex.com> Recipient ok
Apr 24, 2024 07:15:19.144501925 CEST	49712	587	192.168.2.5	8.38.89.60	DATA
Apr 24, 2024 07:15:19.410901070 CEST	587	49712	8.38.89.60	192.168.2.5	354 Start mail input; end with <CRLF>.<CRLF>
Apr 24, 2024 07:15:19.418903112 CEST	49712	587	192.168.2.5	8.38.89.60	.
Apr 24, 2024 07:15:19.631814003 CEST	587	49712	8.38.89.60	192.168.2.5	250 OK
Apr 24, 2024 07:16:54.019680977 CEST	49712	587	192.168.2.5	8.38.89.60	QUIT
Apr 24, 2024 07:16:54.237237930 CEST	587	49712	8.38.89.60	192.168.2.5	221 Service closing transmission channel

Target ID:	0
Start time:	07:15:08
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\New DHL Shipment Document Arrival Notice.pdf.exe"
Imagebase:	0x16162240000
File size:	1'015'405 bytes
MD5 hash:	189B8AC3C0F8D840F30F4897B2D89773
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2184155849.00000161645D8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2184155849.0000016164089000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2187402638.0000016174037000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2187402638.0000016174037000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:15:08
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:15:10
Start date:	24/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Imagebase:
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	07:15:11
Start date:	24/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	07:15:11
Start date:	24/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Imagebase:	0xd00000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.3254981544.000000000318C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.3254981544.0000000003194000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.3252878938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.3252878938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.3254981544.0000000003161000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.3254981544.0000000003161000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	07:15:11
Start date:	24/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Imagebase:	0x120000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:15:11
Start date:	24/04/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6500 -s 1092
Imagebase:	0x7ff704d60000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	60
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF848F1EBF8 Relevance: 3.2, Strings: 2, Instructions: 731
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 00007FF848F224DF
hH, xrefs: 00007FF848F227B0

Memory Dump Source

Source File: 00000000.00000002.2190489713.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_New DHL Shipment Document Arrival Notice.jbxd

Similarity

API ID:
String ID: hH$d
API String ID: 0-2066647031
Opcode ID: 3cfc4a94ab62dff271587252266861a5bf7dbefbb8c37fa1100b299735fdc599
Instruction ID: 8fef23501d5cf501d3c055c41ba141f48ae3419eea6926e1171925658a839da4
Opcode Fuzzy Hash: 3cfc4a94ab62dff271587252266861a5bf7dbefbb8c37fa1100b299735fdc599
Instruction Fuzzy Hash: 7A225531A1DA4A4FE349EB28A4825B1B7E0FF45350F1446BAD44AC71D7EF3AE8438785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F129A1 Relevance: 2.0, Strings: 1, Instructions: 763
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HAH, xrefs: 00007FF848F130AE

Memory Dump Source

Source File: 00000000.00000002.2190489713.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_New DHL Shipment Document Arrival Notice.jbxd

Similarity

API ID:
String ID: HAH
API String ID: 0-1579723087
Opcode ID: 3648465cdc0b8106bfb25a10f5c045533ff2207c46de458ee950cfb38eacb638
Instruction ID: 245076edad1947726860000ee9b29c6c7cabd5df01ed94a3113653ea86c11541
Opcode Fuzzy Hash: 3648465cdc0b8106bfb25a10f5c045533ff2207c46de458ee950cfb38eacb638
Instruction Fuzzy Hash: BB42BE30A1CA164FE769FB6880516B9B3E1EF89390F14457DD48EC76D6DF28AC82C748

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F21D88 Relevance: 1.7, Strings: 1, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fish, xrefs: 00007FF848F21DE0

Memory Dump Source

Source File: 00000000.00000002.2190489713.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_New DHL Shipment Document Arrival Notice.jbxd

Similarity

API ID:
String ID: fish
API String ID: 0-1064584243
Opcode ID: ffeb31363651c7097cd34c3f9cd338d1ce877566378ae836dbcdfe1df4860e42
Instruction ID: c970ea4809aebd84e534a05027ada9f418a34146a1d60bd0f65e8d921c1729d1
Opcode Fuzzy Hash: ffeb31363651c7097cd34c3f9cd338d1ce877566378ae836dbcdfe1df4860e42
Instruction Fuzzy Hash: C5D13531A1DA4A0FE75CBB38A8655B977E1EF96350F04417ED48BC32D3DE29A8428385

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF849000E29 Relevance: 1.1, Instructions: 1108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2191470419.00007FF849000000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff849000000_New DHL Shipment Document Arrival Notice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49c72a6885577fef051b1a63a7d857ebc91beb2314d077605c5e99124d69fa3b
Instruction ID: 5edfa25e8a5a8ed8eff71d641598b583e7fe509e923cdb0f54307e0170f2d85e
Opcode Fuzzy Hash: 49c72a6885577fef051b1a63a7d857ebc91beb2314d077605c5e99124d69fa3b
Instruction Fuzzy Hash: 19721A3180DAC54FEBA6EF28A8555B47FE1FF56344F1901FEC089CB093E929A84AC751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F14309 Relevance: .9, Instructions: 884COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2190489713.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_New DHL Shipment Document Arrival Notice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a7c1f2695898131763e467521747b0193021194d1eabbe3b2cd2b3e1d471387
Instruction ID: ff136655992f4a3688956e4ee9152f995c800c098730fa06ad1f990db3812882
Opcode Fuzzy Hash: 2a7c1f2695898131763e467521747b0193021194d1eabbe3b2cd2b3e1d471387
Instruction Fuzzy Hash: DB420130A1CA464FE749BF2894416B9B3E2FFA5390F50017DD48E835C7EF29AC428789

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1FCB0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 277
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00007FF848F1FEA1

Strings

$, xrefs: 00007FF848F1FCDE

Memory Dump Source

Source File: 00000000.00000002.2190489713.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_New DHL Shipment Document Arrival Notice.jbxd

Similarity

API ID: LibraryLoad
String ID: $
API String ID: 1029625771-3993045852
Opcode ID: bd26c14fadc0d3bcadde598dc1dd9f800c1907958f8dda60706ef6b048cdfdf6
Instruction ID: 4e267d20ae5c01462a44f95b8843920d35a2f0c157502be351f6fba5d72f2aa6
Opcode Fuzzy Hash: bd26c14fadc0d3bcadde598dc1dd9f800c1907958f8dda60706ef6b048cdfdf6
Instruction Fuzzy Hash: 0381C030908A8D8FEB98EF28D8457B977E1FF59350F10417EE80DC7292DB79A8458B91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF84900026B Relevance: 2.3, Strings: 1, Instructions: 1032
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A, xrefs: 00007FF849000786

Memory Dump Source

Source File: 00000000.00000002.2191470419.00007FF849000000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff849000000_New DHL Shipment Document Arrival Notice.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: de2951a86cd5119b3b61ef7b694165c861bed143d3ed78dbe95d46c76b00b94f
Instruction ID: bce6642eaba55ba3426fb7950b07fa1f035db3ff50adcaff512021fd30e950c8
Opcode Fuzzy Hash: de2951a86cd5119b3b61ef7b694165c861bed143d3ed78dbe95d46c76b00b94f
Instruction Fuzzy Hash: 5762187180DAC58FEB66EF2898556A47BF0FF56344F1805FEC08DCB193EA25A846C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F202B4 Relevance: 1.6, APIs: 1, Instructions: 129
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FF848F20371

Memory Dump Source

Source File: 00000000.00000002.2190489713.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_New DHL Shipment Document Arrival Notice.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b13f80fb5648b94c3e0e75b63e8a307e7b3356436f176163f75bb9c161564256
Instruction ID: 66ea67c8889b97f864107592a4ebc22ce1f1bc441758f908a85bf4dae9cf5a9d
Opcode Fuzzy Hash: b13f80fb5648b94c3e0e75b63e8a307e7b3356436f176163f75bb9c161564256
Instruction Fuzzy Hash: A4312B3190CA4C8FDB08EB9898466F9BBE1FB55321F04426FD049C3192CF75A856C795

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F108BD Relevance: 1.6, APIs: 1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FF848F1093F

Memory Dump Source

Source File: 00000000.00000002.2190489713.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_New DHL Shipment Document Arrival Notice.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 538808f788d5b7a36918575bafb37c0e77c04f1c7ba99df8aaf4af20cc3f2655
Instruction ID: 4be8e02a68d9df4839f9000c2d308ddd33f6b2d86f16d48fcbecf7680a72a3f8
Opcode Fuzzy Hash: 538808f788d5b7a36918575bafb37c0e77c04f1c7ba99df8aaf4af20cc3f2655
Instruction Fuzzy Hash: BA21927190CB4C8FDB69EB58D849AE9BBF0EB55310F00416FD08AC3652DB656845CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF849001269 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2191470419.00007FF849000000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff849000000_New DHL Shipment Document Arrival Notice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b0950c861a13308c81a0a95238ba879bed0bbfb799debda2366d6a4494abce
Instruction ID: 1f99e2dd650ea4eaedbc0fb1d6e428ddae60ea9a4a30ee56dc2c2e364758afe6
Opcode Fuzzy Hash: 32b0950c861a13308c81a0a95238ba879bed0bbfb799debda2366d6a4494abce
Instruction Fuzzy Hash: 9E41E73180CAC98FDFA6EF24E8958B47BE1FF65344B1901EAD049CB592EE25E845C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF849000A07 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2191470419.00007FF849000000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff849000000_New DHL Shipment Document Arrival Notice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27143ef1844b1311c1672b5bd54d02121049e9b21702436597990735304f1a6b
Instruction ID: f5e10ccde78f58e0b9f7a5019f4121cb11b28f3a47cf3dfbaac75d3bb94a95d4
Opcode Fuzzy Hash: 27143ef1844b1311c1672b5bd54d02121049e9b21702436597990735304f1a6b
Instruction Fuzzy Hash: 7EE09A35A046298EDF65DB48EC41FD9B7B1EB94350F0041E6D54DE7251CB306A85CF92

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF848F11218 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

"1, xrefs: 00007FF848F112CE

Memory Dump Source

Source File: 00000000.00000002.2190489713.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_New DHL Shipment Document Arrival Notice.jbxd

Similarity

API ID:
String ID: "1
API String ID: 0-1761163573
Opcode ID: a8263741188293e3f759bafa46384435d815a604a4eec7bb5adef3bc085c4552
Instruction ID: ea507d2f63f0257a3ad26c190caa1c365348783e870894aa3248e598a9f1f852
Opcode Fuzzy Hash: a8263741188293e3f759bafa46384435d815a604a4eec7bb5adef3bc085c4552
Instruction Fuzzy Hash: 7D51D92BB19532D5D6107A7EB4451DA7724EFC13BAB09067BC288CE4439A1D78CA87F8

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1CE19 Relevance: .7, Instructions: 699COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2190489713.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_New DHL Shipment Document Arrival Notice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f91d8d0ae9c06d27008973ae9ed58d700db688f4f4d35ef7a550bcbc3b28343
Instruction ID: 1172b0c69c97a83cd0add18c05980b210c138f8c9874900b8153a42c58c78744
Opcode Fuzzy Hash: 3f91d8d0ae9c06d27008973ae9ed58d700db688f4f4d35ef7a550bcbc3b28343
Instruction Fuzzy Hash: 83221430A1DA864FE759BB2884511B4B7F0FF42354F6446BEC08AC75D7DB28BC528785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1246D Relevance: .6, Instructions: 575COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2190489713.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_New DHL Shipment Document Arrival Notice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a282bff4db58ad418445ed2fd8e7b9ac166e8c6dd267aab9db1ec80d183a5cd
Instruction ID: 546d0b29940a3635022de0ad9d3c6d6e45b59473c011d61caa3d19b81f643eaa
Opcode Fuzzy Hash: 7a282bff4db58ad418445ed2fd8e7b9ac166e8c6dd267aab9db1ec80d183a5cd
Instruction Fuzzy Hash: 3602F030A0CA898FE759EBA88495672B7E2EF99350F1404B9C04AC76D3DF39BC46C744

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 4028, Parent PID: 6500COMMON

Execution Graph

Execution Coverage:	11.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	112
Total number of Limit Nodes:	8

Executed Functions

Function 06A93050 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$cq, xrefs: 06A9374F
$cq, xrefs: 06A9375B
$cq, xrefs: 06A937A8
$cq, xrefs: 06A93784
$cq, xrefs: 06A9379C
$cq, xrefs: 06A93778

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID: $cq$$cq$$cq$$cq$$cq$$cq
API String ID: 0-2877684506
Opcode ID: 2fe37c11d181af6d9e29aa96c6589d9369c21dd3996698ecd996ee174d61c263
Instruction ID: 9a160151076603eefd7fd8e0c4046fa9d6ec614738046af84d3ef51214423897
Opcode Fuzzy Hash: 2fe37c11d181af6d9e29aa96c6589d9369c21dd3996698ecd996ee174d61c263
Instruction Fuzzy Hash: DD321131E1061ACBCF15EFA5C99459DB7B2FFC9300F60C699D419AB264EB30AD85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06A9B620 Relevance: 8.0, Strings: 6, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$cq, xrefs: 06A9BB9B
$cq, xrefs: 06A9BBC3
$cq, xrefs: 06A9BBCF
$cq, xrefs: 06A9BB8F
$cq, xrefs: 06A9BB5B
$cq, xrefs: 06A9BB67

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID: $cq$$cq$$cq$$cq$$cq$$cq
API String ID: 0-2877684506
Opcode ID: dc825fd20aa0349402476723193ab3022013062b9af04521b21ef6b8505dd79c
Instruction ID: dbe6cc02f589f4cfc90faf7b2e4e870d78d3c4b9edb01c10844834bd1dbef3e7
Opcode Fuzzy Hash: dc825fd20aa0349402476723193ab3022013062b9af04521b21ef6b8505dd79c
Instruction Fuzzy Hash: 32023C30E1010A8FDF64EB68E5946AEB7F2EF45310F24856AE415DF291DB34EC85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A97D60 Relevance: 3.0, Strings: 2, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$cq, xrefs: 06A982D8
$cq, xrefs: 06A982CC

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID: $cq$$cq
API String ID: 0-2695052418
Opcode ID: 94d6a699126a568d3167406d022ad6e251473c19e46b90e9f596e3237bdee67f
Instruction ID: e65872d8bbd7ae6f3f3d41fe97f816550919e75df58161200dde9a6c24f93d17
Opcode Fuzzy Hash: 94d6a699126a568d3167406d022ad6e251473c19e46b90e9f596e3237bdee67f
Instruction Fuzzy Hash: 1002D130B102068FDF55EB69D5506AEB7F2FF85304F248969D8169B394DB39EC82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06A95590 Relevance: 1.8, Strings: 1, Instructions: 592
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06A958FD

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 84fe20e8d7744b26dac94fc0c6c39735efca8c5c44936258e9856fe5e5276b38
Instruction ID: 0c15717f42695954f87dd120e96a83558fc17cce75eb5532750a6cfae52c4fc7
Opcode Fuzzy Hash: 84fe20e8d7744b26dac94fc0c6c39735efca8c5c44936258e9856fe5e5276b38
Instruction Fuzzy Hash: 4322C275E002158FDF65EBA8C9816AEB7F2FF85320F248469D515AF394DA31DC41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06A965C8 Relevance: .8, Instructions: 820COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34a8b87082ab67bb64f7aa5ec2f0df828056dacbc0212c44586cfe10cd18552
Instruction ID: e0d7c1012ccfd337602b8f8534e624784a2973a15e3ffb7beebba28dce6c46c7
Opcode Fuzzy Hash: a34a8b87082ab67bb64f7aa5ec2f0df828056dacbc0212c44586cfe10cd18552
Instruction Fuzzy Hash: 60628F34A002059FEF55EB68D594BADB7F2EF88314F248469E406DB390DB35ED46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06A9C168 Relevance: .6, Instructions: 640COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08a21f0af28121de0c7d23fb2e691146e39fccdee7c4bc70a6df14022f56d600
Instruction ID: a0d55a2d865248ca519ba916a00910fa03b8e580e079e2013e7c44a2b9248df1
Opcode Fuzzy Hash: 08a21f0af28121de0c7d23fb2e691146e39fccdee7c4bc70a6df14022f56d600
Instruction Fuzzy Hash: A6327334B105059FDF55EB68D990AADB7F2FB88320F208525E516DB391DB34EC82CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06A9B208 Relevance: .6, Instructions: 564COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 451f2cfd70ed474d423a08452bb9055ce717ccb182099a7a0a10ee27d390121b
Instruction ID: 3ad7846b057ec40212fbd1c88e8f1943f7b9a26636c03f20b9950862a98dde18
Opcode Fuzzy Hash: 451f2cfd70ed474d423a08452bb9055ce717ccb182099a7a0a10ee27d390121b
Instruction Fuzzy Hash: 9B222B74E101098FEF64EB98E5947AEB7F2EB89310F248565E419DB391CA34DC81CB71

Uniqueness

Uniqueness Score: -1.00%

Function 06A9ACB0 Relevance: 10.4, Strings: 8, Instructions: 402
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$cq, xrefs: 06A9AE30
$cq, xrefs: 06A9AE53
$cq, xrefs: 06A9AE88
$cq, xrefs: 06A9AE5F
$cq, xrefs: 06A9AE7C
$cq, xrefs: 06A9ADD1
$cq, xrefs: 06A9ADDD
$cq, xrefs: 06A9AE24

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID: $cq$$cq$$cq$$cq$$cq$$cq$$cq$$cq
API String ID: 0-3377385791
Opcode ID: 2f7ed34ed436d4740247d7acdaaad0c304441e736ce19a3172d35764d17cf2b4
Instruction ID: 3ca21554026d9453d86b08f37b984a3534d3903397d7f8b0ea3f69b0b15e4c4b
Opcode Fuzzy Hash: 2f7ed34ed436d4740247d7acdaaad0c304441e736ce19a3172d35764d17cf2b4
Instruction Fuzzy Hash: EDE19130E1021A8FDF55EB69D5506AEB7F2FF89304F30852AE905AB354DB359C46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06A99130 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$cq, xrefs: 06A991DB
$cq, xrefs: 06A991A0
$cq, xrefs: 06A991AC
$cq, xrefs: 06A991E7

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID: $cq$$cq$$cq$$cq
API String ID: 0-2876200767
Opcode ID: fdc9947ea85baf277af01a11872859eda8715bd90a4cce52ed21d50b3f9ba761
Instruction ID: e2295fa452e63430e5e61806c1732eb5c4123fb6c458f901b8d6595a5599abdf
Opcode Fuzzy Hash: fdc9947ea85baf277af01a11872859eda8715bd90a4cce52ed21d50b3f9ba761
Instruction Fuzzy Hash: 6D915030B1020A9FDF55DB69D9507AFB3F6FBC4240F248469D819DB384EB349C868BA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A9CF30 Relevance: 4.5, Strings: 3, Instructions: 799
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$cq, xrefs: 06A9D32F
$cq, xrefs: 06A9D327
$cq, xrefs: 06A9D33B

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID: $cq$$cq$$cq
API String ID: 0-2085107096
Opcode ID: 1119986c01580518bfe3ca21d4076b434883b354c943bd8f214cf0fcb72e4425
Instruction ID: 185672b25b52dc3d0cc7a3c81d79a5d3276a74b85d7b1c5ec2da0fa1982c9baf
Opcode Fuzzy Hash: 1119986c01580518bfe3ca21d4076b434883b354c943bd8f214cf0fcb72e4425
Instruction Fuzzy Hash: 10628170A106068FCB55EB68D690A5EB7F3FF84304B308969E4169F365DB35EC86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06A94B58 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Ohq, xrefs: 06A94D33
XPhq, xrefs: 06A94CA9
fhq, xrefs: 06A94B83

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID: fhq$XPhq$\Ohq
API String ID: 0-1165799323
Opcode ID: de8d3f8a300a1477d3ae98a33f3f43d7191f05ce3330d28d6f748750a2812466
Instruction ID: bfa49e47f3eb348aa70a21ec6466caf086ea874f6fa50d40a93628b515dc6430
Opcode Fuzzy Hash: de8d3f8a300a1477d3ae98a33f3f43d7191f05ce3330d28d6f748750a2812466
Instruction Fuzzy Hash: AB615E70F002199FEF55AFA9C8147AEBAF6FF88310F208429E106EB3D5DA754C458B90

Uniqueness

Uniqueness Score: -1.00%

Function 06A99125 Relevance: 2.7, Strings: 2, Instructions: 167
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$cq, xrefs: 06A991DB
$cq, xrefs: 06A991A0

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID: $cq$$cq
API String ID: 0-2695052418
Opcode ID: fe67eb8c3cfb7c62ca8458aad8d28631a207da1caa8a8cae64685d4d078331b2
Instruction ID: 1fd0163ec62783c5a877e7a5b028eb6f591799833d3b4f3c5e49ad879e7120b7
Opcode Fuzzy Hash: fe67eb8c3cfb7c62ca8458aad8d28631a207da1caa8a8cae64685d4d078331b2
Instruction Fuzzy Hash: 72514030B001069FDF55EB79D95076FB3F6EBC8244F248469D80ADB394EB35AC428BA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A94B48 Relevance: 2.6, Strings: 2, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPhq, xrefs: 06A94CA9
fhq, xrefs: 06A94B83

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID: fhq$XPhq
API String ID: 0-3594109931
Opcode ID: 31264b5809d3a3c94d3e1d99b628f49dab5964d6846b930596154f0ac4e078ff
Instruction ID: 0d331f867e3023b6ee274b56bede4d2b87c770e3fbcea5c5bff22d356beb6678
Opcode Fuzzy Hash: 31264b5809d3a3c94d3e1d99b628f49dab5964d6846b930596154f0ac4e078ff
Instruction Fuzzy Hash: 3B515F74F102099FEB55EFA9C8147AEBBF6FF88300F208529D105AB3D5DA758C068B90

Uniqueness

Uniqueness Score: -1.00%

Function 06A7EA80 Relevance: 1.7, APIs: 1, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3261983612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a70000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 869d2651e51af8cf37d1226a454235fef3d27c450c09d788238c4e0bed8cc551
Instruction ID: ab997642ccb5f2be752e812ab53cf5f4143d842c43acbe6c2a46c3ad368acfd7
Opcode Fuzzy Hash: 869d2651e51af8cf37d1226a454235fef3d27c450c09d788238c4e0bed8cc551
Instruction Fuzzy Hash: B2714570A00B098FD7A4EF2AD95075ABBF1FF88204F108969D45ADBA40D774F849CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0138EB48 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3253739944.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1380000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 883dcb779621c98c9cb2fb5a53091a94a0e8cca1bef59621966bd4a2795eac1b
Instruction ID: a19ea314e20fb1e7e927919a7e23ee33626880ac1a39c1a0d01e7c37fa24730a
Opcode Fuzzy Hash: 883dcb779621c98c9cb2fb5a53091a94a0e8cca1bef59621966bd4a2795eac1b
Instruction Fuzzy Hash: E9413672D0438A8FDB01EFB9D8102EEBFF1AF99310F15856AD554A7381D7349845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A76618 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06A766A7

Memory Dump Source

Source File: 00000005.00000002.3261983612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a70000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3c3a6e77749847e00ed445e71738dbffbb09af5558b935ddb3a2aacd0febd938
Instruction ID: 7834166b0b5d2c4e64e34559c12a00f2fd49b29a35ac03b6b505b29c1e7e8ce3
Opcode Fuzzy Hash: 3c3a6e77749847e00ed445e71738dbffbb09af5558b935ddb3a2aacd0febd938
Instruction Fuzzy Hash: 46214BB5D00249DFCB10CF9AE984ADEBBF4EB48311F14842AE915E7350C3349A54CF65

Uniqueness

Uniqueness Score: -1.00%

Function 06A76620 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06A766A7

Memory Dump Source

Source File: 00000005.00000002.3261983612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a70000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1a495bca2d65b275029614b767f5af74df52128020536b3045068c1475760af0
Instruction ID: ef41100c386121191106b0f38f35c868974d4cf0d5858c3d872fb5ffcc5948d7
Opcode Fuzzy Hash: 1a495bca2d65b275029614b767f5af74df52128020536b3045068c1475760af0
Instruction Fuzzy Hash: E521C4B5D102499FDB10CFAAD984ADEBBF4EB48310F14841AE918A7350D374A954CF65

Uniqueness

Uniqueness Score: -1.00%

Function 06A7EED0 Relevance: 1.6, APIs: 1, Instructions: 59libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,?,?), ref: 06A7EF42

Memory Dump Source

Source File: 00000005.00000002.3261983612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a70000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b987bcf3ca534cf3879ff52d09748a2c2523209ff76a665f77e16c7b9942ac0d
Instruction ID: 91a1226104996219520b37e5e7db1abbf04e40d488902dbe19bfc2b84eaa73fa
Opcode Fuzzy Hash: b987bcf3ca534cf3879ff52d09748a2c2523209ff76a665f77e16c7b9942ac0d
Instruction Fuzzy Hash: 941144B6C002499FDB10CF9AD844ADEFBF8EB49324F14842AE419A7600C374A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06A7EED8 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,?,?), ref: 06A7EF42

Memory Dump Source

Source File: 00000005.00000002.3261983612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a70000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 245e6126728de25baf12d0eae4cdaddf0991fcdc352fd9c54bb412eca363d013
Instruction ID: 1a78145671b4fc23449b433f1d4ca299424d4034da545a0983450009977bdc28
Opcode Fuzzy Hash: 245e6126728de25baf12d0eae4cdaddf0991fcdc352fd9c54bb412eca363d013
Instruction Fuzzy Hash: B311F3B6C003498FDB10DF9AD844ADEFBF4EF88314F14846AE519A7600C375A549CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0138EC30 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0138EC97

Memory Dump Source

Source File: 00000005.00000002.3253739944.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1380000_RegAsm.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: c2ccb0637d194c598f98d7f738c764d96eaae3343e1dc539cdfbe4c7e6e925a6
Instruction ID: 76350dd66d5688943a9eb67caebf71cee1431dedc2622d481a29115c497cef2c
Opcode Fuzzy Hash: c2ccb0637d194c598f98d7f738c764d96eaae3343e1dc539cdfbe4c7e6e925a6
Instruction Fuzzy Hash: 6F1123B1C0065A9FCB10DF9AC544BDEFBF4AF48324F15852AD818B7240D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06A7DE30 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,06A7EA9C), ref: 06A7ECD6

Memory Dump Source

Source File: 00000005.00000002.3261983612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a70000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7795897586cefab5a938ce76b30da37b6a4f11e17f53375239b2a10d8f774112
Instruction ID: 4dc311eac03fff82368362f48736361ea889b99a1e68c767c29d3cbf6a77d00d
Opcode Fuzzy Hash: 7795897586cefab5a938ce76b30da37b6a4f11e17f53375239b2a10d8f774112
Instruction Fuzzy Hash: 5F1102B6C006498FDB10DF9AC944A9EFBF4EB88315F10846AD519BB200C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06A9DAA5 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

PHcq, xrefs: 06A9DC01

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID: PHcq
API String ID: 0-4245845256
Opcode ID: 02a614bf43caecbbdfdd6477dc4c9f9fcf2d75ef2e4c8fbcfcfc5ee6679e6255
Instruction ID: 829b3579b884546be2c859a13a9bdca4835458303b71ff6022660dd7d706ed5d
Opcode Fuzzy Hash: 02a614bf43caecbbdfdd6477dc4c9f9fcf2d75ef2e4c8fbcfcfc5ee6679e6255
Instruction Fuzzy Hash: EB419470E0060A9FDF65FF65C45469EBBF2FF85300F208529E406EB241DB74A886CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A921BD Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

PHcq, xrefs: 06A9230B

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID: PHcq
API String ID: 0-4245845256
Opcode ID: 402c2fecd02853d0335b7c0a8e086cbb247bca964c376f3bf06b15195399a908
Instruction ID: 5a7a35bf8261be11e095e50dd63f5c78264122fef24162d71e45b6cd168cd15e
Opcode Fuzzy Hash: 402c2fecd02853d0335b7c0a8e086cbb247bca964c376f3bf06b15195399a908
Instruction Fuzzy Hash: F831C030B202019FDF5AAB74C56476E7BF3EB89200F248568D406DB385DE39DD4ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A921D0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHcq, xrefs: 06A9230B

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID: PHcq
API String ID: 0-4245845256
Opcode ID: 87bc9ab318a571c82c2a2e443effe3ecae3e0355934db0b7ee1a3563bf5824c1
Instruction ID: 47cedeb5bf5d31f8f8bcdd247dec667c1bd82deff2bea5d210433a6299ab9834
Opcode Fuzzy Hash: 87bc9ab318a571c82c2a2e443effe3ecae3e0355934db0b7ee1a3563bf5824c1
Instruction Fuzzy Hash: 3231AF30B202069FDF59AB74C55476F7AE7AF89200F248468D406DB385DE39DE45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A982A7 Relevance: 1.3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

Strings

$cq, xrefs: 06A982CC

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID: $cq
API String ID: 0-2110363268
Opcode ID: b5efc56ea88e6985e5f772c78de374fbe74e812ebdb31ba202be835b36282da5
Instruction ID: 14b35ef86eaade96e368f48e05234f86758e03b728c85d8efc100334d26a7aa2
Opcode Fuzzy Hash: b5efc56ea88e6985e5f772c78de374fbe74e812ebdb31ba202be835b36282da5
Instruction Fuzzy Hash: 0AF08235E00114CFDF64AF55E6446ADB7F4FB46250F3848A2D812AB191C33D9986CB64

Uniqueness

Uniqueness Score: -1.00%

Function 06A961C8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86fb68b7a4145befe1e529093980b4bc66bb728c3e37f06d77012853410bacc5
Instruction ID: 11fae1bbec2e46bdb585aa4aeb7cdaf8b37216c6ce62f63245e99d86e251e5e8
Opcode Fuzzy Hash: 86fb68b7a4145befe1e529093980b4bc66bb728c3e37f06d77012853410bacc5
Instruction Fuzzy Hash: 7C61A271F100124FDF55AB6EC84466FAAE7AFC4220B254479E80EDB364DE7ADD0287E1

Uniqueness

Uniqueness Score: -1.00%

Function 06A94291 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d5b0bfc7e3cc145b02aaad475598dbe2d86dea66f758daf84902733700f4178
Instruction ID: b1f8b3e84023f744ff7da9fc7890b8378040d9170898bb8e4db6a95f9315b53c
Opcode Fuzzy Hash: 0d5b0bfc7e3cc145b02aaad475598dbe2d86dea66f758daf84902733700f4178
Instruction Fuzzy Hash: F1813934B0020A8BDF54EFB9D55466EB7F2EB89304F208429D41AEB394EA35DC468B91

Uniqueness

Uniqueness Score: -1.00%

Function 06A945AC Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d50ae62307ead70dfa7f918f8df4761b9264f7c3ed85ed5f9ed935c68c37bf25
Instruction ID: e70528c7e3ac92298f5090b66d4b6ade1de39e76146276bb76cb5717743fc85b
Opcode Fuzzy Hash: d50ae62307ead70dfa7f918f8df4761b9264f7c3ed85ed5f9ed935c68c37bf25
Instruction Fuzzy Hash: 8D914E74E0061A8BDF60DF68C850B9DB7B1FF89310F208595D549AB295DB70AA86CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06A945C0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9474e6676eb7885d77fdf31021f9464d5fe95e6ae5d32a20baf696547d6cee22
Instruction ID: d496531fcdf4a4e2c963803e2341827e14608058074484192b4fe602067392c5
Opcode Fuzzy Hash: 9474e6676eb7885d77fdf31021f9464d5fe95e6ae5d32a20baf696547d6cee22
Instruction Fuzzy Hash: 9C914F74E0061A8BDF60DF68C850B9DB7B1FF89310F208599D549BB395DB70AA86CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06A942F7 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a165c15b00070568edcb3dd52c0376019372f691b5b9ad47c64267747ced95d3
Instruction ID: d27f0f3d581fa39d5c76f9a150fca776ba496ca73585905cebb72cf7705c4d4a
Opcode Fuzzy Hash: a165c15b00070568edcb3dd52c0376019372f691b5b9ad47c64267747ced95d3
Instruction Fuzzy Hash: 07712934B0020A8BDF54EFB9D55476EB7F2EF89304F248429D40ADB295EA34DC868B91

Uniqueness

Uniqueness Score: -1.00%

Function 06A9EAF8 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 247b7d937931f928df0f95824cef107a09f2c77b5034b933f1b7fc62e7dce6fd
Instruction ID: 49b87139d58dfbe6bce6dc9cd15189853f74923bcffc6e3818a085c04a97067a
Opcode Fuzzy Hash: 247b7d937931f928df0f95824cef107a09f2c77b5034b933f1b7fc62e7dce6fd
Instruction Fuzzy Hash: BD713970E002099FDF55EBA9D990A9EBBF6FF88304F248429E415AB355DB34EC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06A9EB08 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475574f4be43384cb210bfb84166de6a8003d8ad0cf45cda6ea454fd4bd3a83a
Instruction ID: 48086bfe7069bde4ed57e68ece51d8d67abd9c2f2cd8089bf37faa5e64ebf1d9
Opcode Fuzzy Hash: 475574f4be43384cb210bfb84166de6a8003d8ad0cf45cda6ea454fd4bd3a83a
Instruction Fuzzy Hash: EE711A70E002099FDF54EBA9D990A9EBBF6FF88304F248429E415AB355DA34EC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06A9FC69 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f252ab43abb3de5e0888205982846fa7f7aeee9ea598193658b1fa9b106bdb3
Instruction ID: 49f8958fbaa2b8c6daa2976a16dcf33bbc1a9f3735aef9291cb46e3416fad7af
Opcode Fuzzy Hash: 0f252ab43abb3de5e0888205982846fa7f7aeee9ea598193658b1fa9b106bdb3
Instruction Fuzzy Hash: AF51F031E00109DFDF64BBB8E5546ADBBF2FB89315F208869E106DB251DB359C46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06A9FA18 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1c76cad60e237a6a9c00d58f1a6e9d71c106a7ec48864cf0e0db298672fdca2
Instruction ID: 957dd6bd2f026deca5a2601b9181435dceb9a8923377f314ec756f5e94fa5c09
Opcode Fuzzy Hash: c1c76cad60e237a6a9c00d58f1a6e9d71c106a7ec48864cf0e0db298672fdca2
Instruction Fuzzy Hash: 9751F5B4B201058FEF64676CD96476F26EAD78D310F30442AD50ACB7E5CA68CC91C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 06A9FA28 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb4a4b257dc337883e5adaa389238816aa3cf3d827b7ee7f7500ad20cf1ee18
Instruction ID: 3b215cb05308570ef40235c38f3e70aa01c8ddb7aae5a045a31f1d131f0f10ee
Opcode Fuzzy Hash: 5eb4a4b257dc337883e5adaa389238816aa3cf3d827b7ee7f7500ad20cf1ee18
Instruction Fuzzy Hash: 7951D7B4B201059FEF64676DD96472F26EAD78D310F30442AD50ACB7D5CA68CC91C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 06A95580 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17f829963f88450f735a77325a8fee59e44d72f8094da2fe6852ce3be7a09546
Instruction ID: 4a70fc9bcac2d87897fd396f54519f843ac1701a140f24482190a5050803f70b
Opcode Fuzzy Hash: 17f829963f88450f735a77325a8fee59e44d72f8094da2fe6852ce3be7a09546
Instruction Fuzzy Hash: 31516F74E002058FDF62AB69C481A7EF7F2EB45310F388926D656DB291C634D981CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A95401 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d375d8875748d9c31c0e1444eebc67a912fa8229fae41400865d654154f7890
Instruction ID: 236b0ce77f3a2ec15a8414d243ce65af602dcf245e84355c9e444f792bf08cf5
Opcode Fuzzy Hash: 4d375d8875748d9c31c0e1444eebc67a912fa8229fae41400865d654154f7890
Instruction Fuzzy Hash: 2C415F71E006099FDF71DFA9D881AAFF7F2EB84310F20492AD116DB641D731E8558BA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A9D958 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bb69d6910a5fd21e6357ed12c058a9c25150dd86e077d326aaccdbaba840684
Instruction ID: 3a452a8945b94edaf8307cc1ae4cf75820f4ceec1658d144ab458bba63838b1d
Opcode Fuzzy Hash: 8bb69d6910a5fd21e6357ed12c058a9c25150dd86e077d326aaccdbaba840684
Instruction Fuzzy Hash: 1C31C870E107069FDF15EF69D95069EBBF2FF85304F208929E805AB640DB70A986C760

Uniqueness

Uniqueness Score: -1.00%

Function 06A92080 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec3ad1a9a2cd1408a443103ff7244f01c995c038f7e4d200bab398dc9b0a771
Instruction ID: 210c5bc67a65cfc72f0423f9d1cb79f2fd8ad0e6052fc132676155726fd012ec
Opcode Fuzzy Hash: 0ec3ad1a9a2cd1408a443103ff7244f01c995c038f7e4d200bab398dc9b0a771
Instruction Fuzzy Hash: 6A316130E102099BDB49DFA4D95479EB7F2FF8A300F208529E906EB754DB719D46CB60

Uniqueness

Uniqueness Score: -1.00%

Function 06A92090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 797e595205473b53e915746bfff1d0f8b919b6cf0dbb57061fd17b5992ce9315
Instruction ID: a084784e95b564b3077646d758d9af68eb883a1e32ccb761b46dc93065b59853
Opcode Fuzzy Hash: 797e595205473b53e915746bfff1d0f8b919b6cf0dbb57061fd17b5992ce9315
Instruction Fuzzy Hash: A6318030E10209ABDB49DF64D95479EB7F6FF89300F208529E906EB354DB71AD46CB60

Uniqueness

Uniqueness Score: -1.00%

Function 06A93A91 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f8722e49b8aa9ef2399670a606ded5871e9e1f3a831fd0ed509aab5f8837995
Instruction ID: d5a43619f12ab3aec022e647dd92b25704d9086c74981358153f0ab54d6cfe4b
Opcode Fuzzy Hash: 5f8722e49b8aa9ef2399670a606ded5871e9e1f3a831fd0ed509aab5f8837995
Instruction Fuzzy Hash: CC217A75E012059FDF50DFB9D980AEEBBF1EB48310F208025E915EB390E635D8418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 06A93AA0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09287119ea1fc18ddbe3d5962c2a49c0a7f0cd6420d0846f5021b1743181cc71
Instruction ID: 58ebcd0c10cd2c533de52fe063616a73987d0dcee2a93cba6cd777e983230e4f
Opcode Fuzzy Hash: 09287119ea1fc18ddbe3d5962c2a49c0a7f0cd6420d0846f5021b1743181cc71
Instruction Fuzzy Hash: 43213B75E016159FDF50DFAAD980AAEB7F5EB48310F208025E915E7395E735EC408BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0131D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3253461772.000000000131D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_131d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d8487a1326bcfe61c6b7b685a2fc21737dc714d7b934ee4ae63feff2822d495
Instruction ID: bff9ed9878b6675482034e73d908174e95f8bbfc6373a733af8c86bbeb6fe782
Opcode Fuzzy Hash: 8d8487a1326bcfe61c6b7b685a2fc21737dc714d7b934ee4ae63feff2822d495
Instruction Fuzzy Hash: 6D2134B1504244DFDB19DF98D9C8B26BBA5EB85318F24C66DD8094B24AC33AD847CA62

Uniqueness

Uniqueness Score: -1.00%

Function 06A9304E Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e27941fb85419b2507b3a4d632f65d72852d44d39cc0bc8aabe345ff0d8dd8
Instruction ID: 077abc142ce817db0f4b75c886c8f76ac9f4ecfb4b65274daed1a23b52632c35
Opcode Fuzzy Hash: c0e27941fb85419b2507b3a4d632f65d72852d44d39cc0bc8aabe345ff0d8dd8
Instruction Fuzzy Hash: CE119371E002199FCF68EB78D9815DEF7F2EF89310F208569E006EB244DA318D41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06A93BB0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22bb5d819f10254841e797987cece389a671ffd005edd2c46fa71f97d37deda8
Instruction ID: db8887f04fdb14be21a3c5c97216451da7a6009dfef9ef4dbdc8c6e99dea654d
Opcode Fuzzy Hash: 22bb5d819f10254841e797987cece389a671ffd005edd2c46fa71f97d37deda8
Instruction Fuzzy Hash: D611A536B005294BDF549A69C9146AE73FAEBC8710F104536D406EB384DE64DC0687A1

Uniqueness

Uniqueness Score: -1.00%

Function 06A941F0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9682f8e467a3baeb908a1c85e5b35c635e492a4443ea0fa72772d08fc82afc3a
Instruction ID: 3a041fed634cdd69e6f51585279ffa289514bba1278f782ffffeb821655eaf86
Opcode Fuzzy Hash: 9682f8e467a3baeb908a1c85e5b35c635e492a4443ea0fa72772d08fc82afc3a
Instruction Fuzzy Hash: FE019E31B000115BEB65E6BD9554B1BBBDBEBC9620F248479E50ECB354ED25DC4343A1

Uniqueness

Uniqueness Score: -1.00%

Function 06A93868 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec2dd81213af7ccea97aa2882a36fd06a7d50eb28de8db5e2eeb02592db79c3b
Instruction ID: 6fd9167eb1ae16318dbf25da3158df8a333affb2a3513719bfbc065dee86d22c
Opcode Fuzzy Hash: ec2dd81213af7ccea97aa2882a36fd06a7d50eb28de8db5e2eeb02592db79c3b
Instruction Fuzzy Hash: 2E21F2B5C01259AFCB10DF9AD884ACEFFB4FB49310F10812AE918A7200C774A954CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06A9ED79 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b1190d60fdf5053957ebbcfc3d050623a04fad07c2b5f4fc43c7ebd256d4d21
Instruction ID: 38cf07ddd1cc2e4594d52878e0070506e07844b585b3cc3fb7ef9ac78bb19542
Opcode Fuzzy Hash: 1b1190d60fdf5053957ebbcfc3d050623a04fad07c2b5f4fc43c7ebd256d4d21
Instruction Fuzzy Hash: AC017C31B000125BDF65E77C9560B6EA7E7EBC9620F30893AE40ACB346EA65DC534791

Uniqueness

Uniqueness Score: -1.00%

Function 0131D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3253461772.000000000131D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_131d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e64fc474496645f77accdbd1a3ad286c5c0c617209a35917f0f7eb2d8cd15d48
Instruction ID: cfa51f6464091a8c426eb68faf1bf1864569c1b4a438825516192264cb276326
Opcode Fuzzy Hash: e64fc474496645f77accdbd1a3ad286c5c0c617209a35917f0f7eb2d8cd15d48
Instruction Fuzzy Hash: 8D110D75504280CFCB16CF58D9C8B15FFA1FB84318F28C6AAD8494B65AC33AD44ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 06A93B9F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b36051fc6ef1530118a8ad4a0e0f42d82d25c624a808cbaadbfbd364fcb2cd0e
Instruction ID: 5aea9cb202a579f5c95939e45af765f8a8e168ecb286c8a653135072a4ef9af5
Opcode Fuzzy Hash: b36051fc6ef1530118a8ad4a0e0f42d82d25c624a808cbaadbfbd364fcb2cd0e
Instruction Fuzzy Hash: 6201D476B000295BDF54DABDD9206EF77FADBC9310F24413AE40ADB380EE649C0687A1

Uniqueness

Uniqueness Score: -1.00%

Function 06A93870 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5076a05bb22ba831c53688fac2e4bd7a18132329e3da0e6e56be5ba09ce9c5b5
Instruction ID: 4af65fb53517f9a78f983dbc5b2c6d99649e19937b54e87610bf3c357e82d8fc
Opcode Fuzzy Hash: 5076a05bb22ba831c53688fac2e4bd7a18132329e3da0e6e56be5ba09ce9c5b5
Instruction Fuzzy Hash: FC11D0B5D01259AFCB00DF9AD884ACEFFB4FB49310F10812AE918B7200C374A954CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06A94200 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e42a19d37bdfe542e1e294e8d679032e772e1464b40697eac064e74abc325da1
Instruction ID: 7624e893211f0cfb16f6f763b1525eb8a24ddd7574c79f359e6cc7b5b66f9181
Opcode Fuzzy Hash: e42a19d37bdfe542e1e294e8d679032e772e1464b40697eac064e74abc325da1
Instruction Fuzzy Hash: D6014631B100114BEBA4A6BD955472BB7DBEBC9720F308839E50ECB394ED65DC4343A5

Uniqueness

Uniqueness Score: -1.00%

Function 06A9A2E8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a4188610beb2e857f94863e88171cc47eabeeea7c2befa7f37155c97da35087
Instruction ID: 55cb99433eb969210b4c61567a732082f3b1a561e75e36cbb24dbbf72800a12c
Opcode Fuzzy Hash: 2a4188610beb2e857f94863e88171cc47eabeeea7c2befa7f37155c97da35087
Instruction Fuzzy Hash: E4017135B001115FDB60EB3CE59076FB3E2EB85714F30892AE50ACB395DA25ED528790

Uniqueness

Uniqueness Score: -1.00%

Function 06A9ED88 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 467f06f9640d7d2745fbb5c31e3519a2a585b1be6072879c5f6d2f2a8877436c
Instruction ID: 4cf5eef05872df87d3c9d63aa8d5372bf81743c896589f812e0b99fae11372bc
Opcode Fuzzy Hash: 467f06f9640d7d2745fbb5c31e3519a2a585b1be6072879c5f6d2f2a8877436c
Instruction Fuzzy Hash: 26018C31B100161BDF65E76C9560B2EA3DBEBC9620F30883AE50ACB381EE25DC4243A1

Uniqueness

Uniqueness Score: -1.00%

Function 06A9A2F8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2e60f92012c0832a74477df4439aae4a9cf1e8db313862064564c3e9983f4bf
Instruction ID: f0a905157cf40fc0ba1acdee2baf7ecec518bbd3e3ca4c6e80d893d81565264e
Opcode Fuzzy Hash: f2e60f92012c0832a74477df4439aae4a9cf1e8db313862064564c3e9983f4bf
Instruction Fuzzy Hash: 79018139B101154BDB60EB7DE55071FF3E6E789720F30882AE60ACB390DE25EC424390

Uniqueness

Uniqueness Score: -1.00%

Function 06A9AF00 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f75210e93a5c57527946da80a843a159fe3bc12f6d6e2ba353f7abdf38d8c39b
Instruction ID: 2e38745222e26844fefa5cbe4caeb5018ced35f48b69e599a13dc8f2e68400f9
Opcode Fuzzy Hash: f75210e93a5c57527946da80a843a159fe3bc12f6d6e2ba353f7abdf38d8c39b
Instruction Fuzzy Hash: 46F0F671E002195BDF64A76CD54069EBBE6EB85324F20443EE50DEB340D6219C0583D0

Uniqueness

Uniqueness Score: -1.00%

Function 06A9C7C0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cf2e5298770e77ddbe40627d215d6e27de419191c0efe73ae92e105ba7c5d29
Instruction ID: a56f699f844cc775a1ced5d30643e5c3188323decfc985db46e64bab442032bc
Opcode Fuzzy Hash: 7cf2e5298770e77ddbe40627d215d6e27de419191c0efe73ae92e105ba7c5d29
Instruction Fuzzy Hash: E8F0A732E202289BDF546765D81099AB7B9E784664F104439ED01A7244D6356C04C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 06A96448 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27d735475ffcebc815aad594c024afeee4e62fa9f7805218ef60768f6154fe47
Instruction ID: 0e81002b197612d7af28aedef234eb9a37b130da0587b331f523e2f24f4079bf
Opcode Fuzzy Hash: 27d735475ffcebc815aad594c024afeee4e62fa9f7805218ef60768f6154fe47
Instruction Fuzzy Hash: 79E0D871E281445BEF50EFB08B1475A7BF6DB82244F3188A6C444CF101E175CE018BA0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06A97680 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$cq, xrefs: 06A97BD8
$cq, xrefs: 06A97BEE
$cq, xrefs: 06A97BE2
$cq, xrefs: 06A97B2D
$cq, xrefs: 06A97B39
$cq, xrefs: 06A977AD
$cq, xrefs: 06A9777C
$cq, xrefs: 06A97770
$cq, xrefs: 06A977A1
$cq, xrefs: 06A97BCC

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID: $cq$$cq$$cq$$cq$$cq$$cq$$cq$$cq$$cq$$cq
API String ID: 0-539408830
Opcode ID: fcf17c354d2f0cf0599da24b72e5eec6fa356f20bb25e923a60655573c1eb610
Instruction ID: a5921dc75674e634d88554b53bcfd2f39e6569c904acd83212f46e324c299bc4
Opcode Fuzzy Hash: fcf17c354d2f0cf0599da24b72e5eec6fa356f20bb25e923a60655573c1eb610
Instruction Fuzzy Hash: 8C121C30A1021ACFDF64EF69C954A9EB7F2BF89304F208569D406AB355DB34DD85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06A9A918 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$cq, xrefs: 06A9AA75
$cq, xrefs: 06A9AA94
$cq, xrefs: 06A9AAA0
$cq, xrefs: 06A9AA69
$cq, xrefs: 06A9AAD6
$cq, xrefs: 06A9AA0E
$cq, xrefs: 06A9AA1A
$cq, xrefs: 06A9AACA

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID: $cq$$cq$$cq$$cq$$cq$$cq$$cq$$cq
API String ID: 0-3377385791
Opcode ID: ccd39213ac6ed598c6bfbaece18d6a217c179efc93268a910603b2e1ee784753
Instruction ID: 028cf6b37e108c5b64dfd07c02eac62719ce75b8d8a224a7c36cd2153c6c2f03
Opcode Fuzzy Hash: ccd39213ac6ed598c6bfbaece18d6a217c179efc93268a910603b2e1ee784753
Instruction Fuzzy Hash: 01914E30A1020ADFDF64EB65DA5476EB7F2FF84304F30852AE511AB291DB749D85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06A97080 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$cq, xrefs: 06A973C8
$cq, xrefs: 06A973BC
$cq, xrefs: 06A9751C
$cq, xrefs: 06A97594
.5{q, xrefs: 06A970DB
$cq, xrefs: 06A97588
$cq, xrefs: 06A97362

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID: .5{q$$cq$$cq$$cq$$cq$$cq$$cq
API String ID: 0-986819311
Opcode ID: 63c7536fbc9dfb1f5012c2c66ed6ca8bf5612dbfcc0cb1bb8778076d6ec58c10
Instruction ID: 04379b24db2cf713611ca74d52066d86cb7023c7a0422babc8bf9d5fe64bc827
Opcode Fuzzy Hash: 63c7536fbc9dfb1f5012c2c66ed6ca8bf5612dbfcc0cb1bb8778076d6ec58c10
Instruction Fuzzy Hash: 9EF14A34B10209CFDB59EBA9D554A6EB7F2FF88304F208569D4159B394DB35EC82CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06A983B8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$cq, xrefs: 06A98612
$cq, xrefs: 06A98677
$cq, xrefs: 06A98683
$cq, xrefs: 06A9861E

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID: $cq$$cq$$cq$$cq
API String ID: 0-2876200767
Opcode ID: 04581fb9183ec9dac0fd65e329304e500db681d4620692ee719b590c4d99c4ad
Instruction ID: aa24f6cfe7867ff2f6af2760964e5d9a2a4c28bc2083e38b2be55560d7c8b07a
Opcode Fuzzy Hash: 04581fb9183ec9dac0fd65e329304e500db681d4620692ee719b590c4d99c4ad
Instruction Fuzzy Hash: 80B12930A102098FDF64EF69D5906AEB7F2FF85304F248929D4059B395DB79DC86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06A987D0 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$cq, xrefs: 06A9885B
$cq, xrefs: 06A9884F
LRcq, xrefs: 06A98912
LRcq, xrefs: 06A988C3

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID: LRcq$LRcq$$cq$$cq
API String ID: 0-2876661331
Opcode ID: a481b91544134fb8bc1fa7b738d1d05d6c47578cce62ab1cd12375e2a39a238f
Instruction ID: 4ebda5fb96d7d6d4daa39ba53792e668d904353943b6cdfd9117ea611f917b45
Opcode Fuzzy Hash: a481b91544134fb8bc1fa7b738d1d05d6c47578cce62ab1cd12375e2a39a238f
Instruction Fuzzy Hash: A651A630B102019FDF58EB29D950A6AB7F2FF89354F208969E4159F3A5DB34EC40CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A9ACA2 Relevance: 5.2, Strings: 4, Instructions: 161COMMON

Download Yara Rule

Strings

$cq, xrefs: 06A9AE53
$cq, xrefs: 06A9AE7C
$cq, xrefs: 06A9ADD1
$cq, xrefs: 06A9AE24

Memory Dump Source

Source File: 00000005.00000002.3262083715.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID: $cq$$cq$$cq$$cq
API String ID: 0-2876200767
Opcode ID: 59294a5915033ce2001eb50ca69a5adf1b3f14f0c4f797cac7e20c66e9a6f2f2
Instruction ID: 50a025c71cfd19606ef8c344bf2b41a30632fd31eb50d712243446828c3fed63
Opcode Fuzzy Hash: 59294a5915033ce2001eb50ca69a5adf1b3f14f0c4f797cac7e20c66e9a6f2f2
Instruction Fuzzy Hash: 8B518234E102159FDF65EB68D5806AEB3F2EB85314F34852AE916DB350DB35EC41CBA0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report New DHL Shipment Document Arrival Notice.pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Networking

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_New DHL Shipment_2fb9a779aae7560f97a236ac8a8e38ee4627e80_832b6b58_d4673f3b-6d65-4ce4-a848-6247b28a8c7d\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER592E.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5B03.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5B33.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
New DHL Shipment Document Arrival Notice.pdf.exe

Function 00007FF848F1EBF8 Relevance: 3.2, Strings: 2, Instructions: 731
COMMON

Function 00007FF848F129A1 Relevance: 2.0, Strings: 1, Instructions: 763
COMMON

Function 00007FF848F21D88 Relevance: 1.7, Strings: 1, Instructions: 474
COMMON

Function 00007FF848F1FCB0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 277
libraryCOMMON

Function 00007FF84900026B Relevance: 2.3, Strings: 1, Instructions: 1032
COMMON

Function 00007FF848F202B4 Relevance: 1.6, APIs: 1, Instructions: 129
memoryCOMMON

Function 00007FF848F108BD Relevance: 1.6, APIs: 1, Instructions: 88
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre