Edit tour

Windows Analysis Report
20240328-REV2.exe

Overview

General Information

Sample name:	20240328-REV2.exe
Analysis ID:	1432024
MD5:	ed1e2fd68e9de44ea4e01c7897f64411
SHA1:	a42eb4e6084ac91d1fad3ef9fe01d8d3e9db0c26
SHA256:	37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134
Tags:	exe
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

20240328-REV2.exe (PID: 6840 cmdline: "C:\Users\user\Desktop\20240328-REV2.exe" MD5: ED1E2FD68E9DE44EA4E01C7897F64411)

powershell.exe (PID: 6052 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\20240328-REV2.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 3772 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

20240328-REV2.exe (PID: 4788 cmdline: "C:\Users\user\Desktop\20240328-REV2.exe" MD5: ED1E2FD68E9DE44EA4E01C7897F64411)

WerFault.exe (PID: 2848 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6840 -s 1796 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.mbarieservicesltd.com", "Username": "saless@mbarieservicesltd.com", "Password": "     *o9H+18Q4%;M     "}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.1585065911.0000000006D50000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000005.00000002.2743308776.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000001.00000002.1582368712.0000000003799000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000005.00000002.2747010558.000000000299A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.2747010558.0000000002941000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2747010558.0000000002941000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.1582368712.0000000004187000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Process Memory Space: 20240328-REV2.exe PID: 6840	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 20240328-REV2.exe PID: 4788	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 20240328-REV2.exe PID: 4788	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.20240328-REV2.exe.6d50000.10.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.20240328-REV2.exe.6d50000.10.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.20240328-REV2.exe.3799970.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.20240328-REV2.exe.436e7a0.7.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.2.20240328-REV2.exe.4345780.6.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.2.20240328-REV2.exe.3799970.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
5.2.20240328-REV2.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.2.20240328-REV2.exe.436e7a0.7.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.2.20240328-REV2.exe.4345780.6.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\20240328-REV2.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\20240328-REV2.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\20240328-REV2.exe", ParentImage: C:\Users\user\Desktop\20240328-REV2.exe, ParentProcessId: 6840, ParentProcessName: 20240328-REV2.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\20240328-REV2.exe", ProcessId: 6052, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 199.79.62.115, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\20240328-REV2.exe, Initiated: true, ProcessId: 4788, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\20240328-REV2.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\20240328-REV2.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\20240328-REV2.exe", ParentImage: C:\Users\user\Desktop\20240328-REV2.exe, ParentProcessId: 6840, ParentProcessName: 20240328-REV2.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\20240328-REV2.exe", ProcessId: 6052, ProcessName: powershell.exe

Snort Signatures

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.8 - Destination IP: 199.79.62.115

Timestamp:	04/26/24-10:06:31.436750
SID:	2030171
Source Port:	49711
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Agent Tesla SMTP Activity - Source IP: 192.168.2.8 - Destination IP: 199.79.62.115

Timestamp:	04/26/24-10:06:31.436750
SID:	2839723
Source Port:	49711
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.8 - Destination IP: 199.79.62.115

Timestamp:	04/26/24-10:06:31.436814
SID:	2855542
Source Port:	49711
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Exfil via SMTP - Source IP: 192.168.2.8 - Destination IP: 199.79.62.115

Timestamp:	04/26/24-10:06:31.436814
SID:	2855245
Source Port:	49711
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.8 - Destination IP: 199.79.62.115

Timestamp:	04/26/24-10:06:31.436814
SID:	2840032
Source Port:	49711
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.8 - Destination IP: 199.79.62.115

Timestamp:	04/26/24-10:06:31.436814
SID:	2851779
Source Port:	49711
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://mail.mbarieservicesltd.com

Avira URL Cloud: Label: malware

Found malware configuration

Source: WmiPrvSE.exe.3772.10.memstrmin

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.mbarieservicesltd.com", "Username": "saless@mbarieservicesltd.com", "Password": " *o9H+18Q4%;M "}

Multi AV Scanner detection for domain / URL

Source: mail.mbarieservicesltd.com	Virustotal: Detection: 5%			Perma Link
Source: http://mail.mbarieservicesltd.com	Virustotal: Detection: 5%			Perma Link

Multi AV Scanner detection for submitted file

Source: 20240328-REV2.exe	ReversingLabs: Detection: 44%
Source: 20240328-REV2.exe	Virustotal: Detection: 44%			Perma Link

Machine Learning detection for sample

Source: 20240328-REV2.exe

Joe Sandbox ML: detected

Source: 20240328-REV2.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 20240328-REV2.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Data.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Xml.ni.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: Accessibility.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdbRSDS source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdb\ source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdbSystem.Data.ni.dll< source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: XZW.pdb source: 20240328-REV2.exe, WER5DE2.tmp.dmp.8.dr
Source:	Binary string: mscorlib.pdbx source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.pdbSystem.Data.dll4 source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: XZW.pdbSHA256o source: 20240328-REV2.exe
Source:	Binary string: System.Configuration.ni.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Data.ni.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Xml.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: mscorlib.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Data.ni.pdbRSDS source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Data.pdb, source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER5DE2.tmp.dmp.8.dr

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.8:49711 -> 199.79.62.115:587
Source: Traffic	Snort IDS: 2855245 ETPRO TROJAN Agent Tesla Exfil via SMTP 192.168.2.8:49711 -> 199.79.62.115:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.8:49711 -> 199.79.62.115:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.8:49711 -> 199.79.62.115:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.8:49711 -> 199.79.62.115:587
Source: Traffic	Snort IDS: 2839723 ETPRO TROJAN Win32/Agent Tesla SMTP Activity 192.168.2.8:49711 -> 199.79.62.115:587

Source: global traffic

TCP traffic: 192.168.2.8:49711 -> 199.79.62.115:587

Source: Joe Sandbox View

IP Address: 199.79.62.115 199.79.62.115

Source: Joe Sandbox View

ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS

Source: global traffic

TCP traffic: 192.168.2.8:49711 -> 199.79.62.115:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: mail.mbarieservicesltd.com

Source: 20240328-REV2.exe, 00000005.00000002.2747010558.000000000299A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.mbarieservicesltd.com
Source: 20240328-REV2.exe, 00000005.00000002.2747010558.000000000299A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mbarieservicesltd.com
Source: 20240328-REV2.exe, 00000001.00000002.1581428931.000000000280D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net

Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_04D31808	1_2_04D31808
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_04D317F8	1_2_04D317F8
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_0534C550	1_2_0534C550
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_0534E6F0	1_2_0534E6F0
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_06EA7A20	1_2_06EA7A20
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_06EA9BC0	1_2_06EA9BC0
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_06EACC18	1_2_06EACC18
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_06EAC900	1_2_06EAC900
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_06EA8D10	1_2_06EA8D10
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_06EABED0	1_2_06EABED0
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_06EA82A8	1_2_06EA82A8
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_06EAAA60	1_2_06EAAA60
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_06EA8770	1_2_06EA8770
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_06EA6F10	1_2_06EA6F10
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_06EAD8A8	1_2_06EAD8A8
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_06EABC88	1_2_06EABC88
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_06EA0040	1_2_06EA0040
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_06EA0032	1_2_06EA0032
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_06EAF148	1_2_06EAF148
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_06EAB918	1_2_06EAB918
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_070B7748	1_2_070B7748
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_070B3618	1_2_070B3618
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_070B56C0	1_2_070B56C0
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_070B2DA8	1_2_070B2DA8
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_070B4CC0	1_2_070B4CC0
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_070BA138	1_2_070BA138
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_070B31E0	1_2_070B31E0
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_089539C0	1_2_089539C0
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_08956CD8	1_2_08956CD8
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_08959CC8	1_2_08959CC8
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_0895A688	1_2_0895A688
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_08959CB8	1_2_08959CB8
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_08957280	1_2_08957280
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_08957271	1_2_08957271
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_0895C388	1_2_0895C388
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_0895A3F0	1_2_0895A3F0
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_0895A3E0	1_2_0895A3E0
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_0895C378	1_2_0895C378
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_0895A67A	1_2_0895A67A
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 5_2_00ED4140	5_2_00ED4140
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 5_2_00ED4D58	5_2_00ED4D58
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 5_2_00ED4488	5_2_00ED4488
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 5_2_0615A6C0	5_2_0615A6C0
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 5_2_0615EFB8	5_2_0615EFB8
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 5_2_0615DFEB	5_2_0615DFEB
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 5_2_06157D20	5_2_06157D20
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 5_2_06158D98	5_2_06158D98
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 5_2_06155210	5_2_06155210
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 5_2_061584CB	5_2_061584CB

Source: C:\Users\user\Desktop\20240328-REV2.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6840 -s 1796

Source: 20240328-REV2.exe, 00000001.00000000.1493632755.00000000003AE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameXZW.exe& vs 20240328-REV2.exe
Source: 20240328-REV2.exe, 00000001.00000002.1581428931.000000000280D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7b99aba2-3c62-4861-97de-170caa2c3039.exe4 vs 20240328-REV2.exe
Source: 20240328-REV2.exe, 00000001.00000002.1580368727.000000000086E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 20240328-REV2.exe
Source: 20240328-REV2.exe, 00000001.00000002.1586570461.0000000007622000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 20240328-REV2.exe
Source: 20240328-REV2.exe, 00000001.00000002.1587945175.000000000B0E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs 20240328-REV2.exe
Source: 20240328-REV2.exe, 00000001.00000002.1582368712.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7b99aba2-3c62-4861-97de-170caa2c3039.exe4 vs 20240328-REV2.exe
Source: 20240328-REV2.exe, 00000001.00000002.1582368712.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs 20240328-REV2.exe
Source: 20240328-REV2.exe, 00000005.00000002.2743308776.000000000042C000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7b99aba2-3c62-4861-97de-170caa2c3039.exe4 vs 20240328-REV2.exe
Source: 20240328-REV2.exe, 00000005.00000002.2743688093.00000000008F8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 20240328-REV2.exe
Source: 20240328-REV2.exe	Binary or memory string: OriginalFilenameXZW.exe& vs 20240328-REV2.exe

Source: 20240328-REV2.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 20240328-REV2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 1.2.20240328-REV2.exe.3799970.8.raw.unpack, V4uC3Iifq56IKQcfry.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.20240328-REV2.exe.3799970.8.raw.unpack, V4uC3Iifq56IKQcfry.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.20240328-REV2.exe.4345780.6.raw.unpack, O.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.20240328-REV2.exe.4345780.6.raw.unpack, O.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.2.20240328-REV2.exe.4345780.6.raw.unpack, P.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.20240328-REV2.exe.4345780.6.raw.unpack, P.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.20240328-REV2.exe.4345780.6.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.20240328-REV2.exe.4345780.6.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.20240328-REV2.exe.4345780.6.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.20240328-REV2.exe.4345780.6.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, DqO3BeEpxTFOeAX25D.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, suKFporoyXFpyYjnCY.cs	Security API names: _0020.SetAccessControl
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, suKFporoyXFpyYjnCY.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, suKFporoyXFpyYjnCY.cs	Security API names: _0020.AddAccessRule

Source: 1.2.20240328-REV2.exe.27f6814.5.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 1.2.20240328-REV2.exe.2a18018.1.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 1.2.20240328-REV2.exe.27e6474.3.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 1.2.20240328-REV2.exe.6d80000.11.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/11@1/1

Source: C:\Users\user\Desktop\20240328-REV2.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\20240328-REV2.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\20240328-REV2.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4920:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6840

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tckzrrwj.5ng.ps1

Jump to behavior

Source: 20240328-REV2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 20240328-REV2.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\20240328-REV2.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\20240328-REV2.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\20240328-REV2.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\20240328-REV2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 20240328-REV2.exe	ReversingLabs: Detection: 44%
Source: 20240328-REV2.exe	Virustotal: Detection: 44%

Source: unknown	Process created: C:\Users\user\Desktop\20240328-REV2.exe "C:\Users\user\Desktop\20240328-REV2.exe"
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\20240328-REV2.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process created: C:\Users\user\Desktop\20240328-REV2.exe "C:\Users\user\Desktop\20240328-REV2.exe"
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6840 -s 1796
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\20240328-REV2.exe"	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process created: C:\Users\user\Desktop\20240328-REV2.exe "C:\Users\user\Desktop\20240328-REV2.exe"	Jump to behavior

Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\20240328-REV2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\20240328-REV2.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\20240328-REV2.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 20240328-REV2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 20240328-REV2.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 20240328-REV2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: System.Data.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Xml.ni.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: Accessibility.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdbRSDS source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdb\ source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdbSystem.Data.ni.dll< source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: XZW.pdb source: 20240328-REV2.exe, WER5DE2.tmp.dmp.8.dr
Source:	Binary string: mscorlib.pdbx source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.pdbSystem.Data.dll4 source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: XZW.pdbSHA256o source: 20240328-REV2.exe
Source:	Binary string: System.Configuration.ni.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Data.ni.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Xml.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: mscorlib.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Data.ni.pdbRSDS source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdb source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Data.pdb, source: WER5DE2.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER5DE2.tmp.dmp.8.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 1.2.20240328-REV2.exe.3799970.8.raw.unpack, V4uC3Iifq56IKQcfry.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 1.2.20240328-REV2.exe.6d50000.10.raw.unpack, V4uC3Iifq56IKQcfry.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, suKFporoyXFpyYjnCY.cs

.Net Code: PRsgCpb7f4 System.Reflection.Assembly.Load(byte[])

Source: 20240328-REV2.exe

Static PE information: 0x81577B65 [Wed Oct 6 16:08:05 2038 UTC]

Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_05347E88 pushad ; iretd	1_2_05347E91
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_06EA3E3A push ds; ret	1_2_06EA3E3B
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_070B7E8A push esp; ret	1_2_070B7E91
Source: C:\Users\user\Desktop\20240328-REV2.exe	Code function: 1_2_08951CC0 push 00000059h; ret	1_2_08951CF8

Source: 20240328-REV2.exe

Static PE information: section name: .text entropy: 7.946644747446866

Source: 1.2.20240328-REV2.exe.3799970.8.raw.unpack, V4uC3Iifq56IKQcfry.cs	High entropy of concatenated method names: 'JcqLcnHE8kRk7VHJhl', 'baAwnpSkPWAs4YMGxr', 'wTgrto4LNQ', 'imnL6GCB6AIFRqkhxN', 'RgtTUJcyZL', 'dHYrbjNADO', 'xiCr8b7Qs6', 'PT2rZj37UR', 'P1WruDgOtu', 'd71eKLY6YVFQv'
Source: 1.2.20240328-REV2.exe.3799970.8.raw.unpack, vpednoN8EZgsJ4TDwx.cs	High entropy of concatenated method names: 'SvRTLtpnA', 'uJwWpedno', 'REZpgsJ4T', 'uwxys3A5Q', 'Tl3iTkB7U', 'EqRFtDP16', 'TW5lfqidm', 'wSKAUGlNW', 'LkrevaXpK', 'cwu0Op5AT'
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, MM0nqSL2pcP1fo9nGr.cs	High entropy of concatenated method names: 'BRqq8Nr7FX', 'M44qo7oWQY', 'y5ldT8nfBy', 'DvMdSxQh4k', 'OLCqfLuBSA', 'cmhq16tpVP', 'SCZqkDDN1X', 'zPWq2w2ZYe', 'SQSqaFD0qB', 'K0YqKpsekJ'
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, sCWHAZsS0UutPc9r2g.cs	High entropy of concatenated method names: 'etTqDWEbej', 'aVTq9ZmSyZ', 'ToString', 'ygUqIqK4Vy', 'F03qW68PfY', 'NZXqpU96Xm', 'OmOqAbtClF', 'DoCqOi3l8d', 'i32qeSWy7n', 'C5PqVtpR8w'
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, c3RrIbi4S2dSDSPr32.cs	High entropy of concatenated method names: 'MIaALo02Ps', 'XPQAuvKU1o', 'BdKpZnNe28', 'oZdpH33057', 'KcZpEo1nSs', 'GnHp3lMg8f', 'H5UpJBQsaA', 'iHZpMK7nrt', 'CfkpjF5Pvw', 'f9xptrqGQx'
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, RnjcWbdlYQfuZx2SOm.cs	High entropy of concatenated method names: 'NV3ONU9Il7', 'qryOmBsdxi', 'Gy9OC70crg', 'iM7OQBdRMC', 'dG9O6bNAK1', 'IAxOuoEXjH', 'gsPOYi4RYW', 'XMqOnsSXcx', 'riLhLPhLs0YYPUZxElo', 'mpS2gHhw8sDS95jecb8'
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, CbbCU2jcbmE3ilttJVQ.cs	High entropy of concatenated method names: 'XPCUmg7GMl', 'gLyUyyMIFB', 'kcJUCGjdYv', 'o45UQkBb31', 'PnFULR3T06', 'beRU63YCPm', 'L6sUuOUohj', 'YAVUssRSgx', 'NCPUYTpfA0', 'Xb3Unj10U5'
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, YCfeJ21MxuvufFcUrh.cs	High entropy of concatenated method names: 'HOWUSlVCuQ', 'GjmUbCZasf', 'QHcUg24F00', 'KBVUIY5jxf', 'CVwUWnQXjr', 'J1YUANPXeh', 'nDWUOLNUVd', 'OHvdFFywmg', 'cDdd8I8DRv', 'ivUdiHpvQN'
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, qhMJ8TxmfrQleFASsy.cs	High entropy of concatenated method names: 'q0CdvORm10', 'jhhdcIwrtE', 'gjWdZ7GPCu', 'VfadH6X2jF', 'dAHd2VXMFO', 'z0pdErBfv4', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, DqO3BeEpxTFOeAX25D.cs	High entropy of concatenated method names: 'lEyW2fbXef', 'bRKWaWfYPc', 'RFeWKROrFu', 'kxnWhsPguS', 'Y8mWRZND18', 'BNZW4sMAW4', 'GpIWFmdBSF', 'APnW86wk1l', 'BwJWiMU5tt', 'S5WWoTsWkw'
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, iFn0ALuCn6UUl6nxCD.cs	High entropy of concatenated method names: 'A3lChOBUq', 'evcQKIesi', 'lPd65EsHy', 'sJ9uBV5BS', 'GDvYs6IuH', 'rK0n98r0O', 'IMqjw9yXAiFrBN8hFp', 'RX9j3aOMNkcrx0ELrg', 'EXLdicfCU', 'vZk01eDu0'
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, D0L1d8NNnMWQU8RYtI.cs	High entropy of concatenated method names: 'hG2emnaPKs', 'tsbeyrtCq5', 'tN5eCSYfOi', 'VTkeQ3XPQI', 'k2yeLlHI3w', 'bWXe6Bkrqv', 'mVOeuA6pS9', 'gv2esAK9Tf', 'AaDeYEAy2E', 'koVenbvZZu'
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, wl90ELqXIUV7JJ3xw4.cs	High entropy of concatenated method names: 'Ve2Se8Zu8a', 'B6YSVoaH9X', 'SraSD3yLD1', 'md7S9jIaoy', 'ytVSPBqfWp', 'HB8SBFmXT2', 'XyN6KE66Jr7neSqXtD', 'wvg9D0jKRgulQQD6bd', 'ENMSSTyKMm', 'NNJSbhFl4X'
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, ooGS1Jb8LYOjRI2Nyn.cs	High entropy of concatenated method names: 'Dispose', 'uXESifRvjL', 'fCZGcJMV0w', 'GrOxxgtYnk', 'cR7SonmTru', 'NpdSz49EfY', 'ProcessDialogKey', 'NxNGT255iU', 'nJ1GSoiYGK', 'KbsGGpI7wN'
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, Oss1lVFw9xKlL9Fawd.cs	High entropy of concatenated method names: 'dlPdIwagE6', 'iEwdWvK0n8', 'OjhdpVSrVN', 'OoLdAB7lbv', 'adAdOSZmLe', 'gKMdeZCOyp', 'jxJdVOWBto', 'tI8d7YpN2o', 'kIqdDRmfAG', 'xNnd9GJkHG'
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, zpbjE8aHbUn0YcN3Lo.cs	High entropy of concatenated method names: 'mGxpQuHixV', 'GQLp6b5hBd', 'p0ipsYAL9G', 'OPvpY246VF', 'TyUpPUGMGR', 'ATIpBh0G62', 'f5MpqALqBL', 'Hkbpdu3aHq', 'DJipUWvVR2', 'rC6p0iGycM'
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, wYSy8YM5lVQ1qCEVOD.cs	High entropy of concatenated method names: 'vsAOwHDiaC', 'TKSOWgGvUO', 'Y39OABLnFl', 'ATZOeV25Uc', 'gGkOVTokAH', 'KgpARjRr47', 'PNcA4PN03g', 'e5KAFI95lA', 'oycA8td9ZL', 'rJZAiwAvxP'
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, K5uqj8D3Il5pOp6XVP.cs	High entropy of concatenated method names: 'ToString', 'WRhBfx1riw', 'FOoBc1Frlx', 'pe8BZd8hDp', 'XfGBHISJeQ', 'RdrBEibin6', 'YMXB3RW0gx', 'EysBJhUVWa', 'FZsBMO1D20', 'UAmBjHWybS'
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, P37vu0CgjevrJVGJRa.cs	High entropy of concatenated method names: 'mFDeIh7gTT', 'AAUepvyqja', 'F5FeOXKrOM', 'lhCOocA2pQ', 'cM0OzAh70f', 'ze5eTaKF6D', 'tGheSe1WkE', 'XRPeGDOrvT', 'Auseb0TkKT', 'dvJegCO0c3'
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, GxmFgWhgVkoXLP6vb2.cs	High entropy of concatenated method names: 'LB7PtER1wW', 'S9dP1xwLNa', 'DlUP2NXFfD', 'Q4IPaU7rkv', 'wkBPc8RjWH', 'QQwPZjw1Jf', 'm5wPH8x7Br', 'f8JPEhdFJY', 'sx9P3ibuoK', 'mYWPJ0yXSX'
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, tFEshmjWrsGOPEfxccc.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LYK023aC5B', 'zOd0afH5t5', 's6G0KoeE7y', 'BvS0hiDCX8', 'TEr0Rgn2tM', 'r3U04m6pk7', 'K6C0FIl0H3'
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, z27VGsnctYfwDT4cOl.cs	High entropy of concatenated method names: 'h7uXsqw47h', 'jZNXY53rol', 'YXFXvan21q', 'iFgXc2aV6j', 'uCoXHKNWVJ', 'OEnXEyeA01', 'RT5XJqC0Qi', 'urJXMX7DbY', 'c6bXtHcnPV', 'EWVXfnxmpo'
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, suKFporoyXFpyYjnCY.cs	High entropy of concatenated method names: 'kEDbwLlyxu', 'JhWbI2oSAu', 'yjRbWtwXJ1', 'r6NbpKg0xy', 'uR8bACsltZ', 'BesbO8jEpR', 'GPnbeUcUNb', 't6ibV8rkUx', 'Vrgb7jb01H', 'gDNbDMcFed'
Source: 1.2.20240328-REV2.exe.b0e0000.12.raw.unpack, rHSVVXzwWXSDqXqYTy.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'FBHUXYQop1', 'bLKUPAZrP1', 'YIxUBRR0rh', 'LmQUq8AUj8', 'xMyUdthDi7', 'rWDUUIrJEV', 'XDXU0PW7i8'
Source: 1.2.20240328-REV2.exe.6d50000.10.raw.unpack, V4uC3Iifq56IKQcfry.cs	High entropy of concatenated method names: 'JcqLcnHE8kRk7VHJhl', 'baAwnpSkPWAs4YMGxr', 'wTgrto4LNQ', 'imnL6GCB6AIFRqkhxN', 'RgtTUJcyZL', 'dHYrbjNADO', 'xiCr8b7Qs6', 'PT2rZj37UR', 'P1WruDgOtu', 'd71eKLY6YVFQv'
Source: 1.2.20240328-REV2.exe.6d50000.10.raw.unpack, vpednoN8EZgsJ4TDwx.cs	High entropy of concatenated method names: 'SvRTLtpnA', 'uJwWpedno', 'REZpgsJ4T', 'uwxys3A5Q', 'Tl3iTkB7U', 'EqRFtDP16', 'TW5lfqidm', 'wSKAUGlNW', 'LkrevaXpK', 'cwu0Op5AT'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: 20240328-REV2.exe PID: 6840, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\20240328-REV2.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\20240328-REV2.exe	Memory allocated: CE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Memory allocated: 2790000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Memory allocated: 2610000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Memory allocated: 89D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Memory allocated: 99D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Memory allocated: 9BE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Memory allocated: ABE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Memory allocated: B150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Memory allocated: C150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Memory allocated: E90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Memory allocated: 2940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Memory allocated: 27E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7156	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2275	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Window / User API: threadDelayed 2036	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Window / User API: threadDelayed 2726	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3672	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5040	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6816	Thread sleep count: 2036 > 30	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6072	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6072	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6072	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6072	Thread sleep time: -99770s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6072	Thread sleep time: -99640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6072	Thread sleep time: -99515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6816	Thread sleep count: 2726 > 30	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6072	Thread sleep time: -99358s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6072	Thread sleep time: -99249s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6072	Thread sleep time: -99140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6072	Thread sleep time: -99029s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6072	Thread sleep time: -98904s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6072	Thread sleep time: -98781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6072	Thread sleep time: -98672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6072	Thread sleep time: -98562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6072	Thread sleep time: -98453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6072	Thread sleep time: -98343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6072	Thread sleep time: -98234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6072	Thread sleep time: -98125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6072	Thread sleep time: -97977s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6072	Thread sleep time: -97859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6072	Thread sleep time: -97750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6072	Thread sleep time: -97640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe TID: 6072	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\20240328-REV2.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\20240328-REV2.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\20240328-REV2.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 99770	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 99640	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 99515	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 99358	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 99249	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 99140	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 99029	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 98904	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 98672	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 98562	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 98453	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 98343	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 98234	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 98125	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 97977	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 97859	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 97750	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 97640	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: 20240328-REV2.exe, 00000005.00000002.2743758681.000000000099A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllstringPNPDeviceID
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: 20240328-REV2.exe, 00000005.00000002.2751147441.0000000005D20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWJ
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\20240328-REV2.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\20240328-REV2.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\20240328-REV2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\20240328-REV2.exe"
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\20240328-REV2.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\20240328-REV2.exe

Memory written: C:\Users\user\Desktop\20240328-REV2.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\20240328-REV2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\20240328-REV2.exe"			Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Process created: C:\Users\user\Desktop\20240328-REV2.exe "C:\Users\user\Desktop\20240328-REV2.exe"			Jump to behavior

Source: C:\Users\user\Desktop\20240328-REV2.exe	Queries volume information: C:\Users\user\Desktop\20240328-REV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Queries volume information: C:\Users\user\Desktop\20240328-REV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\20240328-REV2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 1.2.20240328-REV2.exe.436e7a0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20240328-REV2.exe.4345780.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.20240328-REV2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20240328-REV2.exe.436e7a0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20240328-REV2.exe.4345780.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2743308776.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1582368712.0000000004187000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000005.00000002.2747010558.000000000299A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2747010558.0000000002941000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 20240328-REV2.exe PID: 4788, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 1.2.20240328-REV2.exe.6d50000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20240328-REV2.exe.6d50000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20240328-REV2.exe.3799970.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20240328-REV2.exe.3799970.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1585065911.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1582368712.0000000003799000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\20240328-REV2.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\20240328-REV2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\20240328-REV2.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\20240328-REV2.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\20240328-REV2.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 00000005.00000002.2747010558.0000000002941000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 20240328-REV2.exe PID: 4788, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 1.2.20240328-REV2.exe.436e7a0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20240328-REV2.exe.4345780.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.20240328-REV2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20240328-REV2.exe.436e7a0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20240328-REV2.exe.4345780.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2743308776.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1582368712.0000000004187000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000005.00000002.2747010558.000000000299A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2747010558.0000000002941000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 20240328-REV2.exe PID: 4788, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 1.2.20240328-REV2.exe.6d50000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20240328-REV2.exe.6d50000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20240328-REV2.exe.3799970.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20240328-REV2.exe.3799970.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1585065911.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1582368712.0000000003799000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	2 OS Credential Dumping	131 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	1 Credentials in Registry	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	151 Virtualization/Sandbox Evasion	Security Account Manager	151 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Data from Local System	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
20240328-REV2.exe	45%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
20240328-REV2.exe	44%	Virustotal		Browse
20240328-REV2.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
mbarieservicesltd.com	1%	Virustotal		Browse
mail.mbarieservicesltd.com	5%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://mail.mbarieservicesltd.com	100%	Avira URL Cloud	malware
http://mbarieservicesltd.com	0%	Avira URL Cloud	safe
http://mbarieservicesltd.com	1%	Virustotal		Browse
http://mail.mbarieservicesltd.com	5%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mbarieservicesltd.com	199.79.62.115	true	true	1%, Virustotal, Browse	unknown
mail.mbarieservicesltd.com	unknown	unknown	true	5%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.8.dr	false		high
http://mbarieservicesltd.com	20240328-REV2.exe, 00000005.00000002.2747010558.000000000299A000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	20240328-REV2.exe, 00000001.00000002.1581428931.000000000280D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mail.mbarieservicesltd.com	20240328-REV2.exe, 00000005.00000002.2747010558.000000000299A000.00000004.00000800.00020000.00000000.sdmp	false	5%, Virustotal, Browse Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
199.79.62.115	mbarieservicesltd.com	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432024
Start date and time:	2024-04-26 10:05:18 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	20240328-REV2.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/11@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 149 Number of non-executed functions: 27
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:06:25	API Interceptor	22x Sleep call for process: 20240328-REV2.exe modified
10:06:27	API Interceptor	15x Sleep call for process: powershell.exe modified
10:06:33	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
199.79.62.115	PO82100088.exe	Get hash	malicious	AgentTesla	Browse
	WNGO8CYRZG.exe	Get hash	malicious	AgentTesla	Browse
	F0A7vyQAuZ.exe	Get hash	malicious	AgentTesla	Browse
	quote N4302-088.exe	Get hash	malicious	AgentTesla	Browse
	Quote#U00a0UPDATE#U00a0#U00a027-03-24.exe	Get hash	malicious	AgentTesla	Browse
	Quote_Q9555.exe	Get hash	malicious	AgentTesla	Browse
	Quote#U00a0UPDATE#U00a0#U00a027-03-24.exe	Get hash	malicious	AgentTesla	Browse
	124431-OFFER.exe	Get hash	malicious	AgentTesla	Browse
	Quote_90002010.exe	Get hash	malicious	AgentTesla	Browse
	PO234400.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	Payment.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	SecuriteInfo.com.Win32.PWSX-gen.29608.5434.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.91.199.224
	Dhl Express Shipping Docs .pdf.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	BARSYL SHIPPING Co (VIETNAM).exe	Get hash	malicious	AgentTesla	Browse	207.174.215.249
	PR2403016.scr.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	BARSYL SHIPPING Co (VIETNAM).exe	Get hash	malicious	AgentTesla	Browse	207.174.215.249
	OKJ2402PRT000025.PDF.scr.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	PO82100088.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	BARSYL SHIPPING Co (VIETNAM).exe	Get hash	malicious	AgentTesla	Browse	162.215.248.214
	Urgent PO 18-3081 Confirmation.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_20240328-REV2.ex_d0d499a9646a641b819fa0255edad0bdab418090_3cf00dc3_f546981a-4c8e-4734-9074-23d81c861b04\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2832140247113648
Encrypted:	false
SSDEEP:	192:mxghY+0BU/iaGOJo1ZrFHqozuiFPZ24IO8r:kghCBU/iahMrzuiFPY4IO8r
MD5:	A2010789470B29C8154CF3AC293574EA
SHA1:	EEEDE969E6723B572B6A019824C49DE8126FCE05
SHA-256:	2BE9EC8A56CFF7508FBBE2822C156BF4A098FE579FC3C89D01B972DED9CD8D3D
SHA-512:	B99F697F18099C1E37915FBEB7143A208EFB062877E171AD31BBDB0F2E3AD9BE7246B64FC156F2EA3DB924E9A9B49E1E8373027599A837EA1CFBBAF01FE42E3D
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.5.9.2.3.8.7.6.0.2.0.1.9.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.5.9.2.3.8.8.7.1.1.3.8.5.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.5.4.6.9.8.1.a.-.4.c.8.e.-.4.7.3.4.-.9.0.7.4.-.2.3.d.8.1.c.8.6.1.b.0.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.1.1.b.6.7.9.a.-.5.0.1.b.-.4.8.5.4.-.8.f.0.d.-.b.c.6.7.d.9.1.4.b.0.7.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.2.0.2.4.0.3.2.8.-.R.E.V.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.X.Z.W...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.b.8.-.0.0.0.1.-.0.0.1.4.-.c.c.3.0.-.2.c.a.2.b.0.9.7.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.5.1.e.f.b.7.d.8.8.b.b.f.d.1.3.c.c.9.b.4.2.c.3.0.0.e.f.a.6.d.d.0.0.0.0.0.0.0.0.!.0.0.0.0.a.4.2.e.b.4.e.6.0.8.4.a.c.9.1.d.1.f.a.d.3.e.f.9.f.e.0.1.d.8.d.3.e.9.d.b.0.c.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5DE2.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Apr 26 08:06:28 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	356231
Entropy (8bit):	4.107414333063161
Encrypted:	false
SSDEEP:	3072:YNfHlYbLpmmEut8Iyf394uEqlg5J5LTgTLjphMCXAMbr:YhlYbwmbt8IyfN4IATgYCXAMb
MD5:	3A7EFCE410CFDC6C67C168409BA2CCC1
SHA1:	6DF2F2BADBE1B619E7E7E681E36A674CBD33C60E
SHA-256:	1FB7F4E52C4B05BF4FE53BCB2AD12990E806699E7DAC1E15F19C6CDC44189F4E
SHA-512:	39CFD46A87EAACB4B9305550C48959F90B99E52BE101F557D11699919C2356C0F398D436C712CC60E716BD685ECD3C2F61173F8FBBBED06452DD751D692522F6
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........`+f........................t#..........$...\-.......0...g..........`.......8...........T............C...+...........-..........l/..............................................................................eJ.......0......GenuineIntel............T............`+f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER60A2.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8418
Entropy (8bit):	3.6965566573319495
Encrypted:	false
SSDEEP:	192:R6l7wVeJIK6oh6YSGYSU9dMgmfZpXprjx89bSV7wsf0Amm:R6lXJV6oh6YrYSU9WgmfXYS9fZ
MD5:	722DDA7C42AD8A8EA0683C1DA0C67D34
SHA1:	28AFCFE6672EFCC3C37A8F2D80825390846DBB75
SHA-256:	17550E7BF9514888D6A7307E9F2DFF43B34C13954297CA87D9EFA333A599F9E8
SHA-512:	B9E09F1596F77F97ABFC72C1F35A3C7A37AB116BCEE5B1C4DD9B1184E7D43816B3F8F4E6F9B63DF3618A422D70FD36F6D2068E8101E720C97BADFED681C8CB04
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.8.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6101.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4751
Entropy (8bit):	4.474658268377554
Encrypted:	false
SSDEEP:	48:cvIwWl8zstJg77aI97AWpW8VYXhYm8M4JjhFkNo+q8vaaNxq/qd:uIjfHI7t57VWAJ8NoK7O/qd
MD5:	2F27562D056D295F3AA59E71D231EC8A
SHA1:	135D6886222A921A75A7DBB9465785EAA700DAC2
SHA-256:	D4F1E4B0B11472449382DB1A2D439543E6E1D5B5ED939AA72CA5A6CA7FB1CBFD
SHA-512:	7588681EA7341EC8A70CFF4BC1DA63449D768135D669618798B67872E089E109328EA68E9B7C862E13B30CABE6E0E0F962ACB21A6E8B6BE71C79CE76B1155300
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="296589" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\20240328-REV2.exe.log

Download File

Process:	C:\Users\user\Desktop\20240328-REV2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379401388151058
Encrypted:	false
SSDEEP:	48:fWSU4xc4RTmaoUeW+gZ9tK8NPZHUxL7u1iMuge//8PUyus:fLHxcIalLgZ2KRHWLOug8s
MD5:	6EFC00BBF21EB6D04A4F584932EE52E2
SHA1:	5046755E9D3154F66AAAE20B582B02A5A6ED51E5
SHA-256:	49923B1A86502BE5C3F109E07820A7AA03914E0263D247368792232A4A8E9F66
SHA-512:	8EA293396D7124BBD83E092D5320F5CFD2D7C0E2B2C70B2C1B3A4C202CC38D8466C6E71B7B10FE210D29DE5719AB17A04C0F2AD194688F6F1F60BE9FE50523FA
Malicious:	false
Reputation:	low
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.ConfigurationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.4.................%...K... ...........System.Xml..<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e22pavwa.f3a.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tckzrrwj.5ng.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yakagxcv.e30.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zv2kgg4g.glx.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.372256882851346
Encrypted:	false
SSDEEP:	6144:/FVfpi6ceLP/9skLmb02yWWSPtaJG8nAge35OlMMhA2AX4WABlguNwiL:tV1UyWWI/glMM6kF7Wq
MD5:	9827F7439DF466540DD61B68F581F17A
SHA1:	1308B1F3C3357D497D72DAA5C31FE4A364A7526E
SHA-256:	0E55C6859E65ADA4B4A076E0200E64BE48B50640595D0F242DBB98B478D9B1E8
SHA-512:	368FE00A9A9CFE9A0EF2BB7239C2CCAFD22E2F0A4B7AFA50C9404C670C0EEDDB1F615048B64311B2DA7B34715FDAEFB6BEF2DF76F3E7E8F16F2A0ED420081CD4
Malicious:	false
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmN.x.................................................................................................................................................................................................................................................................................................................................................X2n.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.939616453505201
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	20240328-REV2.exe
File size:	634'368 bytes
MD5:	ed1e2fd68e9de44ea4e01c7897f64411
SHA1:	a42eb4e6084ac91d1fad3ef9fe01d8d3e9db0c26
SHA256:	37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134
SHA512:	6bef9338609c2d307ace1620d8e8c8a7d2888448b04a259dbd54937aa92255f8805c696558177303e95ebcf74d041d995b392e6084a92f80789d7422d02f7bf1
SSDEEP:	12288:gYIPXjyEcoqe8OKZDOZqB8tMX4tVOiaatVSSDc1ow1rxEdex:gYIPuEtq/KoDX4XaaaSo1DUd
TLSH:	1BD412425EB92BA3D9BD9BF95031A50403F0AF567623E74C2FD160E72A61BC88741E73
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e{W...............0.............:.... ........@.. ....................... ............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x49c33a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x81577B65 [Wed Oct 6 16:08:05 2038 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
xor eax, 35455354h
xor dword ptr [edi+eax*2], esi
dec eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx+4Ah], dl
push ebx
cmp byte ptr [eax+edi+34h], al
inc ebx
inc ebx
xor al, 37h
xor eax, 00000035h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9c2e6	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9e000	0x57c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9a504	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x9a360	0x9a400	37ff9b0485b6f7646a52456ff84b91ef	False	0.9468398627431118	data	7.946644747446866	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x9e000	0x57c	0x600	8fa9b427f921272c1d0ab0e00b6a7e9e	False	0.4140625	data	4.0198470762349565	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa0000	0xc	0x200	9da1352c6b37388f351c4c4e2e89eacc	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x9e090	0x2ec	data			0.4411764705882353
RT_MANIFEST	0x9e38c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/26/24-10:06:31.436750	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49711	587	192.168.2.8	199.79.62.115
04/26/24-10:06:31.436750	TCP	2839723	ETPRO TROJAN Win32/Agent Tesla SMTP Activity	49711	587	192.168.2.8	199.79.62.115
04/26/24-10:06:31.436814	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	49711	587	192.168.2.8	199.79.62.115
04/26/24-10:06:31.436814	TCP	2855245	ETPRO TROJAN Agent Tesla Exfil via SMTP	49711	587	192.168.2.8	199.79.62.115
04/26/24-10:06:31.436814	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49711	587	192.168.2.8	199.79.62.115
04/26/24-10:06:31.436814	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49711	587	192.168.2.8	199.79.62.115

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 10:06:29.658147097 CEST	49711	587	192.168.2.8	199.79.62.115
Apr 26, 2024 10:06:29.854377031 CEST	587	49711	199.79.62.115	192.168.2.8
Apr 26, 2024 10:06:29.854453087 CEST	49711	587	192.168.2.8	199.79.62.115
Apr 26, 2024 10:06:30.143410921 CEST	587	49711	199.79.62.115	192.168.2.8
Apr 26, 2024 10:06:30.144125938 CEST	49711	587	192.168.2.8	199.79.62.115
Apr 26, 2024 10:06:30.340574026 CEST	587	49711	199.79.62.115	192.168.2.8
Apr 26, 2024 10:06:30.341639042 CEST	49711	587	192.168.2.8	199.79.62.115
Apr 26, 2024 10:06:30.538235903 CEST	587	49711	199.79.62.115	192.168.2.8
Apr 26, 2024 10:06:30.539256096 CEST	49711	587	192.168.2.8	199.79.62.115
Apr 26, 2024 10:06:30.775567055 CEST	587	49711	199.79.62.115	192.168.2.8
Apr 26, 2024 10:06:30.833426952 CEST	587	49711	199.79.62.115	192.168.2.8
Apr 26, 2024 10:06:30.833636999 CEST	49711	587	192.168.2.8	199.79.62.115
Apr 26, 2024 10:06:31.029897928 CEST	587	49711	199.79.62.115	192.168.2.8
Apr 26, 2024 10:06:31.030000925 CEST	587	49711	199.79.62.115	192.168.2.8
Apr 26, 2024 10:06:31.030154943 CEST	49711	587	192.168.2.8	199.79.62.115
Apr 26, 2024 10:06:31.239109039 CEST	587	49711	199.79.62.115	192.168.2.8
Apr 26, 2024 10:06:31.239260912 CEST	49711	587	192.168.2.8	199.79.62.115
Apr 26, 2024 10:06:31.435554028 CEST	587	49711	199.79.62.115	192.168.2.8
Apr 26, 2024 10:06:31.435638905 CEST	587	49711	199.79.62.115	192.168.2.8
Apr 26, 2024 10:06:31.436749935 CEST	49711	587	192.168.2.8	199.79.62.115
Apr 26, 2024 10:06:31.436814070 CEST	49711	587	192.168.2.8	199.79.62.115
Apr 26, 2024 10:06:31.436851025 CEST	49711	587	192.168.2.8	199.79.62.115
Apr 26, 2024 10:06:31.436882973 CEST	49711	587	192.168.2.8	199.79.62.115
Apr 26, 2024 10:06:31.633367062 CEST	587	49711	199.79.62.115	192.168.2.8
Apr 26, 2024 10:06:31.633380890 CEST	587	49711	199.79.62.115	192.168.2.8
Apr 26, 2024 10:06:31.634105921 CEST	587	49711	199.79.62.115	192.168.2.8
Apr 26, 2024 10:06:31.685513973 CEST	49711	587	192.168.2.8	199.79.62.115
Apr 26, 2024 10:08:09.311119080 CEST	49711	587	192.168.2.8	199.79.62.115
Apr 26, 2024 10:08:09.548603058 CEST	587	49711	199.79.62.115	192.168.2.8
Apr 26, 2024 10:08:09.709059954 CEST	587	49711	199.79.62.115	192.168.2.8
Apr 26, 2024 10:08:09.709230900 CEST	49711	587	192.168.2.8	199.79.62.115
Apr 26, 2024 10:08:09.709325075 CEST	49711	587	192.168.2.8	199.79.62.115
Apr 26, 2024 10:08:09.906341076 CEST	587	49711	199.79.62.115	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 10:06:29.299489975 CEST	60173	53	192.168.2.8	1.1.1.1
Apr 26, 2024 10:06:29.646856070 CEST	53	60173	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 10:06:29.299489975 CEST	192.168.2.8	1.1.1.1	0xb564	Standard query (0)	mail.mbarieservicesltd.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 10:06:29.646856070 CEST	1.1.1.1	192.168.2.8	0xb564	No error (0)	mail.mbarieservicesltd.com	mbarieservicesltd.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 10:06:29.646856070 CEST	1.1.1.1	192.168.2.8	0xb564	No error (0)	mbarieservicesltd.com		199.79.62.115	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 26, 2024 10:06:30.143410921 CEST	587	49711	199.79.62.115	192.168.2.8	220-md-54.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 13:36:30 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:06:30.144125938 CEST	49711	587	192.168.2.8	199.79.62.115	EHLO 651689
Apr 26, 2024 10:06:30.340574026 CEST	587	49711	199.79.62.115	192.168.2.8	250-md-54.webhostbox.net Hello 651689 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:06:30.341639042 CEST	49711	587	192.168.2.8	199.79.62.115	AUTH login c2FsZXNzQG1iYXJpZXNlcnZpY2VzbHRkLmNvbQ==
Apr 26, 2024 10:06:30.538235903 CEST	587	49711	199.79.62.115	192.168.2.8	334 UGFzc3dvcmQ6
Apr 26, 2024 10:06:30.833426952 CEST	587	49711	199.79.62.115	192.168.2.8	235 Authentication succeeded
Apr 26, 2024 10:06:30.833636999 CEST	49711	587	192.168.2.8	199.79.62.115	MAIL FROM:<saless@mbarieservicesltd.com>
Apr 26, 2024 10:06:31.030000925 CEST	587	49711	199.79.62.115	192.168.2.8	250 OK
Apr 26, 2024 10:06:31.030154943 CEST	49711	587	192.168.2.8	199.79.62.115	RCPT TO:<iinfo@mbarieservicesltd.com>
Apr 26, 2024 10:06:31.239109039 CEST	587	49711	199.79.62.115	192.168.2.8	250 Accepted
Apr 26, 2024 10:06:31.239260912 CEST	49711	587	192.168.2.8	199.79.62.115	DATA
Apr 26, 2024 10:06:31.435638905 CEST	587	49711	199.79.62.115	192.168.2.8	354 Enter message, ending with "." on a line by itself
Apr 26, 2024 10:06:31.436882973 CEST	49711	587	192.168.2.8	199.79.62.115	.
Apr 26, 2024 10:06:31.634105921 CEST	587	49711	199.79.62.115	192.168.2.8	250 OK id=1s0GbH-004EjF-15
Apr 26, 2024 10:08:09.311119080 CEST	49711	587	192.168.2.8	199.79.62.115	QUIT
Apr 26, 2024 10:08:09.709059954 CEST	587	49711	199.79.62.115	192.168.2.8	221 md-54.webhostbox.net closing connection

Target ID:	1
Start time:	10:06:25
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\20240328-REV2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\20240328-REV2.exe"
Imagebase:	0x310000
File size:	634'368 bytes
MD5 hash:	ED1E2FD68E9DE44EA4E01C7897F64411
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000002.1585065911.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000002.1582368712.0000000003799000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000001.00000002.1582368712.0000000004187000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:06:26
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\20240328-REV2.exe"
Imagebase:	0x10000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:06:26
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:06:26
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\20240328-REV2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\20240328-REV2.exe"
Imagebase:	0x480000
File size:	634'368 bytes
MD5 hash:	ED1E2FD68E9DE44EA4E01C7897F64411
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000005.00000002.2743308776.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.2747010558.000000000299A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2747010558.0000000002941000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.2747010558.0000000002941000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	10:06:27
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6840 -s 1796
Imagebase:	0xee0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:06:29
Start date:	26/04/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff605670000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.5%
Total number of Nodes:	197
Total number of Limit Nodes:	19

Executed Functions

Function 0895A688 Relevance: 2.3, Strings: 1, Instructions: 1042
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&IH3, xrefs: 0895AA80

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID: &IH3
API String ID: 0-1546010026
Opcode ID: d16f7d7e1d4b9c9045519bf08de7307ea3f07c9449e197dc9ecf28b621b83895
Instruction ID: 6b6d120619938bc8c510175d9a9e3d28685ecc3ac3d1700a19716af27e2be75e
Opcode Fuzzy Hash: d16f7d7e1d4b9c9045519bf08de7307ea3f07c9449e197dc9ecf28b621b83895
Instruction Fuzzy Hash: 57B2C275E00228CFDB64DF69C984AD9BBB2FF89305F1581E9D509AB225DB319E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 070BA138 Relevance: 1.9, APIs: 1, Instructions: 377
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 070BA58F

Memory Dump Source

Source File: 00000001.00000002.1586059222.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70b0000_20240328-REV2.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: b7c469665d98b79f6b52cedd3cfe7be0e307ca79de7717ac05dd6ed98d2f2622
Instruction ID: 1873dfaf7c618cc4ea5ec0fa962488d0fac7c4b59f42d5058d51178d07e7792b
Opcode Fuzzy Hash: b7c469665d98b79f6b52cedd3cfe7be0e307ca79de7717ac05dd6ed98d2f2622
Instruction Fuzzy Hash: 21D19AF1B007058FDBA5EB75C450BAEB7F6AF89700F10856DD24A9B290DB35EA01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06EA9BC0 Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

tIh, xrefs: 06EA9F75

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID: tIh
API String ID: 0-443931868
Opcode ID: c75b4ed9251025c279c6177c6db3b5fd4864dcfc2bf9ed80377e19b17210893a
Instruction ID: 005339484071efa8a06cd73a5a10e59472cf680b6db983a5cddcdfe51ec51813
Opcode Fuzzy Hash: c75b4ed9251025c279c6177c6db3b5fd4864dcfc2bf9ed80377e19b17210893a
Instruction Fuzzy Hash: 0AD11270E2471ADFDB44CFA9C5818AEFBB6FB88300F10A559D416AB215D734AA42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 06EA7A20 Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

)", xrefs: 06EA7ACA

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID: )"
API String ID: 0-4237191880
Opcode ID: 93d7232bbbebb3c9aae57c32a008238c869988bd3dbe0b4423ffcb711e35db88
Instruction ID: b3c187627ee03f0706cfa633fcbb435965b1d792e555af774667b61f8ebbf3f7
Opcode Fuzzy Hash: 93d7232bbbebb3c9aae57c32a008238c869988bd3dbe0b4423ffcb711e35db88
Instruction Fuzzy Hash: 5881C174E002099FDB48CFEAC984AEEBBB2FF88310F24942AD415AB254D774A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 089539C0 Relevance: 1.0, Instructions: 969COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eca868270da5558a3811e79a242512c50c8445afbed7909ad68a04fb76e1708
Instruction ID: 604172825300afc21d93914cd60c05a51cb99d24d27edff4a9c5542682d7a12c
Opcode Fuzzy Hash: 7eca868270da5558a3811e79a242512c50c8445afbed7909ad68a04fb76e1708
Instruction Fuzzy Hash: 5872D030B002158FDB58EB78C858B6E77A6AFC9751F248569D80ADB3A0CF34DD06D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 08956CD8 Relevance: .8, Instructions: 805COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca7b84f1ae91ecf3e37b83013d38515b7a9038bfc8b05f0f33137d8742f8b906
Instruction ID: 815f4b524fb318d432e6dc6f5a4566d44ba35008e96a06013631bb994ff3f2ca
Opcode Fuzzy Hash: ca7b84f1ae91ecf3e37b83013d38515b7a9038bfc8b05f0f33137d8742f8b906
Instruction Fuzzy Hash: C9721E34A00219CFDB15EF68C844AADF7F1BF89311F1586A9D859AB351DB30AD85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0534C550 Relevance: .7, Instructions: 668COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1584604125.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5340000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bb63d3d3a28e381bce96f18bc073c4ecf13f3a2122a19be4052e699df74c75f
Instruction ID: a52efd88fe99b783defccaf987dbe08c4ddb359674d09b161e30562b71659cc5
Opcode Fuzzy Hash: 2bb63d3d3a28e381bce96f18bc073c4ecf13f3a2122a19be4052e699df74c75f
Instruction Fuzzy Hash: 87521134A012088FDB14DF68C588A6DB7F2BF89715F2595A8E80A9B361CB74FD46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04D31808 Relevance: .6, Instructions: 588COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1584098888.0000000004D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4d30000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ec4e8c50f76ae46a880fe6b82ea895f72df581c917571cc8263c8ddc096a296
Instruction ID: 8ef60efe8e80fdbe209285f20f7a904bdcc48a3ac4ff9511547b6070d361649e
Opcode Fuzzy Hash: 1ec4e8c50f76ae46a880fe6b82ea895f72df581c917571cc8263c8ddc096a296
Instruction Fuzzy Hash: B9525E34A003568FDB14DF28C844B99B7B2FFC9314F2582A9D5596F3A2DB71A982CF41

Uniqueness

Uniqueness Score: -1.00%

Function 04D317F8 Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1584098888.0000000004D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4d30000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff4f0b164f684ad7cf6a1cbdcbf8746fba73cf06e7e33f99cbf8bb36917107e5
Instruction ID: 61a89bc34078b6c7467165614672b3484194bf1ac77714430f8bd6c38c886581
Opcode Fuzzy Hash: ff4f0b164f684ad7cf6a1cbdcbf8746fba73cf06e7e33f99cbf8bb36917107e5
Instruction Fuzzy Hash: 9E526E34A003568FDB14DF28C844B99B7B2FFC5314F2582A9D5596F3A2DB71A982CF81

Uniqueness

Uniqueness Score: -1.00%

Function 06EACC18 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb73bd0c44af3a4585f2ee4d2ff3f9683d43b90d41be90bae6083f87a1fbc1d5
Instruction ID: 0c49bf917cffb78fdb5cff1abf623736c4e7b5c9ce2a53bc372fecf618e75884
Opcode Fuzzy Hash: fb73bd0c44af3a4585f2ee4d2ff3f9683d43b90d41be90bae6083f87a1fbc1d5
Instruction Fuzzy Hash: 40910370E16308DFDB48CFA9D5809DDBBB2FB89700F20A42AE416BB264D734A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 06EAC900 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cce6b1f289e4b55a2495ba95f9ed6d6a0d17b96dc2540a21be0748370646fc57
Instruction ID: 7b86f82aef1d5edaf18d3c84859a49fbb15fc9698cbb1cc6451090a538ec3dea
Opcode Fuzzy Hash: cce6b1f289e4b55a2495ba95f9ed6d6a0d17b96dc2540a21be0748370646fc57
Instruction Fuzzy Hash: 72810674E05219DFDB44CFA9C9809EEFBB1FB88300F20A55AD415BB254D734A916CF94

Uniqueness

Uniqueness Score: -1.00%

Function 06EA8D10 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04e26a5055a105f3fdb7f89a6a0710f70f215493fc46eb4b0cbfbc65d0b20969
Instruction ID: 066ffcb26d0266b00a35b909a0b29e5afda7f32e6882cdc607c4acd843a46893
Opcode Fuzzy Hash: 04e26a5055a105f3fdb7f89a6a0710f70f215493fc46eb4b0cbfbc65d0b20969
Instruction Fuzzy Hash: 2A21E9B1E006188BEB58CFABD8402DEFBF7AFC8310F14C06AD509AA258DB701A45CE50

Uniqueness

Uniqueness Score: -1.00%

Function 08959CB8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d42e9b92f9e63dc1e54eb34416e21855ee526883348148d44d9f2c361a9fa74
Instruction ID: 860f4d6e1fcb191d3826538940804310e9a1bafcfe42a6481b0f8f46e4f55f52
Opcode Fuzzy Hash: 1d42e9b92f9e63dc1e54eb34416e21855ee526883348148d44d9f2c361a9fa74
Instruction Fuzzy Hash: 38215EB1E052548BE718DFABD90439EBBF7AFC9301F04C07AD809AB258EB3008068F41

Uniqueness

Uniqueness Score: -1.00%

Function 08959CC8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1583882e0f406454b49484da0e45ecfa031e5abfbbf1f766321cf4b1fcda403b
Instruction ID: 7f3899d09a3efb7144a293fed9894d70104880009adff1d0bb0f1d8e7dcdf102
Opcode Fuzzy Hash: 1583882e0f406454b49484da0e45ecfa031e5abfbbf1f766321cf4b1fcda403b
Instruction Fuzzy Hash: 8611EF71E056588BE71CDFABD90439EBBF7AFC9300F04C17AD8196A258DB7409458F50

Uniqueness

Uniqueness Score: -1.00%

Function 025FDF58 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 025FDFDE
GetCurrentThread.KERNEL32 ref: 025FE01B
GetCurrentProcess.KERNEL32 ref: 025FE058
GetCurrentThreadId.KERNEL32 ref: 025FE0B1

Memory Dump Source

Source File: 00000001.00000002.1581028936.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25f0000_20240328-REV2.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 3a62a5ede29a9bb65ffa62d744cd9a5e5c993742e894de5b2595fc3ea0afc80c
Instruction ID: 38dc9e80abaac863fc0d64d08351d7dc09d5681329cd8925febc9b7fee3850c4
Opcode Fuzzy Hash: 3a62a5ede29a9bb65ffa62d744cd9a5e5c993742e894de5b2595fc3ea0afc80c
Instruction Fuzzy Hash: 105174B090134ACFDB14DFAAD648BAEBBF1BF88314F208459E508A73A0CB355944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 025FDF60 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 025FDFDE
GetCurrentThread.KERNEL32 ref: 025FE01B
GetCurrentProcess.KERNEL32 ref: 025FE058
GetCurrentThreadId.KERNEL32 ref: 025FE0B1

Memory Dump Source

Source File: 00000001.00000002.1581028936.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25f0000_20240328-REV2.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: af6f273884a1641e56ac33ae65b4dc228d06e1f828e6e3007fed274731e2ffbc
Instruction ID: f3ed9c1cc4cbfd831bddedee7fa3e714edc6ea907355cbf4dce90d28ac8d43b7
Opcode Fuzzy Hash: af6f273884a1641e56ac33ae65b4dc228d06e1f828e6e3007fed274731e2ffbc
Instruction Fuzzy Hash: 155164B090134ACFDB14DFAAC548BAEBBF1BF88314F208559E508A73A0CB346944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 06EAA200 Relevance: 2.6, Strings: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3H5, xrefs: 06EAA29E
3H5, xrefs: 06EAA290

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID: 3H5$3H5
API String ID: 0-2752242361
Opcode ID: 6f40a506ade08c6db476d465013589233f079393d8e4b82e1b597b04e628a5a2
Instruction ID: e073ddbda686853e206c62b6442aa76c6c84b203f0a4cefa7f6fd6e25b591a10
Opcode Fuzzy Hash: 6f40a506ade08c6db476d465013589233f079393d8e4b82e1b597b04e628a5a2
Instruction Fuzzy Hash: 4F2139B0D00309DFDB44CFAAC540AAEFBF1FF89300F10D56A9508AB214E731AA55CB91

Uniqueness

Uniqueness Score: -1.00%

Function 070B5E40 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 070B6076

Memory Dump Source

Source File: 00000001.00000002.1586059222.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70b0000_20240328-REV2.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 8c8b048df1c42ee90d3413e529c57f5a20d4b920d436048fa58de53c49228948
Instruction ID: 78a9a1fb0c0458dd34f77df1ff7aeb9ff2d4ab9e75c9fdbfdd8f85aaba7b3cc4
Opcode Fuzzy Hash: 8c8b048df1c42ee90d3413e529c57f5a20d4b920d436048fa58de53c49228948
Instruction Fuzzy Hash: E2914AB1D0031ADFDB20CF69CC417DEBBF2AB48310F0486A9D809A7290DB759A95CF91

Uniqueness

Uniqueness Score: -1.00%

Function 025FBCB8 Relevance: 1.7, APIs: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 025FBF1E

Memory Dump Source

Source File: 00000001.00000002.1581028936.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25f0000_20240328-REV2.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 81b9de475cf9f1246dd62bf0d12380c81109ada84af5cfa8192679bea9b4b27b
Instruction ID: 2706f4b5aea72f340e11bde89701e7514166ac9680de3a49017dae3bcc880e79
Opcode Fuzzy Hash: 81b9de475cf9f1246dd62bf0d12380c81109ada84af5cfa8192679bea9b4b27b
Instruction Fuzzy Hash: 718123B0A00B05CFDB64DF29D44475ABBF1BF88308F008A2ED586DBA50DB75E946CB95

Uniqueness

Uniqueness Score: -1.00%

Function 070B56AF Relevance: 1.7, APIs: 1, Instructions: 159
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 070B5666

Memory Dump Source

Source File: 00000001.00000002.1586059222.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70b0000_20240328-REV2.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 323824b51faa2fc7d5972354d68ec63ddd58ba8189e493db350639126ea7cf15
Instruction ID: 2c2cfc41f09659f0bc830c2a47e76e80bd616c9d9f798f179a67a8e4bd8fc14d
Opcode Fuzzy Hash: 323824b51faa2fc7d5972354d68ec63ddd58ba8189e493db350639126ea7cf15
Instruction Fuzzy Hash: 2C613DB1E002198BDB14DFA9C9406EEFBF6EF89311F24C1A9D418AB355D7349A42CF61

Uniqueness

Uniqueness Score: -1.00%

Function 025F5D0D Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 025F5DC9

Memory Dump Source

Source File: 00000001.00000002.1581028936.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25f0000_20240328-REV2.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3dd380ae699f6b7d17d20a84e58deba9a555238e9ebad720df12a4f04a6fee2a
Instruction ID: 5f9120ba669c1f2897ef62c37c50f22c88df257b07a9fee07c403798d6403dcb
Opcode Fuzzy Hash: 3dd380ae699f6b7d17d20a84e58deba9a555238e9ebad720df12a4f04a6fee2a
Instruction Fuzzy Hash: F241F1B1C01719CFEB24DFA9C8847DEBBB5BF88704F60816AD508AB251EB715946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 025F4538 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 025F5DC9

Memory Dump Source

Source File: 00000001.00000002.1581028936.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25f0000_20240328-REV2.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3f78d706c91ceba9ad71e72df1088e42ee226551bbe94b08f30008d334957f62
Instruction ID: 1384c4fa8a3f2d30e974ec23f0121eeb9cf08bf07a924674bfe549d0baf6d2eb
Opcode Fuzzy Hash: 3f78d706c91ceba9ad71e72df1088e42ee226551bbe94b08f30008d334957f62
Instruction Fuzzy Hash: 5341C1B1D00719CFEB24DFA9C884B8EBBB5BF88704F60816AD508AB251EB755945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05349ED8 Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 05349F77

Memory Dump Source

Source File: 00000001.00000002.1584604125.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5340000_20240328-REV2.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 35ed89a2e35d7b784d02f4e7093a0f3ec2b7421afaa65b25decec59bac0db202
Instruction ID: 9c0a2131d478d7a966ea58046e4352c0d6ca7ac99845c5fa441e928c202906d2
Opcode Fuzzy Hash: 35ed89a2e35d7b784d02f4e7093a0f3ec2b7421afaa65b25decec59bac0db202
Instruction Fuzzy Hash: 4731EEB6D003099FDB10CF9AD880ADEFBF4FB58320F14842AE919A7210D775A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 05349EE0 Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 05349F77

Memory Dump Source

Source File: 00000001.00000002.1584604125.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5340000_20240328-REV2.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: fd71b8bfa0a261e7134d61105c382846133c8a6425b2d4caf3ce8b2613e50746
Instruction ID: dcf060320e1b73b93fac9bdeeb96574b1c6a6ac2d4ef312f674bc52572520bef
Opcode Fuzzy Hash: fd71b8bfa0a261e7134d61105c382846133c8a6425b2d4caf3ce8b2613e50746
Instruction Fuzzy Hash: DE21CEB69003099FDB10CF9AD884A9EFBF5BB58320F14842AE919A7210D774A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 070B5BB8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 070B5C48

Memory Dump Source

Source File: 00000001.00000002.1586059222.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70b0000_20240328-REV2.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: bcd4bfe0d54bf089c855a58aea83af6fb38735dfd2581caf14924d2458f55812
Instruction ID: ab70f5a037d398b3b51aba12d7cad67587ae5b1f3abd6a617eba53fa6827aff1
Opcode Fuzzy Hash: bcd4bfe0d54bf089c855a58aea83af6fb38735dfd2581caf14924d2458f55812
Instruction Fuzzy Hash: 1F2125B190030A9FDB10DFAAC885BDEBBF5FF48310F10842AE918A7240D7799955DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 025FE1A0 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 025FE22F

Memory Dump Source

Source File: 00000001.00000002.1581028936.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25f0000_20240328-REV2.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 068eb5b44c03041d340123373b999b6af7f780a07e04071d004d75355094aada
Instruction ID: e4c35651ed81192779c7f8d2f8a12f3c66e771f877eca89fd674f24dd9e2a137
Opcode Fuzzy Hash: 068eb5b44c03041d340123373b999b6af7f780a07e04071d004d75355094aada
Instruction Fuzzy Hash: 8021F4B59002089FDB10CF9AD585ADEBBF5FB48310F14805AE914A7310D374A941CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 070B5CA0 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 070B5D28

Memory Dump Source

Source File: 00000001.00000002.1586059222.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70b0000_20240328-REV2.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 2fe287126e5801a15f1a3c222fb9008338b2dd8d6f48b7ee6c480bc8d2177c40
Instruction ID: ae6979eb15a247caea3029bad61f9da83f5c70634ff670bef521d81a70c58380
Opcode Fuzzy Hash: 2fe287126e5801a15f1a3c222fb9008338b2dd8d6f48b7ee6c480bc8d2177c40
Instruction Fuzzy Hash: 1D2127B18003499FDB10DFAAC844BDEBBF5FF48310F50852DE558A3240C7799510DB64

Uniqueness

Uniqueness Score: -1.00%

Function 070B55E8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 070B5666

Memory Dump Source

Source File: 00000001.00000002.1586059222.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70b0000_20240328-REV2.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c8f747269ad61bdca09212b399d4c66760619987182b1a5b046d48d3a657ebce
Instruction ID: c79821adb665e05fa391ba28371380d33e0ff948f11066a5330b9522ab32ef46
Opcode Fuzzy Hash: c8f747269ad61bdca09212b399d4c66760619987182b1a5b046d48d3a657ebce
Instruction Fuzzy Hash: 0F2129B1D003098FDB10DFAAC8857EEBBF4EF88614F14842DD559A7240DB789A45CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 070B55E0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 070B5666

Memory Dump Source

Source File: 00000001.00000002.1586059222.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70b0000_20240328-REV2.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 2144c5e48edd355dfe5d8b99c948d726c5f222a523b963d5bb3eeb94669de2cb
Instruction ID: 89649eeb6bd34ffe1589b314098108ab419a1a96a11d5e631cb23d0cbef7b634
Opcode Fuzzy Hash: 2144c5e48edd355dfe5d8b99c948d726c5f222a523b963d5bb3eeb94669de2cb
Instruction Fuzzy Hash: 53213AB190030A9FDB10DFAAC8847EEBBF4AF88324F14852DD559A7240C7789A45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 070B5CA8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 070B5D28

Memory Dump Source

Source File: 00000001.00000002.1586059222.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70b0000_20240328-REV2.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 64ffb41278919a3b8ed7f1b6f6c95ab96746e748bdee848f298f820bf0cebe3e
Instruction ID: 2565aa7313e8e1f3f22c583faf924d9781fd4a242bfa585ac1dc021eed3c8a5d
Opcode Fuzzy Hash: 64ffb41278919a3b8ed7f1b6f6c95ab96746e748bdee848f298f820bf0cebe3e
Instruction Fuzzy Hash: 6A2116B18003499FDB10DFAAC884BDEBBF5FF48310F508529E518A7240C7799510DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 025FE1A8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 025FE22F

Memory Dump Source

Source File: 00000001.00000002.1581028936.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25f0000_20240328-REV2.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 52c970d24a0c3cd698c7420772a70feb66d8e6210c4516896386b7c28464acf8
Instruction ID: 26a116f011fa56b3bf58a3d5881dc4d23b853c3235b541672398036a2d01de0e
Opcode Fuzzy Hash: 52c970d24a0c3cd698c7420772a70feb66d8e6210c4516896386b7c28464acf8
Instruction Fuzzy Hash: 8821C4B59003499FDB10CFAAD984ADEFBF9FB48310F14841AE954A3350D374A954CF65

Uniqueness

Uniqueness Score: -1.00%

Function 070B5AF0 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 070B5B66

Memory Dump Source

Source File: 00000001.00000002.1586059222.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70b0000_20240328-REV2.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2e7b500dd08226b12103c46d981c03b9ef5efae2d6c92e73218ba3d0630db1d0
Instruction ID: 38d660306c2797245ccedffe5e357d2349a083242d2bb9262831e18029373473
Opcode Fuzzy Hash: 2e7b500dd08226b12103c46d981c03b9ef5efae2d6c92e73218ba3d0630db1d0
Instruction Fuzzy Hash: C71147B19003099FDB20DFAAC844BDEBFF6AF88310F248819E515A7250C7759951DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 025FC138 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,025FBF99,00000800,00000000,00000000), ref: 025FC1AA

Memory Dump Source

Source File: 00000001.00000002.1581028936.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25f0000_20240328-REV2.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0ae2c7a6ac9f2018ed8f1bfc5ae92d353335fba9d70c274ccf974cc66e8296da
Instruction ID: 600b57fbf81e2110ecbe63a44b0a42993adf00a7202ba2733c29442277d7d892
Opcode Fuzzy Hash: 0ae2c7a6ac9f2018ed8f1bfc5ae92d353335fba9d70c274ccf974cc66e8296da
Instruction Fuzzy Hash: 5C11F2B6C003098FDB10CF9AC844BDEBBF4AB98224F14842AD559A7610C375A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 025FB6C8 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,025FBF99,00000800,00000000,00000000), ref: 025FC1AA

Memory Dump Source

Source File: 00000001.00000002.1581028936.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25f0000_20240328-REV2.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3f16ea85b0f1d0acc6229174e8198c6eb4ef8fd3b1275bf96312fe308b707e3c
Instruction ID: 1c6bd8af9d70dfbc2389ab082161a504319cc1a21feb7307e488c2f7386504d3
Opcode Fuzzy Hash: 3f16ea85b0f1d0acc6229174e8198c6eb4ef8fd3b1275bf96312fe308b707e3c
Instruction Fuzzy Hash: 9F1103B69003099FDB20DF9AD844BDEFBF4BB98210F10842EE519A7200C375A545CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 070B5AF8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 070B5B66

Memory Dump Source

Source File: 00000001.00000002.1586059222.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70b0000_20240328-REV2.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: adfa4bfe8ff87b387a5e34ed0aca4118df3faddc71d7101d2c79f6fc78636377
Instruction ID: 6457039a7240fc1bf3cb430c2a9f4b37fa73317dd2b1af02d4a84538ec758e64
Opcode Fuzzy Hash: adfa4bfe8ff87b387a5e34ed0aca4118df3faddc71d7101d2c79f6fc78636377
Instruction Fuzzy Hash: 3F1134B18003499FDB20DFAAC844BDEFBF5EF88720F148819E519A7250CB75A950DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 070B5530 Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 070B559A

Memory Dump Source

Source File: 00000001.00000002.1586059222.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70b0000_20240328-REV2.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 9d659e8834dbc36120f6906a6bd952f13b40390f12722a29356ffb077941f7bc
Instruction ID: 09f34e122d7b51f0cf5e2ecc66d4f8a0f95d8d8d024fd1757002ae810984c426
Opcode Fuzzy Hash: 9d659e8834dbc36120f6906a6bd952f13b40390f12722a29356ffb077941f7bc
Instruction Fuzzy Hash: 011158B19003098FDB24DFAAC4847EEFBF5AF88210F248819D419A7250CB799905CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 070B5538 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 070B559A

Memory Dump Source

Source File: 00000001.00000002.1586059222.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70b0000_20240328-REV2.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 1bf247cc355a10d071b0513c03844449ad180d038d1787fe4059480ccd580963
Instruction ID: 67450d86f7e9f925daca0227eac6f88675d8e9fa0697ea9643cb7a08d3138c57
Opcode Fuzzy Hash: 1bf247cc355a10d071b0513c03844449ad180d038d1787fe4059480ccd580963
Instruction Fuzzy Hash: FC113AB19003498FDB20DFAAC8457DEFBF5AF88620F148819D519A7240CB79A544CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 025FBEB8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 025FBF1E

Memory Dump Source

Source File: 00000001.00000002.1581028936.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25f0000_20240328-REV2.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 21c1cda5671a0199bb5994494d48cf4815333bdb103a491d2b0bc7485f27dee3
Instruction ID: b7183f7da8de7c98f6065745789c118f2b1c7a00a5639e047e7ed21a3224566f
Opcode Fuzzy Hash: 21c1cda5671a0199bb5994494d48cf4815333bdb103a491d2b0bc7485f27dee3
Instruction Fuzzy Hash: 3C110FB6C003498FCB20CF9AD444BDEFBF4AB88328F11841AD528A7210C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 070B6B10 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 070B98CD

Memory Dump Source

Source File: 00000001.00000002.1586059222.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70b0000_20240328-REV2.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: fe87fb4ab66bcb87489f599c85c95f869da97e5cb6e9eb5dacf87062cea6470c
Instruction ID: 83ba9413e903280a9a688a7160761ae2c61e38d337321d44900a26c5c9d79314
Opcode Fuzzy Hash: fe87fb4ab66bcb87489f599c85c95f869da97e5cb6e9eb5dacf87062cea6470c
Instruction Fuzzy Hash: 4A11F5B5800349DFDB20DF9AD444BDEBBF8EB48320F108519E554A7200C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 070BA560 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 070BA58F

Memory Dump Source

Source File: 00000001.00000002.1586059222.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70b0000_20240328-REV2.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ebc7a263249f9005f27c44d729fc61ce50131e2624a26e85cd643fcfc44b8c7b
Instruction ID: 37414f424604e3fb4e95be9848be028413c97c52437262557e27131e55b45aa6
Opcode Fuzzy Hash: ebc7a263249f9005f27c44d729fc61ce50131e2624a26e85cd643fcfc44b8c7b
Instruction Fuzzy Hash: 82F034F0E4020ADFC764EFA8C849BAEBBF0BB05204F508669C414E3250D7748645CF84

Uniqueness

Uniqueness Score: -1.00%

Function 06EAC350 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

O};5, xrefs: 06EAC388

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID: O};5
API String ID: 0-3558557551
Opcode ID: 829d7ffce80c99321fb7d9a1118349eb7e4766cf149778d72591d37bf15de4c3
Instruction ID: e62764eb58a37efb7e6a80756bdf7ab7858e9463d35f86f7754d8d6e2a9bd480
Opcode Fuzzy Hash: 829d7ffce80c99321fb7d9a1118349eb7e4766cf149778d72591d37bf15de4c3
Instruction Fuzzy Hash: 9E416E70A14709DFDB84CFA9D5898AEFFF5FB89300F609895D445AB324D730AA21CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0895084B Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 832496ee2e75cc3ae3bf298145f9de2d5de5b8939f3e9a950b8736bcdc4be084
Instruction ID: bd11aa638befe8b3849a4618770df9154e706486239f1061b0b607aad19c7d93
Opcode Fuzzy Hash: 832496ee2e75cc3ae3bf298145f9de2d5de5b8939f3e9a950b8736bcdc4be084
Instruction Fuzzy Hash: 7B021730700605DFDB44EF68D498A6DBBF2BF89715F5585A8E8099B366CB30EC86CB50

Uniqueness

Uniqueness Score: -1.00%

Function 08952768 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7764175dee3a38d78ca0b0ee789e6ca5ccb1f79d9adc44ada091da85f3454aed
Instruction ID: 3fbea8ba91030d6d6805674f2a67085db167afbe1cce6b8fb8caa01f5f2a78d7
Opcode Fuzzy Hash: 7764175dee3a38d78ca0b0ee789e6ca5ccb1f79d9adc44ada091da85f3454aed
Instruction Fuzzy Hash: D0C1F935B00214CFDB14EFA8D558A9DBBF1BF89715F2545A8E806AB3A1DB31EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 08952F10 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 617ba875a32ecbbd8a3c6b6ea78808383c871a52aab9bf16f96dc7301387e8eb
Instruction ID: f549206023569682b30531dd43da97cf8420d9dcc393aee5a0d3fe4dcb291b45
Opcode Fuzzy Hash: 617ba875a32ecbbd8a3c6b6ea78808383c871a52aab9bf16f96dc7301387e8eb
Instruction Fuzzy Hash: 5A61BA30B043049FDB18EBB9D41466E7BA6AFC6311F2484ADD40ADB791CB35EE02DB91

Uniqueness

Uniqueness Score: -1.00%

Function 06EAF6F8 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94ef9089066363eb11f1b56ca6376113d52b6ef0d76fc3d4f77c4c544487d9e5
Instruction ID: 1334b85383131e62ec74ac6613b407047604416256c6e660c2d231b5c3dd6ba9
Opcode Fuzzy Hash: 94ef9089066363eb11f1b56ca6376113d52b6ef0d76fc3d4f77c4c544487d9e5
Instruction Fuzzy Hash: E3613874D19308DFEB54CFA9D4446EEBBFAEF89300F10A129E419AB255DB306942CF80

Uniqueness

Uniqueness Score: -1.00%

Function 08959F41 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13af550ee7e66ef7c894f5e36c2fea8ad2264d90d59dd1db7900d5489511d6fd
Instruction ID: c9352426bd9297372d1ce11f48037d51e1fd9fa902f05a1c0d94c53ec2b9601c
Opcode Fuzzy Hash: 13af550ee7e66ef7c894f5e36c2fea8ad2264d90d59dd1db7900d5489511d6fd
Instruction Fuzzy Hash: 89512774E09228CFDB10EFA8D885BEDBBF9BB49301F205129E809AB345DB345944CF54

Uniqueness

Uniqueness Score: -1.00%

Function 08958BA0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f6b3691207d522f6e04d552c64fca329762a6314ac20936d243184c46e21b85
Instruction ID: 10b929bb698ee9dcb595bad6a0cd39f7ae761f8d5b723bfe47e94442c31cac61
Opcode Fuzzy Hash: 5f6b3691207d522f6e04d552c64fca329762a6314ac20936d243184c46e21b85
Instruction Fuzzy Hash: 6B517F30E00219CFDB04EBA9D8557EEBBF2FF89355F20856AD805BB654DB309945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08953992 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c7c57bcf8c67e19bb96d1257b8d3b62438281a1ce662a9fc68b98a78ac757c9
Instruction ID: d1b7705f0a1570d82746fe6867be52d5476b79e7814911362f7e517ce0463759
Opcode Fuzzy Hash: 1c7c57bcf8c67e19bb96d1257b8d3b62438281a1ce662a9fc68b98a78ac757c9
Instruction Fuzzy Hash: 73517B30600205CFDB15DF39C894BA9BBB5AF8A345F1581ADE806DB362DB30EC45DB51

Uniqueness

Uniqueness Score: -1.00%

Function 06EA6D14 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9e2e0f10d5f2d7f72e3696f4aaaa9b9c3262aeb5ab62a42f63143a6d81728e8
Instruction ID: 58c22eba11ea4c2dadae80bde70344205f83825077866845e96abc79475613e2
Opcode Fuzzy Hash: f9e2e0f10d5f2d7f72e3696f4aaaa9b9c3262aeb5ab62a42f63143a6d81728e8
Instruction Fuzzy Hash: 5B51A135B003058FDB05DBB9D8549AEBBF6FFC4324B148969E419DB351EB30AD058BA0

Uniqueness

Uniqueness Score: -1.00%

Function 08959D48 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28987ef335bf2834cdaf532301d315a43ff20fc48e25203ef2d5d38c11f670ee
Instruction ID: e893ed882b5f80ef3204831398195f02e7b1807e1fb6e552b4d9ac294bafe9c0
Opcode Fuzzy Hash: 28987ef335bf2834cdaf532301d315a43ff20fc48e25203ef2d5d38c11f670ee
Instruction Fuzzy Hash: 37512974A09218CFDB10EFA8D485BEDBBF9BB49301F205219E809AB385DB345E45CF58

Uniqueness

Uniqueness Score: -1.00%

Function 06EAFCF0 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fa84d1256402c2ca2c222838ae8e6ac108e493fa1fbcbede57dedf361dcf90e
Instruction ID: c1bcfb00c63a70ed3d64c3514d00a1c240bdb51f88a5a996ef755693889c6dbd
Opcode Fuzzy Hash: 8fa84d1256402c2ca2c222838ae8e6ac108e493fa1fbcbede57dedf361dcf90e
Instruction Fuzzy Hash: 1A418D71A003198FCB55EFA9D8446AFBBFAEF88250F10842AD455EB340DB34A901CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0895FA10 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bec180deb7190f72fe5bf4f39e9554cb1b387ca3c8f392958a71be3589ae5a9
Instruction ID: 96eebed390b3f28703a161639df0ebac12f81b553c0a889bf4a69048501a48e6
Opcode Fuzzy Hash: 1bec180deb7190f72fe5bf4f39e9554cb1b387ca3c8f392958a71be3589ae5a9
Instruction Fuzzy Hash: 81410670D09209CFDB08DFAAC5446EEBBF6AB8C312F14D42AD819A7251EB344A41CF55

Uniqueness

Uniqueness Score: -1.00%

Function 08951352 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e497349d92d54affe86f0249383aea36096d9eb886b23337b1e3429483847107
Instruction ID: 49b18fb1d22ecd386c39e2c8c018aa83016d38caa49007a31e30a33ed5ddf004
Opcode Fuzzy Hash: e497349d92d54affe86f0249383aea36096d9eb886b23337b1e3429483847107
Instruction Fuzzy Hash: 9A416C30300601CFDB29EF24C898B6EB7F6BF8561AF14856DD5068B3A1CB71AC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 08951360 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6f3f35a3ce3dbf47031babc8d4d0bf594bc6ee3b5c9d9de0898d07cc5141fc
Instruction ID: 47be06ae339bcb68ce88d4754a0e84cef2e89ee68959eab673bcf9a0769fd082
Opcode Fuzzy Hash: fb6f3f35a3ce3dbf47031babc8d4d0bf594bc6ee3b5c9d9de0898d07cc5141fc
Instruction Fuzzy Hash: 94411A30300601DFDB28EF64C498B6AB3F6BF8571AF14856DD5068B3A4CB71AC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06EAC4D8 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a65928b46e5a86fd7d87d2aeafec6fae80070dfd0799608c7baa614c1e3f431c
Instruction ID: d9ab254c275886df2d14854b863142c9ea3143ae64eef56f16ec49cbb7122864
Opcode Fuzzy Hash: a65928b46e5a86fd7d87d2aeafec6fae80070dfd0799608c7baa614c1e3f431c
Instruction Fuzzy Hash: 51418B74E0430A9FDB45CF95D8819EEBBB2FF89350F20A429E509BB354D7709A41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 08953B8C Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 860c7d445d38de88cebd4c365e2ad5ac6bf4e05004b84b76a7fe4eaefb264b4b
Instruction ID: 93749025a81cd418e2e1268196798b0ef33644f96cf9bd454081573ce502f9a5
Opcode Fuzzy Hash: 860c7d445d38de88cebd4c365e2ad5ac6bf4e05004b84b76a7fe4eaefb264b4b
Instruction Fuzzy Hash: 57415130200700CFD765EB38C858B5A37A6BF86759F1585ADD85ACF3A1CF75A84ADB40

Uniqueness

Uniqueness Score: -1.00%

Function 06EAE464 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99da490ee7466dd3400f3015ac095e5d387c0f7b981cf041ff2bdbb443bd8337
Instruction ID: 1b9490516e92f0b6d6637222c742c664aa2fdeb170bfb218c42ba50b47bca5f2
Opcode Fuzzy Hash: 99da490ee7466dd3400f3015ac095e5d387c0f7b981cf041ff2bdbb443bd8337
Instruction Fuzzy Hash: 7C3157B59003099FDB14DFA9D884ADEBFF9FB48320F10852AE809A7310C734A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 08959D5F Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42ea3e2dc6355abb79d44765e3cc70ebc7bdded7e725d4986235fc4c54dc3556
Instruction ID: 961a8ae17b3a22e30e103a5fac9ffff6980816ce196d89613097df6ec904b285
Opcode Fuzzy Hash: 42ea3e2dc6355abb79d44765e3cc70ebc7bdded7e725d4986235fc4c54dc3556
Instruction Fuzzy Hash: D441D174A05228DFEB64EF64D844B9DBBB2FB89301F1081D9E80AA7345DB305E81DF42

Uniqueness

Uniqueness Score: -1.00%

Function 08954B12 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87548d9c4c5ddd400616b3819c99f93b1e313501d5217072e5687572ac6befb4
Instruction ID: b3bf6556ae5386078cfff9509b8a50829185aec35881c9960c69063e4694b586
Opcode Fuzzy Hash: 87548d9c4c5ddd400616b3819c99f93b1e313501d5217072e5687572ac6befb4
Instruction Fuzzy Hash: 8A317A747002149FCB14EF68C884A6D7BBABF88621F114299E925DB3B1CB71DD42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 089520C8 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c00d48def93167d5879c4485a04ba66b1bb64155a7c9cc5c3fdf8fd8abaabb5e
Instruction ID: bda7930833423e520318f994d015ae5f3d088cff098fae518f9329f7fb0f99c9
Opcode Fuzzy Hash: c00d48def93167d5879c4485a04ba66b1bb64155a7c9cc5c3fdf8fd8abaabb5e
Instruction Fuzzy Hash: A1311E343006018FD718EB69C884B5A73EABF85615F1584ADE909CB371DF30EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08954B20 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 305c6fa701c65ca5381b1b2591141765368f24ec5bb1a7e88c24ff5572ee3c06
Instruction ID: 1ff02cd441ef4e79ad5f1875f6159756f99153798774c20f22b37b38abdb86f5
Opcode Fuzzy Hash: 305c6fa701c65ca5381b1b2591141765368f24ec5bb1a7e88c24ff5572ee3c06
Instruction Fuzzy Hash: 27315C747002149FCB54EF68C884A6E77B6FF88625F104259E9259B3B1DB71DD42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 089520B8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43112ff3be849934b3bc1d8c4d7cd57f60e37b5c5767a7dbbaf69582abb7c120
Instruction ID: f78db9014b2e24f67aedbd1fb58e4dac78271323a236d84f4304a10238941d4e
Opcode Fuzzy Hash: 43112ff3be849934b3bc1d8c4d7cd57f60e37b5c5767a7dbbaf69582abb7c120
Instruction Fuzzy Hash: E3311934300601CFD718EB68C884B5A77A6BF8961AF1580A9DA5ACB371DB30EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0895C7E8 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edf2e4fc080e38381fe3410bb7c16a109f1a688d18eaa5fd0f266bf98c7e8739
Instruction ID: 32d0a97b612c42d02969c2414d78a833a29bba84757ca26c837ec43209443520
Opcode Fuzzy Hash: edf2e4fc080e38381fe3410bb7c16a109f1a688d18eaa5fd0f266bf98c7e8739
Instruction Fuzzy Hash: 4A319A74E04208DFDB04EFA8D4416EEBBFAEF89306F10946AD915AB351DB389901CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0895B922 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddf0010df18dcfb306c051281198b965fb9c2a32d6ea660cc95115cb2670b259
Instruction ID: 8afb473851aa9d302a3c35c8c7d0bb376de05ce431612b52c16b3f6fcd337f4c
Opcode Fuzzy Hash: ddf0010df18dcfb306c051281198b965fb9c2a32d6ea660cc95115cb2670b259
Instruction Fuzzy Hash: 9A316934E08249CFDB04EFA8D4516EEBBF5EB89315F10956AD809B7350EB341A01CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0895B928 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eff3cf22ae4792b7104c65352a43ca77a6009d04de784e05f905446cbb98085e
Instruction ID: 4574fd9ac4564a4a77c433e408fccea8df901afe43aeb89eb4e2180dd49def10
Opcode Fuzzy Hash: eff3cf22ae4792b7104c65352a43ca77a6009d04de784e05f905446cbb98085e
Instruction Fuzzy Hash: C8314574E08209CFDB04EFA9D4516EEBBF9EB89315F10952AD809A7250EB345A01CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 08952DA0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06335334d39b7511a200978b4537a82d99d960633e6821d7d992bd09c5bd739d
Instruction ID: 4023372ae7b0bc686d2bcc89480a77f529416f3eb13999b39723f345894cba0e
Opcode Fuzzy Hash: 06335334d39b7511a200978b4537a82d99d960633e6821d7d992bd09c5bd739d
Instruction Fuzzy Hash: 5821C3347002018BAF15B7B9946873E36EB9FC9946359442DDC0BCB394EF24DD0787A6

Uniqueness

Uniqueness Score: -1.00%

Function 089525D4 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca478fe0e24bfcc8997b4a1a9598f50c11f6f73e3e449af03e798f4e08b1a272
Instruction ID: af5fb300aff61b297b687fc59ec412081e881da2e1722b71fd5afc7a843c7d85
Opcode Fuzzy Hash: ca478fe0e24bfcc8997b4a1a9598f50c11f6f73e3e449af03e798f4e08b1a272
Instruction Fuzzy Hash: 48313E30200700CFD764EF28C858B5677A9BF8576AF50C56DE85A8B3A1DF71E88A9B40

Uniqueness

Uniqueness Score: -1.00%

Function 0895C7F8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8424c331e8e0d19e02a6d7456199d0eb7d7468a5c94514e278de585733a8da1d
Instruction ID: 6e3e753d129753c9327f08d1b5903075da1abb57d5fa18e6de0e21c331a09b3b
Opcode Fuzzy Hash: 8424c331e8e0d19e02a6d7456199d0eb7d7468a5c94514e278de585733a8da1d
Instruction Fuzzy Hash: 41313A74E04209DFDB04EFA9D4456EEBBF9FB88306F10946AD915AB344DB349941CF90

Uniqueness

Uniqueness Score: -1.00%

Function 08955CA1 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dc9ff110f6ec6df4cd18b8ad97ef2e495652bdea9de046fa247bf28903de552
Instruction ID: 75391a0223cfc4b9b7156b8ff119a934695e0b27b579025d0ba7a35a832142b9
Opcode Fuzzy Hash: 3dc9ff110f6ec6df4cd18b8ad97ef2e495652bdea9de046fa247bf28903de552
Instruction Fuzzy Hash: AA31F835204385CFC725FF34C49086A7BF5BF823067204A7EE8959B692DB35E885CB50

Uniqueness

Uniqueness Score: -1.00%

Function 08952A6D Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f308e4b058ba0df8f6c4c15bd6a2d67db0a701c2d4a5c87ba591aea30e5669ac
Instruction ID: 337b214ea4f3d3ec0bba293f7790367bea1f9437d5f205d25741702471e78575
Opcode Fuzzy Hash: f308e4b058ba0df8f6c4c15bd6a2d67db0a701c2d4a5c87ba591aea30e5669ac
Instruction Fuzzy Hash: CA31E734A00204CFDB25EFA5D558A9D77F6AF89316F159468E806AB3A0DB31ED81CF21

Uniqueness

Uniqueness Score: -1.00%

Function 06EADDE0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88c0284530c9805334fda28df19b00c7b0f8dac8d3ab96eb705af28ac6132190
Instruction ID: e53b7e098c6ec7c6d7d11e206fa3b2e0f634a83ca7fbe5eac9e73392a41ea145
Opcode Fuzzy Hash: 88c0284530c9805334fda28df19b00c7b0f8dac8d3ab96eb705af28ac6132190
Instruction Fuzzy Hash: E83106B4E04219DFEB44EFA9D8416AEBBF5EF88300F109169E405AB354DB346A01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00C8D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1580725645.0000000000C8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c8d000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c57039095f821916ee90854e12a5977aa3a7537378fddbf5c51741885b9ca904
Instruction ID: 86085e9fac6311f3d060ed0dceaec48be86630d30e9b6a56106a3ea18285ed70
Opcode Fuzzy Hash: c57039095f821916ee90854e12a5977aa3a7537378fddbf5c51741885b9ca904
Instruction Fuzzy Hash: 0F212875504304DFDB04EF10D9C4B16BB65FBD4328F20C16DE80A0B296C336E856CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 08952258 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8295b59fbddfe316bf30b616a14819f827ce30d33046f8cece3f0f85d6ce940
Instruction ID: 2d83773f99e07b28b74190c68fedbd5775f5d4b23ebff0fcec7bbf305afc8008
Opcode Fuzzy Hash: d8295b59fbddfe316bf30b616a14819f827ce30d33046f8cece3f0f85d6ce940
Instruction Fuzzy Hash: CC3116342006008FC765EB68D488BA577A6BF85715F5584A9E49ECB262DF71A88ACB40

Uniqueness

Uniqueness Score: -1.00%

Function 08952D90 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fc49ffe474a64e0547080900b984263839af29e2f56e26a9ab3f35ff11b44cb
Instruction ID: a7343e052ca07971fde3776a64eddb38ed88a850cb38c6e5789698badbdde84b
Opcode Fuzzy Hash: 0fc49ffe474a64e0547080900b984263839af29e2f56e26a9ab3f35ff11b44cb
Instruction Fuzzy Hash: BA11B6383002008B9F15BBB9E46863E36EB9FC8956B19402DDC0ACB395DF24DD07C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 00C9D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1580782974.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c9d000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b4123352ddce77e036884422dab22ade844aaa94325e15c315ce8e9c8382f05
Instruction ID: baa0c87c11ed113debac0c74d9539f17dbb7078b9f1029f274abfc4402d5eff5
Opcode Fuzzy Hash: 6b4123352ddce77e036884422dab22ade844aaa94325e15c315ce8e9c8382f05
Instruction Fuzzy Hash: 8A21D075604304DFDF14DF24D988B16BB65FB84314F20C569E84A5B286C33AD847CA62

Uniqueness

Uniqueness Score: -1.00%

Function 00C9D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1580782974.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c9d000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e2833c9f9e1900bff102d8b543d8a135842812ae06df84856b396e8feed135e
Instruction ID: eff190c783f57b2d52f7b67390b6166b0d6b38bd2a1bebc9c867b94102ee48e0
Opcode Fuzzy Hash: 4e2833c9f9e1900bff102d8b543d8a135842812ae06df84856b396e8feed135e
Instruction Fuzzy Hash: DE21F275604704EFDF05DF10D9C8B26BBA5FB84714F20C6ADE84A5B296C336DC46CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0895F2FC Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7b865c48e5174d4260620319eedc70d66c7cc78c2ee6bee8a478584ffa4ee2a
Instruction ID: 15186a9adc09c4ac67964035a8b0e2a647542ca6667292597d94e92286e3dcd8
Opcode Fuzzy Hash: c7b865c48e5174d4260620319eedc70d66c7cc78c2ee6bee8a478584ffa4ee2a
Instruction Fuzzy Hash: F631AE74E00219CFDF08DFE9D8849EDBBB2BF89311F10812AE919AB351DB316945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 08952268 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c7b95477be0d7f9c66e1725eed4f5cbf464ce735ad194a22fa31cc0bf9507c0
Instruction ID: 9ffda4867f0428ce8d207ee1ec71c1b3a34c960e694bcda94511579b0377d6d9
Opcode Fuzzy Hash: 7c7b95477be0d7f9c66e1725eed4f5cbf464ce735ad194a22fa31cc0bf9507c0
Instruction Fuzzy Hash: 3D310634200700CFC768EB68D448BA677E6FF85716F5585A9E55ECB361DF70A88ACB40

Uniqueness

Uniqueness Score: -1.00%

Function 06EAF9F8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aea0ea921f03206e20337f291f09d50f543c115c101bd02aeaa676218498492f
Instruction ID: 2fe87ad4fea398e2779cdb63e79183d018d5cb9b165f179117a55df7c6350a7d
Opcode Fuzzy Hash: aea0ea921f03206e20337f291f09d50f543c115c101bd02aeaa676218498492f
Instruction Fuzzy Hash: D2110471A09384AFCB56CF70DC544ADBFF8EF0620072148EAD8C5CB252E9309E06D762

Uniqueness

Uniqueness Score: -1.00%

Function 0895FBC8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77aeed93e39a186d903228f2913d535b34d41e8a594ee4538da03eb0a93afa0c
Instruction ID: 6f48cf18210558a9c2939bf6dd05b3ae6ca443ab280730bc308ee85f03383104
Opcode Fuzzy Hash: 77aeed93e39a186d903228f2913d535b34d41e8a594ee4538da03eb0a93afa0c
Instruction Fuzzy Hash: 412125B4D08209DFCB40DFA9C5909AEBBF5EF49311F2094AAD809A7711CB309A41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06EAE770 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a82b2914959d097af24795b55aa28aaffa55199bfa4b7b8a5b06ac1c22550598
Instruction ID: 08b7d0e44942969d27868019602f08a0567608e2e41e7311528a87126b5b35a9
Opcode Fuzzy Hash: a82b2914959d097af24795b55aa28aaffa55199bfa4b7b8a5b06ac1c22550598
Instruction Fuzzy Hash: 5B21DFB0C01318DFDB60DF9AC988B8EBBF5BB48714F24801AE408BB250C7B56845CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C9D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1580782974.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c9d000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6460201677beabda5119eedd4b1842e2e017826cd7fe9615af3e0632cc738ccb
Instruction ID: dff65b4f2b293baa4dd272998d26a74d2afe68817b1840daaf068772d2678cc9
Opcode Fuzzy Hash: 6460201677beabda5119eedd4b1842e2e017826cd7fe9615af3e0632cc738ccb
Instruction Fuzzy Hash: A3216F755093C08FDB12CF24D994715BF71EB46314F28C5EAD84A8F6A7C33A990ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 06EAC278 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfda7c567ae6be2077b16851b7f53f78028add578652425f74e663881f983cbd
Instruction ID: 3c7502b462c5a4c84ff0e258b75fe5ba23c4902425f88d7e45076f455b104fca
Opcode Fuzzy Hash: dfda7c567ae6be2077b16851b7f53f78028add578652425f74e663881f983cbd
Instruction Fuzzy Hash: 32219EB4A10A08DFD704DF5AE085999BFF5FF88310F5281D5E8489B265EB31A9A1CB05

Uniqueness

Uniqueness Score: -1.00%

Function 08952010 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c1f3c8df5bcea8400d417dde2da87ea0a13581d2726bdeeefe4cb656d1dab7
Instruction ID: 40847c84c7fdd115908312ed737a637bcb5242690a1847df3561aadbf1240c3e
Opcode Fuzzy Hash: b9c1f3c8df5bcea8400d417dde2da87ea0a13581d2726bdeeefe4cb656d1dab7
Instruction Fuzzy Hash: 0F115B31701604CFC724EF79C49481AB7F6AF9621675445BEE4079B371DB32E886CB61

Uniqueness

Uniqueness Score: -1.00%

Function 06EAE0D8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6ced5fb2b8ee607170299bdc15089ca4982a48ecc32ea7ad0ad8ef4b258c1f5
Instruction ID: d3f44f80befa30e2c849c5e69bd9ab8d1b980db4088185e769a21f2ba95026f6
Opcode Fuzzy Hash: c6ced5fb2b8ee607170299bdc15089ca4982a48ecc32ea7ad0ad8ef4b258c1f5
Instruction Fuzzy Hash: 0E111F32F003199BDB55EBB998106FEBBF6AF85351B24406AC504EB244EB319D06DBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0895070C Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99e7f431bafcdd8eda2fee9d8b9fe252f059e1ce53763b43cf60281a9d8bb5f1
Instruction ID: d847c9b80f28b64d8927bd9eabeaaa150dc637c4aee817743f9262f3e9901b49
Opcode Fuzzy Hash: 99e7f431bafcdd8eda2fee9d8b9fe252f059e1ce53763b43cf60281a9d8bb5f1
Instruction Fuzzy Hash: A4115B70B006008FC718EF79D89496AB7F2BFC9614B20856DD4169B3A5DB75EC06CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00C8D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1580725645.0000000000C8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c8d000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction ID: 77e27412449eb15816fb699a2e249a98099652b6eb55f5d554c7b0452e6758e5
Opcode Fuzzy Hash: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction Fuzzy Hash: A2110376504240DFCB01DF00D5C0B16BF72FB94324F24C2A9D80A0B296C33AE95ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0895F2D5 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac9b7f248aa941fa83f57a2352d139d22e392c9059197e4635c17860c88aaccb
Instruction ID: 568cd27d183d44503ba2ea03e806684eb2ad2bc12cb1e790015e50fcfd5aa765
Opcode Fuzzy Hash: ac9b7f248aa941fa83f57a2352d139d22e392c9059197e4635c17860c88aaccb
Instruction Fuzzy Hash: 5E11A7B5E04248CFDB04DFEAD8446ADBBB6BF89311F14902AD819BB355DB305906CF14

Uniqueness

Uniqueness Score: -1.00%

Function 06EAE474 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12903017147a41abe7dc96f984543f51b6da2d22a64f87b83a9682faad4c1f4d
Instruction ID: c68060a73f4659a34b11ea9b872c3fc0d40f0aebb8dd94e651b68469ff392b8f
Opcode Fuzzy Hash: 12903017147a41abe7dc96f984543f51b6da2d22a64f87b83a9682faad4c1f4d
Instruction Fuzzy Hash: A72100B59003499FDB20DF9AD884ADEBBF8FB48320F10841AE919A7210C374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 08957EC8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a21fb77e20d5e7d253e82e773c3f39786b0f074d3144b79082c8557c2ac61cc0
Instruction ID: 29d476b7819013ecfeb733cbcb4bf17a86b7f0e3bbb3dd05d3baa5b444681970
Opcode Fuzzy Hash: a21fb77e20d5e7d253e82e773c3f39786b0f074d3144b79082c8557c2ac61cc0
Instruction Fuzzy Hash: 40118270A09388AFCB05DBB8E55455D7F619F86314F2082EAC4599F2E6CA308E06C765

Uniqueness

Uniqueness Score: -1.00%

Function 0895B872 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9610f21a1f51ca9c3aa6e722279b58055d8b98f2909f07717e109054382cc6c9
Instruction ID: 03ba5c1412095c02bd85a88b59b795f1f32a072ee5a1d4e882ce853f5601830b
Opcode Fuzzy Hash: 9610f21a1f51ca9c3aa6e722279b58055d8b98f2909f07717e109054382cc6c9
Instruction Fuzzy Hash: C511E374D09249DFCB01EFA8D5411ADBFF9FB89311F109599D918AB342C7340A01CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0895F258 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4532e9f3e1edef34d95f366bd6e479b7f8a14b43beed9992b59113ce622c29f
Instruction ID: d6bb2525b6ff28e5c16bdfaca1fb12dcae2747ac90373e2f9a10de5945f07285
Opcode Fuzzy Hash: d4532e9f3e1edef34d95f366bd6e479b7f8a14b43beed9992b59113ce622c29f
Instruction Fuzzy Hash: 4411F8B4D042488BDB18DFEAC5546AEFFBAAF89310F14C02AD815BB358DB7419068F90

Uniqueness

Uniqueness Score: -1.00%

Function 00C9D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1580782974.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c9d000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction ID: aa13fd11975c116fa364eb20e6f1225a9674394f629e5327f43cb28cd6f4efdc
Opcode Fuzzy Hash: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction Fuzzy Hash: 5611BB75504680DFCB01CF10C5C4B15BBA2FB84324F24C6ADD84A4B296C33AD84ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 0895B880 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b32cf9bb6105e3ce663e64f12f2e4d5059b5d409b0b8361422c00390e02c5f8
Instruction ID: 981917a992fedf30b54b4b6fad8da22b5c62ffeb0457e1392c703ac460a554e0
Opcode Fuzzy Hash: 9b32cf9bb6105e3ce663e64f12f2e4d5059b5d409b0b8361422c00390e02c5f8
Instruction Fuzzy Hash: 84115EB4D19208DFCB04EFA9D5452AEBBF9FB88311F109569E919A7300DB304A01CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0895FCD0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c809feb4613af356f93ca22e658acfe8fe271116d2c430449d76e489e033ead
Instruction ID: 72d60a136a1e97fb35dc526491ec0c44e43f4511a49565515d683db67414a9f9
Opcode Fuzzy Hash: 5c809feb4613af356f93ca22e658acfe8fe271116d2c430449d76e489e033ead
Instruction Fuzzy Hash: A0110974D08208EFCB04EFA9D5409ADFBF9FB49321F1099A5D809A7305EB709A40CF80

Uniqueness

Uniqueness Score: -1.00%

Function 08952D01 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70d42563263894d3d3bae4173fc433a5173f731665b9089b2c5713bc83e1e9de
Instruction ID: 0aa096e448477cfc10df513809307e06d1e0248be1c6e800cc6e9d7d2787904e
Opcode Fuzzy Hash: 70d42563263894d3d3bae4173fc433a5173f731665b9089b2c5713bc83e1e9de
Instruction Fuzzy Hash: 3C01D2342093814FC722E77CC8507593FA5AFC6152F0904AEC885CF667DA249803C392

Uniqueness

Uniqueness Score: -1.00%

Function 08952001 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96b72a1d2e2e5f8a164470c2b9f940ca350175539447cd9970982e53027e3f6c
Instruction ID: 2867f0b939a496c2d8204ce486cdc0ad65dc414a3d969b21f4f7a49224480c15
Opcode Fuzzy Hash: 96b72a1d2e2e5f8a164470c2b9f940ca350175539447cd9970982e53027e3f6c
Instruction Fuzzy Hash: AB01F131309280CFC715EF38D4505197BF2AFA625271901AEE446DF2B2DB32DC41CB22

Uniqueness

Uniqueness Score: -1.00%

Function 08959058 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d92aa75a42126c94ba9294375b605cd783f5d24b0be122e8c26880372c0fc79
Instruction ID: 4e5c5facb94bddfe98e951c20a7843b52231c17d2325c70a3d7076462ae8d3f3
Opcode Fuzzy Hash: 5d92aa75a42126c94ba9294375b605cd783f5d24b0be122e8c26880372c0fc79
Instruction Fuzzy Hash: 94F0BB327442049BE714EA9AB801F9BB7DDDBC0671F24846FE54C97640DD31A8018754

Uniqueness

Uniqueness Score: -1.00%

Function 0895F2F4 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccd50da8ab8d3bfed713ae6b7ea3db59c0a55085839e08aa26b3bd46cf5f2f36
Instruction ID: 25dfb029722a2965637abbcc7b0e5a906a4e67a63402c7a6f145ca6d4af330af
Opcode Fuzzy Hash: ccd50da8ab8d3bfed713ae6b7ea3db59c0a55085839e08aa26b3bd46cf5f2f36
Instruction Fuzzy Hash: C301C4B4D04648CBDF08EFE6D4483AEFFB6AF88311F10D42AC816BA258DB7415068F50

Uniqueness

Uniqueness Score: -1.00%

Function 089583F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e577c58f5b725405389ff6f9a95a7cd771592e84ab1d0916a0c0531309db349d
Instruction ID: 40d0cd69428e869686b466c991d3b99b3612188534984d5e4b90ce2e7680b7ce
Opcode Fuzzy Hash: e577c58f5b725405389ff6f9a95a7cd771592e84ab1d0916a0c0531309db349d
Instruction Fuzzy Hash: 5E0121342097828FC72AEB28E44026A7BE1AF45226F0445BECC85DB7E2CB30D482C741

Uniqueness

Uniqueness Score: -1.00%

Function 08958400 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a2346cd76c9194bfa1fec227014d2716cdb05f30c720cf1a58335e979d19fe9
Instruction ID: 5a95b4a312e327dc2f60a771b0b464ff425a9ce5273a2dae01f8406fd9e0a693
Opcode Fuzzy Hash: 7a2346cd76c9194bfa1fec227014d2716cdb05f30c720cf1a58335e979d19fe9
Instruction Fuzzy Hash: D5F0C831204704DBDB24EE1AD440767B7E8AF44756F40853DDD0A97750DB75E882C750

Uniqueness

Uniqueness Score: -1.00%

Function 08958A4F Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23496b1d66d061a3dc956f59494e1a79f21bcc323a0a468d575e7c6d3eaad46d
Instruction ID: fd05b62aad005fe05c2795a13089cba500f7b853c61723957adb1f1e892c648f
Opcode Fuzzy Hash: 23496b1d66d061a3dc956f59494e1a79f21bcc323a0a468d575e7c6d3eaad46d
Instruction Fuzzy Hash: AB014B70D09209EFCB04DFA8D9066AEBFF4FB49301F5481AAD814F3211E7304A01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06EA6808 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 338e74929555dddf78a4ed66589890efadee93f579a8c0d80e9d04c4e571ed02
Instruction ID: 75aaae2102c296e684ff6f40fd0ff00cbcf03c1afeb1c994e560d2a6eaba5884
Opcode Fuzzy Hash: 338e74929555dddf78a4ed66589890efadee93f579a8c0d80e9d04c4e571ed02
Instruction Fuzzy Hash: 48F0ECB4D19308EFDB44DFA9D4416AEBBBDEB4A300F04A1AA941997311E7706A01DF80

Uniqueness

Uniqueness Score: -1.00%

Function 08952D28 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 522ad0819d63d9859084ae9efdf585d81a349adbd52f2bbe53e0fdbf0b694634
Instruction ID: 711b7d5fa136623587763069d634fcd7b84367151a992e45097dd0b043492238
Opcode Fuzzy Hash: 522ad0819d63d9859084ae9efdf585d81a349adbd52f2bbe53e0fdbf0b694634
Instruction Fuzzy Hash: BCF05E353106048BDA18F7B9C850B6A37EAABC5956F08046DDA46DB764DEB4EC028791

Uniqueness

Uniqueness Score: -1.00%

Function 06EAAE20 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed3bcf447d3a743272e916ce49b10726eabb321305ffef132eb2ca4e0356ec2d
Instruction ID: d89ec5c7c238ee7c57ee60f50a64256b3cb75945a4661d4d988e17aaa50c65e8
Opcode Fuzzy Hash: ed3bcf447d3a743272e916ce49b10726eabb321305ffef132eb2ca4e0356ec2d
Instruction Fuzzy Hash: 2E01A5B4D042599FCB40DFA8C4856AEBFF8FB08301F1085A9E954E7340D734AA81DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06EAA2F8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3ab62ce0c60cac0888d5ea56a46bed6307d206ed478996afd82d8d2758248c1
Instruction ID: 8f4300b8607f73ab1b54cb9ddeb3a53678c4d6d5eaa9ddf706046ceb32b760bd
Opcode Fuzzy Hash: b3ab62ce0c60cac0888d5ea56a46bed6307d206ed478996afd82d8d2758248c1
Instruction Fuzzy Hash: EF01B675E00208EFDB04DFA9C599A9DBFF5EF88310F05C0A5A4089B361DA34E940DF40

Uniqueness

Uniqueness Score: -1.00%

Function 06EAFC88 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24380bdb75b6c83fada3e7f129146ddd6a630d00cfab27a0de3ef3982f999882
Instruction ID: db9f6dc6c81a0b43a2793c7adc73c04f10585c65aeefebbcde09d102f150866a
Opcode Fuzzy Hash: 24380bdb75b6c83fada3e7f129146ddd6a630d00cfab27a0de3ef3982f999882
Instruction Fuzzy Hash: 2BF01D71D0421AEFCF40EF99D8019EFBBB9FF89324F048519E914AB210D732A516CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08958B90 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4904804302695f50607f5ac5fdbf20382cc9a0833931ae78634263f0a18ba23
Instruction ID: dd0a81ce3487be0b2e4e5793851bddd753745cd1eb6cbd0fd339f1b22cf23572
Opcode Fuzzy Hash: e4904804302695f50607f5ac5fdbf20382cc9a0833931ae78634263f0a18ba23
Instruction Fuzzy Hash: 33F044B1D1421B8FCF40EFA8C8025EEBBB1BF85301F11486AD518FB010E730228A8B80

Uniqueness

Uniqueness Score: -1.00%

Function 089570B7 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a245e839fddf1ba0455b23093e76cabfd8a9a96739dda72b6b25e641d7e667aa
Instruction ID: f555bd79b214ddf5316d18fbddd15f4fd548443b3df29a690f8e9b40876298f6
Opcode Fuzzy Hash: a245e839fddf1ba0455b23093e76cabfd8a9a96739dda72b6b25e641d7e667aa
Instruction Fuzzy Hash: 99F0593321428AEBDF12DEA48C009DC3FA4DF02239F044257F9E1DA092C3799266D752

Uniqueness

Uniqueness Score: -1.00%

Function 0895C93F Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a24ca336e0a8652409ac97e45fb3572a362b7c84c062b80e0dcd6efb38aacd45
Instruction ID: 489ad1a0ff749aa6f897a32f591ed855ce3ecd276f48bad9fdc00bd31b3d774c
Opcode Fuzzy Hash: a24ca336e0a8652409ac97e45fb3572a362b7c84c062b80e0dcd6efb38aacd45
Instruction Fuzzy Hash: 52F05874D0A248EFC751EFA8D454298FFF4EF4A204F10C1EAD89897341D6314A02CF41

Uniqueness

Uniqueness Score: -1.00%

Function 08958A60 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cea5b6b0f11852afafc9277160a2eefac964236e345543f4c66390fa9c97ec4
Instruction ID: 4ab76393d0d78d895a1d31300261d5d732e2fbf3f9de8f51665684866f1e2f11
Opcode Fuzzy Hash: 6cea5b6b0f11852afafc9277160a2eefac964236e345543f4c66390fa9c97ec4
Instruction Fuzzy Hash: 5CF0B7B4D08209EFCB44DFA9D9456AEBBF4FB48301F1085AAE819B3350EB305A41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0895BB20 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65500994ce026a137fe86e100f316ec32c75cc58341442379c096efe3bcb87be
Instruction ID: 9fc1c20bea67d2094088918fce98708c936501c5aa2734968ac2707601303ba1
Opcode Fuzzy Hash: 65500994ce026a137fe86e100f316ec32c75cc58341442379c096efe3bcb87be
Instruction Fuzzy Hash: 11F05E74D09288AFC742DFA8D44159CBFB4EF46211F1480EAC858DB392D7758945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 089570C8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d50237e84e06884b9f2cba989d746a7a16f05bd67d7f97e9fea4f7272327df9
Instruction ID: 2969b183b4c8947d9d50432ab87712de1caa7a66edc022b359f534e00b6d1e2c
Opcode Fuzzy Hash: 2d50237e84e06884b9f2cba989d746a7a16f05bd67d7f97e9fea4f7272327df9
Instruction Fuzzy Hash: 13F0653261021DFB5F10EE988C015DD37A8EF0923AF148526FDA5D6140D375E6609BA1

Uniqueness

Uniqueness Score: -1.00%

Function 08955AA0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90d5ad94065e7e3a011ae3c9201eac4323184f1a44fe699388ab33591f0e3c9f
Instruction ID: 0ec714bee49d494fc4299c15e079be448b9c4c7faebcb8cd148e6addbca33318
Opcode Fuzzy Hash: 90d5ad94065e7e3a011ae3c9201eac4323184f1a44fe699388ab33591f0e3c9f
Instruction Fuzzy Hash: 07E086313401105B8318B65ED8D497E7BDAEBC9626751847AF50DD7311CE219C065355

Uniqueness

Uniqueness Score: -1.00%

Function 0895BAD8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 691f8c1fe5f8bd7de9d5e0876c1ce21c970209629df470969bcbb25b2a3cfe80
Instruction ID: 128021d97bd8d5c139d0fe760178d12851ba2c33c1c09ddc694d073f50f98a03
Opcode Fuzzy Hash: 691f8c1fe5f8bd7de9d5e0876c1ce21c970209629df470969bcbb25b2a3cfe80
Instruction Fuzzy Hash: 1FE0ED7050A2989FC703EFB494015AA3FF8DF47206F1405EAD440CB1A2D63189048782

Uniqueness

Uniqueness Score: -1.00%

Function 0895F302 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2fd9256d1eaa0f7c17360cef86e4861b66090e67edb2cbc232e355697dddaa5
Instruction ID: c949f8c86709b42658a30b64dd201a50947b3e24cd58212fa77fe5e35f47e4f8
Opcode Fuzzy Hash: e2fd9256d1eaa0f7c17360cef86e4861b66090e67edb2cbc232e355697dddaa5
Instruction Fuzzy Hash: 29F0D4B4E16218DFDB04EFA5E9445ADB7F6BF88311F60942AE805A7254EB348901CB00

Uniqueness

Uniqueness Score: -1.00%

Function 08958468 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d1f0078b3fd5f7c59b63d9deb6f2da51a8d115594380d4d029c51c86b1b429
Instruction ID: db9558cb7f9da7c02a37d1543a1cd3fe6752d3efb3ce276ff6630b46d5dfcf8f
Opcode Fuzzy Hash: e8d1f0078b3fd5f7c59b63d9deb6f2da51a8d115594380d4d029c51c86b1b429
Instruction Fuzzy Hash: DCE0D8353491914FC306936CE86455C7FA69FCA27171640FAD14CCF363CE114C068795

Uniqueness

Uniqueness Score: -1.00%

Function 0895B830 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e5943533b5b43d8c38b07b331eaae2b315b9ed509f481f3e86153b566828143
Instruction ID: 66d80276882df661d18a774db8eaa30eacb0b10ef2ea5c8aa3db5f14c0f04ac7
Opcode Fuzzy Hash: 5e5943533b5b43d8c38b07b331eaae2b315b9ed509f481f3e86153b566828143
Instruction Fuzzy Hash: FDF0E53090D244BFCB02DBA8D4514ACBF70EF07311F1481EED8049F292C7314956C782

Uniqueness

Uniqueness Score: -1.00%

Function 06EA6688 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 970508921de0b66fc67540c6744a05a76bc9338243a572aa3d81c8639b2901cd
Instruction ID: 6543e9bc52a582ffd39fd027247c0a10df6db33ae89efe1b7c5dda08730307b6
Opcode Fuzzy Hash: 970508921de0b66fc67540c6744a05a76bc9338243a572aa3d81c8639b2901cd
Instruction Fuzzy Hash: F8F0C975D04208FFCB44DF98D841AADBBB9EB89314F14C1A9EC185B350D632AA51DF80

Uniqueness

Uniqueness Score: -1.00%

Function 0895C950 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dd1ddba78b560982898321530a8f49f6e76de239658f53fcae9509715830521
Instruction ID: 1c5de09a908c6a2bbe2e8494d629b2f6a07076c3222ba5e7871853e0a3a8a097
Opcode Fuzzy Hash: 7dd1ddba78b560982898321530a8f49f6e76de239658f53fcae9509715830521
Instruction Fuzzy Hash: AEE0E574E05208EFCB84EFA8D4516ACFBF8EB4A305F10C1A99818A7340D6319A42CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0895BB30 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dd1ddba78b560982898321530a8f49f6e76de239658f53fcae9509715830521
Instruction ID: c4819ac96e30ad02f34fcc6c62261b8d2a6b2cb2f74fc43462a6e2062e043c39
Opcode Fuzzy Hash: 7dd1ddba78b560982898321530a8f49f6e76de239658f53fcae9509715830521
Instruction Fuzzy Hash: 92E0E574E05208EFCB84EFA8D4416ACFBF8EB89315F10C1A9981897340E7719A02CF41

Uniqueness

Uniqueness Score: -1.00%

Function 08952F00 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4def1677bc02a81a394c74cc4c5e5642433e62e75f2626629b2b58babc036d01
Instruction ID: c8a7d9f9119ab0f7ec96dbd49e564af0182af7572374c262c48741a66daf1b13
Opcode Fuzzy Hash: 4def1677bc02a81a394c74cc4c5e5642433e62e75f2626629b2b58babc036d01
Instruction Fuzzy Hash: 4AE01A3050A3849FC716DB6999195007F649F4322AB2946EEDC948B2B7D232E81BCB92

Uniqueness

Uniqueness Score: -1.00%

Function 0895A398 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94b264fb9242477e37f5d983a50dce538199b617606bb0bcf93212eb2c26d91c
Instruction ID: 493421c3cae8ae029bc5f46a30fa83c0df07eda562626ff55e41d450437e9d2e
Opcode Fuzzy Hash: 94b264fb9242477e37f5d983a50dce538199b617606bb0bcf93212eb2c26d91c
Instruction Fuzzy Hash: 81E0D871515214DFC700EBA0D511A5A7BF8EF4E206F1059A5A4448B010EA304D00DB81

Uniqueness

Uniqueness Score: -1.00%

Function 06EA68C8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ede38e36a69fe2260818a0b162e2db11f13d264695d8138c9b109e1cf9796d3d
Instruction ID: 949ea510c0eccb833c839d658965fa74f22d305f9a30ee51f53a9716118ecd30
Opcode Fuzzy Hash: ede38e36a69fe2260818a0b162e2db11f13d264695d8138c9b109e1cf9796d3d
Instruction Fuzzy Hash: B3E0E5B4E04308EFCB84DFA9D4516ACFBF8EB4A304F14C1A998189B340D631AA02DF80

Uniqueness

Uniqueness Score: -1.00%

Function 0895BAE8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6b4856173e035621405f1ee9c0406d433ac9aae9c068cef63c91e58db3d0d11
Instruction ID: fa01538d620acdf607fb29d57e3c73a05f4f836870b0d58cdbfea138e042df21
Opcode Fuzzy Hash: c6b4856173e035621405f1ee9c0406d433ac9aae9c068cef63c91e58db3d0d11
Instruction Fuzzy Hash: 67E012B580624CEFC700FFA58401AAA7BFCDF8A216F4045A5D90597150EA725A549B91

Uniqueness

Uniqueness Score: -1.00%

Function 08959F10 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 248add142da7310a49f997271e2f3ccc3a777b62ffb88191043cafb3d1624f87
Instruction ID: 75502c060f3775fea8fa1d39bf2b406026f2088270bf9bd3dc00c20be140233c
Opcode Fuzzy Hash: 248add142da7310a49f997271e2f3ccc3a777b62ffb88191043cafb3d1624f87
Instruction Fuzzy Hash: FCE0C232B04054CFCB20CF14E804ADCF7B8DB58302F008566E40ADB102DB3585168F10

Uniqueness

Uniqueness Score: -1.00%

Function 0895A3A8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82241198d6eeddc60723cbf369eda0ec635899d62b830b98e81dd5d39f9054e
Instruction ID: e5997a5584979bc36ce065bc82f8eba1b2865e14dd6c99a62322dc35ce7d08b5
Opcode Fuzzy Hash: e82241198d6eeddc60723cbf369eda0ec635899d62b830b98e81dd5d39f9054e
Instruction Fuzzy Hash: 0EE01271909218EFD700EFA4D51669EBBFDEB4A206F005AA5A5499B110FE314E009B95

Uniqueness

Uniqueness Score: -1.00%

Function 0895B840 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 170ba1ff578cff43dffda045faba17bb0357f195be7a50c8d79f95bd0c7133d6
Instruction ID: 5ace65fa4014719249c422cf6e9e91a14002b8be13219b4aad88f42922ebcdb1
Opcode Fuzzy Hash: 170ba1ff578cff43dffda045faba17bb0357f195be7a50c8d79f95bd0c7133d6
Instruction Fuzzy Hash: BCE0EC74909208EBCB04EB94D55296DBBB8EB46315F1091EDDC181B381DB325E42DB81

Uniqueness

Uniqueness Score: -1.00%

Function 0895EB56 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae724905daf151cbbc7b425ff55d6b7b0e74752c02ecfa10a06031d5fc6c3e23
Instruction ID: 58a0b77f4258ecad1e590a0136dee5122ad7c63bca483e0dac709acaa890b3f9
Opcode Fuzzy Hash: ae724905daf151cbbc7b425ff55d6b7b0e74752c02ecfa10a06031d5fc6c3e23
Instruction Fuzzy Hash: EAD05231A02218CFCB10DB88EC40BECBBB8FBC9222F0042E2C40CA2214D3302A80CF20

Uniqueness

Uniqueness Score: -1.00%

Function 08959F74 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5691910bc6c0cb471310e8dfe2ab4ca15412b640b362f44b23fe7782daa6e00b
Instruction ID: 0a28acde029746a378467150cc82671a123f55fc3f6ef66ed998c9f419ba4f90
Opcode Fuzzy Hash: 5691910bc6c0cb471310e8dfe2ab4ca15412b640b362f44b23fe7782daa6e00b
Instruction Fuzzy Hash: FFE0E238A0421A8FCB20EF28E4427A9BBB5FB48300F0041A9E409A7706E7306E418F80

Uniqueness

Uniqueness Score: -1.00%

Function 06EA6ED8 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eba574e5ee9b55e2b432f991b557ef0d68bba87bd23c082f87660f660efdec6
Instruction ID: 18b7cd7d9fa63072407bd1586143598698030d876e3fa545e395dbf155474c34
Opcode Fuzzy Hash: 4eba574e5ee9b55e2b432f991b557ef0d68bba87bd23c082f87660f660efdec6
Instruction Fuzzy Hash: 7AC08071814308ABC350DFB9D8097197BACD707355F444454F408C7140DF715550C665

Uniqueness

Uniqueness Score: -1.00%

Function 0895A105 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3df88673862557b8a49f92dc070d335783d38eb331b780ba627d5370c58e0cb
Instruction ID: 3b16e8928c92c15c4bd8b863a597b83211b85a8c971bdc64be7ce4f41a82d135
Opcode Fuzzy Hash: d3df88673862557b8a49f92dc070d335783d38eb331b780ba627d5370c58e0cb
Instruction Fuzzy Hash: 45E0E278905219CBEB50CF60DD44BACBBB4FB08300F008295D80EAB380DA304A85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 08959E33 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d61f87774fb8aeda9971e2c4e67223f1eca52a874cfdbf23e810bd770c29b0
Instruction ID: 4431a2a80313b61000ec29db224139f3f0e1b319e02fc45ca652d7037c5d552a
Opcode Fuzzy Hash: f8d61f87774fb8aeda9971e2c4e67223f1eca52a874cfdbf23e810bd770c29b0
Instruction Fuzzy Hash: 99D09E74918198CBCB40DF90D5555ACBFB8FB09302F109855D40FAA244CA351D84CF00

Uniqueness

Uniqueness Score: -1.00%

Function 0895E828 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ab8b1b5fd4a6f4729bc247b24a0a17d4e85d0da40f617fee0caa36cedc046ea
Instruction ID: 36142bbda40b9ca71327d8bb0814098b52b0065a1d3fd838edbe85579226eb9f
Opcode Fuzzy Hash: 4ab8b1b5fd4a6f4729bc247b24a0a17d4e85d0da40f617fee0caa36cedc046ea
Instruction Fuzzy Hash: 63C08CB00123048BD3106FAAA81C329376CAF06206FC00015EA08414608B714886CFB6

Uniqueness

Uniqueness Score: -1.00%

Function 0895FA83 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13930bb6605cdd3abdd091ddcbdeada492517ed7655ac2772a65d48954a5cff7
Instruction ID: a83f0f90833cf504f56f02eb788ec5b7fc9590b446f2fe99998076bbeacfd85a
Opcode Fuzzy Hash: 13930bb6605cdd3abdd091ddcbdeada492517ed7655ac2772a65d48954a5cff7
Instruction Fuzzy Hash: 04B09B3594660CC7C750DA50F4544BD7736EB8A232B105285DC0E231004F315950CA95

Uniqueness

Uniqueness Score: -1.00%

Function 06EAE41C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 681dedbfdf9f8162d3ebc45c3ff037dc5acf6ea8aff2af64f0667aadd4662e24
Instruction ID: 4fa0987838fc3258bfe2bcd001ce73952f2fd5ef10f432c5f8a516853d3a28b9
Opcode Fuzzy Hash: 681dedbfdf9f8162d3ebc45c3ff037dc5acf6ea8aff2af64f0667aadd4662e24
Instruction Fuzzy Hash: A2B01275294300E7BAC463648C50A5BAA66BBF5B01B40BC42731814010DD70E429E36F

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0895C388 Relevance: 5.3, Strings: 4, Instructions: 259COMMON

Download Yara Rule

Strings

[V~*, xrefs: 0895C4F4
]\`, xrefs: 0895C60A
[V~*, xrefs: 0895C4ED
T+-q, xrefs: 0895C6C2

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID: T+-q$[V~*$[V~*$]\`
API String ID: 0-1849991408
Opcode ID: a63563a1a284b55ad8cfe78a8599e8cdc1d291871e8c7b6c22b5ea3e6f4bd5f0
Instruction ID: 632a85313d21cfc0e67b8503a50962086ed2913a77f417107fd4d1b2f3e06d22
Opcode Fuzzy Hash: a63563a1a284b55ad8cfe78a8599e8cdc1d291871e8c7b6c22b5ea3e6f4bd5f0
Instruction Fuzzy Hash: C0B116B0E152199FCB04DFAAD9808AEFBF2FF89305F54D92AD815BB214D73099428F54

Uniqueness

Uniqueness Score: -1.00%

Function 0895C378 Relevance: 4.0, Strings: 3, Instructions: 257COMMON

Download Yara Rule

Strings

[V~*, xrefs: 0895C4F4
]\`, xrefs: 0895C60A
T+-q, xrefs: 0895C6C2

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID: T+-q$[V~*$]\`
API String ID: 0-3978741314
Opcode ID: e9a62a80e6be190934ec47fc510e58b26118f62248416e234024c449c09da216
Instruction ID: e8d88e3fdacbba050a5e7d3cf9bcf2d93cef46cfac4fcb3da487a395b83813bd
Opcode Fuzzy Hash: e9a62a80e6be190934ec47fc510e58b26118f62248416e234024c449c09da216
Instruction Fuzzy Hash: 1DB117B0E152199FCB04DFAAD9808AEFBF2FF89305F54D92AD815BB214D73099428F54

Uniqueness

Uniqueness Score: -1.00%

Function 06EA82A8 Relevance: 3.9, Strings: 3, Instructions: 155COMMON

Download Yara Rule

Strings

RWIK, xrefs: 06EA8312
[[bb, xrefs: 06EA840B
7Z/t, xrefs: 06EA83BB

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID: 7Z/t$RWIK$[[bb
API String ID: 0-1157992699
Opcode ID: 668f8d1441c90c8ec53d81a17e69523536d44331c98a1e893a0645db2403501c
Instruction ID: 5c4370a1417085951479ecd292ab0bb2749f79f7387298b3a564f73bf48a15a0
Opcode Fuzzy Hash: 668f8d1441c90c8ec53d81a17e69523536d44331c98a1e893a0645db2403501c
Instruction Fuzzy Hash: DB51F570E05709CFDB48CFAAC5455AEFBF2AF89300F14E42AD459AB254D7349A428F94

Uniqueness

Uniqueness Score: -1.00%

Function 06EA6F10 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

0, xrefs: 06EA6F85

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: f15c47a7cf97fa8bf208badf5a2a5bafdc880df71b30a2e706514f7aa28decc3
Instruction ID: a3cbc95116b98ae646c392bc750a6eca8539a1ce638b5811f354416e2558984f
Opcode Fuzzy Hash: f15c47a7cf97fa8bf208badf5a2a5bafdc880df71b30a2e706514f7aa28decc3
Instruction Fuzzy Hash: 1921FB71E007189BEB58CFABD85079EFBF7AFC9200F14C07AD508A6224DB341A418F51

Uniqueness

Uniqueness Score: -1.00%

Function 070B7748 Relevance: .5, Instructions: 548COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1586059222.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70b0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c51c69ef0f64119c267e65b59e5dd3f0f54dc593175d978fa9885f11cd3ee2b9
Instruction ID: 2eef05c435b21a208a2f56c89f1fde2489538adfca9157c757d3c2553075e4a0
Opcode Fuzzy Hash: c51c69ef0f64119c267e65b59e5dd3f0f54dc593175d978fa9885f11cd3ee2b9
Instruction Fuzzy Hash: C63205B4B002058FDB54DF69C594BADB7F2BF89704F2581A9E506AB361CB31EE01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 08957271 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36e88f1780c83adc619797aa95b36cf50a4653599f436769e22c43ffb8b0df07
Instruction ID: 4085de9dd4ff562d225f918d267d54cebbff90e538ad9f59fb2385d4ad8918aa
Opcode Fuzzy Hash: 36e88f1780c83adc619797aa95b36cf50a4653599f436769e22c43ffb8b0df07
Instruction Fuzzy Hash: 2612BB75D0061A8FCB15DF68C8906D9F7B1BF89310F15C6AAD858AB211EB70AAC5CF80

Uniqueness

Uniqueness Score: -1.00%

Function 08957280 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c7d8503db0fb96ce82ed24b15d3ca64bd0a436d4e2cf5297b872a591109d2a8
Instruction ID: d5a209d9eb735983913f1798f09e65cc498f5cc69bfa6fc5d8cdfa555f350745
Opcode Fuzzy Hash: 0c7d8503db0fb96ce82ed24b15d3ca64bd0a436d4e2cf5297b872a591109d2a8
Instruction Fuzzy Hash: 6D12BA75D0061ACFCB15DF68C890AD9F7B1BF89310F15C6AAD859A7211EB70AAC5CF80

Uniqueness

Uniqueness Score: -1.00%

Function 070B3618 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1586059222.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70b0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daea485079375afcdfe26a4fc2460bf951984680ef4c4e8834de289da76f1f30
Instruction ID: bfd7b5d7fc47a7ed671901205a06a4d3dc90c6a1ee16a4495c0a5450d8cf3cba
Opcode Fuzzy Hash: daea485079375afcdfe26a4fc2460bf951984680ef4c4e8834de289da76f1f30
Instruction Fuzzy Hash: 78E119B4E102598FDB24DFA9C580AAEFBF6FF89304F248259D414A7355D730AA42CF60

Uniqueness

Uniqueness Score: -1.00%

Function 070B56C0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1586059222.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70b0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73848a70a3378d130d5416725fd12d55bf39e951a416f5b56d83a9b42802620d
Instruction ID: 664c8cf484c26e33bbaa7e1ea6abbbcd1e40ed13522e42df9a7d9f1b8ce12640
Opcode Fuzzy Hash: 73848a70a3378d130d5416725fd12d55bf39e951a416f5b56d83a9b42802620d
Instruction Fuzzy Hash: 51E1FBB4E002598FDB14DF99C580AAEBBF6FF89315F24C2A9D414A7355D7309A42CF60

Uniqueness

Uniqueness Score: -1.00%

Function 070B2DA8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1586059222.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70b0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4241d9f6a1bdd3c3d87c8475cb4491726424773d9683108f2af05540f9a0c20b
Instruction ID: 789ad94948abe64982607c76dca72be463d96e83883b9cc1009d2464cea0f768
Opcode Fuzzy Hash: 4241d9f6a1bdd3c3d87c8475cb4491726424773d9683108f2af05540f9a0c20b
Instruction Fuzzy Hash: B1E1FCB4E102598FDB14DF99C580AAEFBF6FF89305F248269D414A7355D730AA42CF60

Uniqueness

Uniqueness Score: -1.00%

Function 070B4CC0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1586059222.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70b0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feab7c9825fdbe0f174e7cad27b7f081f4939c6c034b7dc27f81e6ba8d17ea73
Instruction ID: 9b7f0b87c7f802a9537019595d6b2e7e1019bb32941d496a412c729d12244f8b
Opcode Fuzzy Hash: feab7c9825fdbe0f174e7cad27b7f081f4939c6c034b7dc27f81e6ba8d17ea73
Instruction Fuzzy Hash: 64E10CB4E102598FDB14DF99C580AAEFBF6FF89304F248259E414A7356D731AA42CF60

Uniqueness

Uniqueness Score: -1.00%

Function 070B31E0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1586059222.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70b0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e45c614a19e2436d2e22452e92e8626df30fec9a48d8e4b7328e345d51d8d2
Instruction ID: 0bf6f163a41b1060cfb53b2684a0ec0d26f828a2d75c142c6ba8098746a5f8df
Opcode Fuzzy Hash: 68e45c614a19e2436d2e22452e92e8626df30fec9a48d8e4b7328e345d51d8d2
Instruction Fuzzy Hash: 6DE1E9B4E002598FDB14DF99C580AAEFBF6FF89305F248269D414A7355D731AA42CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0534E6F0 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1584604125.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5340000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ff19c0b6a65d022e5f260609c8c58be88e808b65490911f15f4f5601185ffcc
Instruction ID: 00e677e9e628afe5d92e7bb300fe99efb89ae778c344e537499a2c44204c0e41
Opcode Fuzzy Hash: 9ff19c0b6a65d022e5f260609c8c58be88e808b65490911f15f4f5601185ffcc
Instruction Fuzzy Hash: 9CA1A170B042459FEF59EBB8881477F66ABAFC9A40F14847CD00ADB384DE389D0797A5

Uniqueness

Uniqueness Score: -1.00%

Function 06EAF148 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55822dc16cae888851f226cc82b201c901c22a6b32f3001b41dd917f7b90ca6d
Instruction ID: de916886fbca591c71cd363cbd84cdb44a2c2eb087253c687c24469f4adfc704
Opcode Fuzzy Hash: 55822dc16cae888851f226cc82b201c901c22a6b32f3001b41dd917f7b90ca6d
Instruction Fuzzy Hash: 15D11635D2075A8ACB10EBA4D99069DB7B1FFD6300F50C79AE5093B224EF706AC5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0895A67A Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd34170c660a2c8fd5c39a8deb816a5235a9e60d85bdc9eaa501ccd9d4211b70
Instruction ID: 2332c362f7d354347a705489e4a626da8d5b04f0d480dc11c4c9432459980785
Opcode Fuzzy Hash: bd34170c660a2c8fd5c39a8deb816a5235a9e60d85bdc9eaa501ccd9d4211b70
Instruction Fuzzy Hash: E2C18475E01628CFDB58DF6AC944ADDBBF2BF89301F14C1A9D809AB325DB305A858F50

Uniqueness

Uniqueness Score: -1.00%

Function 06EAAA60 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f2be58b6b984d0d67bac89c88caf22878dbb93c92ad9ce46a76b86ea12e6837
Instruction ID: 71276be57422449dd8ac329911c53992b701c2ebcdc94408b36bfd4cfb22aebb
Opcode Fuzzy Hash: 9f2be58b6b984d0d67bac89c88caf22878dbb93c92ad9ce46a76b86ea12e6837
Instruction Fuzzy Hash: DA81AD74E15319CFDB44CFA9C68499EBBF2FF88310B14956AE415AB320D334AA42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 06EA8770 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64c1fe8b6ee950f9842a7cae0585fd84e45efd03775240876887924146af46b7
Instruction ID: 32abdf77aa1e387f34ec0895f7af544a421d0dc237286da4bf2bdedcdb7b15e6
Opcode Fuzzy Hash: 64c1fe8b6ee950f9842a7cae0585fd84e45efd03775240876887924146af46b7
Instruction Fuzzy Hash: 297112B4E013099FDB44CF99D4859EEFBB2FB88310F10952AE415AB354D734AA41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0895A3E0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c17e209a5a7b63c6956d5d9689cf3cd13d4618c01a9b361311e63702759dd2e5
Instruction ID: 2e5cea6ee76ad0005d97bb2585961efd982e7aa4cf3f3282071a1e824af5b073
Opcode Fuzzy Hash: c17e209a5a7b63c6956d5d9689cf3cd13d4618c01a9b361311e63702759dd2e5
Instruction Fuzzy Hash: 58614071914245DFD748EFAAE94269EBFF3BFC4300F14C52AD404AB259EF74590A8B90

Uniqueness

Uniqueness Score: -1.00%

Function 06EABED0 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63e830e2ed2911d38a1f1e367d50a45534c8757ca3d5342ae36c8512525df531
Instruction ID: 22d441b37bbf54ac651926427caec1fc1179069556b0ddb6c56b22bd8ae33dbf
Opcode Fuzzy Hash: 63e830e2ed2911d38a1f1e367d50a45534c8757ca3d5342ae36c8512525df531
Instruction Fuzzy Hash: D9613B7491AB09DFD740CF91F585099BFB6FBC8340F71A8A9C0899F168EB34A664CB14

Uniqueness

Uniqueness Score: -1.00%

Function 0895A3F0 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 405838f78592e8622736383c85bcc6a19d8f2e6ab5daf701c95488323912f1b8
Instruction ID: fc421bc87b569a2670db832066c1645030a1994340118b22d2487d6452b33cb9
Opcode Fuzzy Hash: 405838f78592e8622736383c85bcc6a19d8f2e6ab5daf701c95488323912f1b8
Instruction Fuzzy Hash: A7612E70914245DFD748EFAAE94269EBFF7BFC8300F14C52AD404AB259EF74590A8B90

Uniqueness

Uniqueness Score: -1.00%

Function 06EAB918 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27b89b57eac5f5a3904c59d16d8243ad82702cf6ed2fe6472511daacb738899c
Instruction ID: 6edb9663239aae28a469176d53b42ae98256a18102109eb72414846161f9036f
Opcode Fuzzy Hash: 27b89b57eac5f5a3904c59d16d8243ad82702cf6ed2fe6472511daacb738899c
Instruction Fuzzy Hash: C361F4B0E0430A9FDB44CFAAC6915EEFBB6FB99200F14945AD419BB214D334AA41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06EAD8A8 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb4d85ad5c39cd4e83df23dcccc23b6934ac8774be8f73cfe89647589a226c
Instruction ID: 9997599ef31fef31fd2908bce9ae3a39c6e43fac5a87e7c9ad0aefaf196debfd
Opcode Fuzzy Hash: 4ccb4d85ad5c39cd4e83df23dcccc23b6934ac8774be8f73cfe89647589a226c
Instruction Fuzzy Hash: 91512870E15309DFDB44CFAAD9855EEBBF2AF88310F10A42AE415AB654D7346A018F94

Uniqueness

Uniqueness Score: -1.00%

Function 06EA0040 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93b0ce629a5cac16e7dcc6e7365776ebeb76ce29e48dbaddbf0d8640c06d7b9b
Instruction ID: f7e59eef18f44911f73497e67e643c290dabf1a68917ee0855e514d253f8256b
Opcode Fuzzy Hash: 93b0ce629a5cac16e7dcc6e7365776ebeb76ce29e48dbaddbf0d8640c06d7b9b
Instruction Fuzzy Hash: 3A4150B1D016188BEB5CCF6B8D406DAFAF7AFC8305F18C1BA841CAA254DB7415868F50

Uniqueness

Uniqueness Score: -1.00%

Function 06EABC88 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be1f7062d3df6365e2e179c6f0f5b4187d7ed5c9ef60917e4944b5cec13fce02
Instruction ID: ab4ec1b1ebc764c99953bf1104cbe67e556dff1f258a47f1f117965a0227f1a7
Opcode Fuzzy Hash: be1f7062d3df6365e2e179c6f0f5b4187d7ed5c9ef60917e4944b5cec13fce02
Instruction Fuzzy Hash: EA41B5B0E04309DFDB44CFAAC4815EEFBB2BB88300F24D56AC415AB214D734AA51CF94

Uniqueness

Uniqueness Score: -1.00%

Function 06EA0032 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1585780879.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ea0000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05bffea7f2eeaa2f56028ef745a56dd2a93d7a7bd9df4272decc619424c8145d
Instruction ID: 42a5c4242c5b56691111fde9dc9f0bc42d9e7b22803b5f41f01cc1fcda243086
Opcode Fuzzy Hash: 05bffea7f2eeaa2f56028ef745a56dd2a93d7a7bd9df4272decc619424c8145d
Instruction Fuzzy Hash: 024135B1E016588BEB5DCF6B8D4069EFAF3AFC9200F18C1BA841CAF254EB3105568F55

Uniqueness

Uniqueness Score: -1.00%

Function 08955570 Relevance: 5.2, Strings: 4, Instructions: 187COMMON

Download Yara Rule

Strings

B, xrefs: 08955596
@, xrefs: 0895563E
B, xrefs: 08955643
@, xrefs: 08955591

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID: @$@$B$B
API String ID: 0-685577651
Opcode ID: ea251f18b75e941346cfffa23845623420337fcb7bbaccd827df98856198cacf
Instruction ID: 98c7beb387102a617587002c271811236738c40ddfbe9516b40a10dda6014a83
Opcode Fuzzy Hash: ea251f18b75e941346cfffa23845623420337fcb7bbaccd827df98856198cacf
Instruction Fuzzy Hash: DB61F475701605CFCB24EF78C48056EB7B6FF89225725856AE81ACB7A2DB30DC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08955560 Relevance: 5.1, Strings: 4, Instructions: 83COMMON

Download Yara Rule

Strings

B, xrefs: 08955596
@, xrefs: 0895563E
B, xrefs: 08955643
@, xrefs: 08955591

Memory Dump Source

Source File: 00000001.00000002.1587080933.0000000008950000.00000040.00000800.00020000.00000000.sdmp, Offset: 08950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8950000_20240328-REV2.jbxd

Similarity

API ID:
String ID: @$@$B$B
API String ID: 0-685577651
Opcode ID: c8674d607a136684b863785d5094cb6b0e7d940f905dc467a92e0b1fa9b4427f
Instruction ID: bf8db55ecbb3f2200cd1a4d21b8b8e5b7d9d390943a4c334381286bc55b42392
Opcode Fuzzy Hash: c8674d607a136684b863785d5094cb6b0e7d940f905dc467a92e0b1fa9b4427f
Instruction Fuzzy Hash: 2621BF71B016568FCB25EF6DC8C486EBBB9EF89215726406AE805DB272D730DC42CB91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 20240328-REV2.exePID: 4788, Parent PID: 6840COMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	72.2%
Signature Coverage:	0%
Total number of Nodes:	90
Total number of Limit Nodes:	7

Executed Functions

Function 06155210 Relevance: 1.9, APIs: 1, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2751559834.0000000006150000.00000040.00000800.00020000.00000000.sdmp, Offset: 06150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6150000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 833557c5644a7fb8071b53c4cf23fbeffc91d2cef9ce461e51fe2985cba3f6f0
Instruction ID: 2f34e76491336a30b51edee11dc00484a1d35e5f216533f93571bb7af0402193
Opcode Fuzzy Hash: 833557c5644a7fb8071b53c4cf23fbeffc91d2cef9ce461e51fe2985cba3f6f0
Instruction Fuzzy Hash: A0F14B30E00349CFDB54DFA9C844B9DFBF2BF88314F568559E819AB265DBB0A945CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00EDAC80 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00EDAD0E
GetCurrentThread.KERNEL32 ref: 00EDAD4B
GetCurrentProcess.KERNEL32 ref: 00EDAD88
GetCurrentThreadId.KERNEL32 ref: 00EDADE1

Memory Dump Source

Source File: 00000005.00000002.2745890984.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ed0000_20240328-REV2.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 302af41989e0369649439c47662b862cf1d0c511f795efda8e32d440ce6ce73f
Instruction ID: d076939d6ce6a71b5007f32032904b45ed0a2b050838c3cffd6a66a7806b285d
Opcode Fuzzy Hash: 302af41989e0369649439c47662b862cf1d0c511f795efda8e32d440ce6ce73f
Instruction Fuzzy Hash: DD5169B090034A8FDB14DFAAD548BAEBBF1FF88305F248059D509A73A0D774A945CF66

Uniqueness

Uniqueness Score: -1.00%

Function 00EDAC90 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00EDAD0E
GetCurrentThread.KERNEL32 ref: 00EDAD4B
GetCurrentProcess.KERNEL32 ref: 00EDAD88
GetCurrentThreadId.KERNEL32 ref: 00EDADE1

Memory Dump Source

Source File: 00000005.00000002.2745890984.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ed0000_20240328-REV2.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: e61cc9fa7021d4c81283d6a96a7d59d4326d7ee8883bcc7358753559b9c7c1ae
Instruction ID: 381601b792c5a76765b2c022c070caa1edeaf84bf3f96113d959ace4819194d3
Opcode Fuzzy Hash: e61cc9fa7021d4c81283d6a96a7d59d4326d7ee8883bcc7358753559b9c7c1ae
Instruction Fuzzy Hash: 685169B090034A8FDB14DFAAD448BAEBBF1EF88315F248019D509B77A0D774A945CF66

Uniqueness

Uniqueness Score: -1.00%

Function 061500E5 Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06150202

Memory Dump Source

Source File: 00000005.00000002.2751559834.0000000006150000.00000040.00000800.00020000.00000000.sdmp, Offset: 06150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6150000_20240328-REV2.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 00976eb1c774c17740747f3f9435fa0516cea33225e70700608ada66cb3beb8d
Instruction ID: 28da8366fa469f29972004dc821ef5adeba9112778f943ac6656f9ff5cfae860
Opcode Fuzzy Hash: 00976eb1c774c17740747f3f9435fa0516cea33225e70700608ada66cb3beb8d
Instruction Fuzzy Hash: 1851BDB5D00309DFDB14CFA9C984ADEFBB5BF48310F25812AE818AB210D7759945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 061500F0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06150202

Memory Dump Source

Source File: 00000005.00000002.2751559834.0000000006150000.00000040.00000800.00020000.00000000.sdmp, Offset: 06150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6150000_20240328-REV2.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e5ed0f6ad5f0586b18c7b8e1c073d0402a67cf68adfdef064a5fac49e316b936
Instruction ID: 9e2b30c674d282057fe5ef5711007fcae55f25379501b62371849e195d6fdf9a
Opcode Fuzzy Hash: e5ed0f6ad5f0586b18c7b8e1c073d0402a67cf68adfdef064a5fac49e316b936
Instruction Fuzzy Hash: 5B41B0B1D00349DFDB14CFAAC884ADEFBB5BF88310F25812AE818AB210D7759945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06150414 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06152B71

Memory Dump Source

Source File: 00000005.00000002.2751559834.0000000006150000.00000040.00000800.00020000.00000000.sdmp, Offset: 06150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6150000_20240328-REV2.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 3f079db067893937a638a35a5ff49b24fb04433c2acd8ae8488ce421150d63db
Instruction ID: d5617ad88544beba8574e297744757e7ccf931440757b59fe03e5b6e62a07a49
Opcode Fuzzy Hash: 3f079db067893937a638a35a5ff49b24fb04433c2acd8ae8488ce421150d63db
Instruction Fuzzy Hash: 9E4129B9A00309CFDB14DF59C888AAAFBF5FB88314F25C459D519A7321D774A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EDAED0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00EDAF5F

Memory Dump Source

Source File: 00000005.00000002.2745890984.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ed0000_20240328-REV2.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 36a016d455593f722ec40c20ee64a2d342db02b2a0e54fce1f6feb6b83ade63c
Instruction ID: e51172c56e6690818d1c8542e9daac645ed6da21fc18268dda41518a4b7a4eeb
Opcode Fuzzy Hash: 36a016d455593f722ec40c20ee64a2d342db02b2a0e54fce1f6feb6b83ade63c
Instruction Fuzzy Hash: 4A21F4B5D002499FDB10CFAAD484ADEBFF4EB48320F14801AE954A3350D374A941CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EDAED8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00EDAF5F

Memory Dump Source

Source File: 00000005.00000002.2745890984.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ed0000_20240328-REV2.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9f1804b068e1b1b672fc4638a5d5c67bd40093c6e9cd5408c45ca8055f0c7f8c
Instruction ID: 28c3bae3aa3ca2d3c51a0ea7271f4d3be4811815815b1e160765556b8e39c232
Opcode Fuzzy Hash: 9f1804b068e1b1b672fc4638a5d5c67bd40093c6e9cd5408c45ca8055f0c7f8c
Instruction Fuzzy Hash: 3521B3B59002499FDB10CFAAD884ADEBBF9EB48710F14841AE914A3350D378A955CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06154FF0 Relevance: 1.5, APIs: 1, Instructions: 47
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 0615504D

Memory Dump Source

Source File: 00000005.00000002.2751559834.0000000006150000.00000040.00000800.00020000.00000000.sdmp, Offset: 06150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6150000_20240328-REV2.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: a71e48868d1f4fd6962237209a5dc622f6973258cc82941c63dcd00ff8052d46
Instruction ID: c10b33a60a46498f7b8cd17d63c5edeeec097c834a7ed12c56ddd755936b02c5
Opcode Fuzzy Hash: a71e48868d1f4fd6962237209a5dc622f6973258cc82941c63dcd00ff8052d46
Instruction Fuzzy Hash: FC1106B5800349CFDB20DFAAD844BCEFFF8AB48224F24845AD558A7210D379A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06154098 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0615504D

Memory Dump Source

Source File: 00000005.00000002.2751559834.0000000006150000.00000040.00000800.00020000.00000000.sdmp, Offset: 06150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6150000_20240328-REV2.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 99f9fa2b3688c225a4223dc82c1570687f86d1e3944926a1c5e4fbd64e711ada
Instruction ID: b57b7f49e9d1db5e208729411ba0b17751864a4a736e0f8b87036316fe8481e3
Opcode Fuzzy Hash: 99f9fa2b3688c225a4223dc82c1570687f86d1e3944926a1c5e4fbd64e711ada
Instruction Fuzzy Hash: AA1133B4800349CFDB20DFAAD484B9EFBF4EB48224F20841AD528A3200C778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E0D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745314546.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e0d000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f2743064614a79b7171a4be84a74950e33d99cd1d87e5c9cc769ddb566cce1c
Instruction ID: e1d6ce6581eba24d3d9b2845404267e8d12bbaab98425ae784b053932cefcf32
Opcode Fuzzy Hash: 2f2743064614a79b7171a4be84a74950e33d99cd1d87e5c9cc769ddb566cce1c
Instruction Fuzzy Hash: 4F21D075608304DFDB14DF54D984B16BB66FB84328F20C569D84E5B286C33AD887CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00E0D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745314546.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e0d000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 170db237b2d36619eebe5bfcde8d2880bdd5ad2fdeea6ac6b8bf807eed1f493a
Instruction ID: cac9da8954b2a968820b44a9ab87d76900bff9ff1deaa03f85abc650a2d63929
Opcode Fuzzy Hash: 170db237b2d36619eebe5bfcde8d2880bdd5ad2fdeea6ac6b8bf807eed1f493a
Instruction Fuzzy Hash: 0D21537550D3808FC712CF64D994715BF72EB46314F28C5DAD8498B6A7C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00CED628 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745135646.0000000000CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ced000_20240328-REV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b9a1c2b3deda6dfdbe702e8f5d5408e53906bd36f7433048d717908a4d16ec3
Instruction ID: 1458d81d0316a7cb4bad9ea375dcc525b066d1558c271f45fce6e74f84fe6e6b
Opcode Fuzzy Hash: 1b9a1c2b3deda6dfdbe702e8f5d5408e53906bd36f7433048d717908a4d16ec3
Instruction Fuzzy Hash: 40F0C2714043849EE7208A16C884B62FFECEF41734F18C45AFD1D4A287C2799844CAB1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 20240328-REV2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_20240328-REV2.ex_d0d499a9646a641b819fa0255edad0bdab418090_3cf00dc3_f546981a-4c8e-4734-9074-23d81c861b04\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5DE2.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER60A2.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6101.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\20240328-REV2.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e22pavwa.f3a.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tckzrrwj.5ng.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yakagxcv.e30.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zv2kgg4g.glx.ps1

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
20240328-REV2.exe

Function 0895A688 Relevance: 2.3, Strings: 1, Instructions: 1042
COMMON

Function 070BA138 Relevance: 1.9, APIs: 1, Instructions: 377
COMMON

Function 025FDF58 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Function 025FDF60 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 06EAA200 Relevance: 2.6, Strings: 2, Instructions: 63
COMMON

Function 070B5E40 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 025FBCB8 Relevance: 1.7, APIs: 1, Instructions: 206
COMMON

Function 070B56AF Relevance: 1.7, APIs: 1, Instructions: 159
threadCOMMON

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre