Edit tour

Windows Analysis Report
PO#50124.exe

Overview

General Information

Sample name:	PO#50124.exe
Analysis ID:	1432053
MD5:	b4306234a3b45c69df6a6a7cecd6070c
SHA1:	323197c988bc794e3a6314fce81dc20c48d234ee
SHA256:	13129eaaaee8200a17214e947f0e984d10050e79c2cd5a963d7ada54ce3aa0a8
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

PO#50124.exe (PID: 7072 cmdline: "C:\Users\user\Desktop\PO#50124.exe" MD5: B4306234A3B45C69DF6A6A7CECD6070C)

PO#50124.exe (PID: 7252 cmdline: "C:\Users\user\Desktop\PO#50124.exe" MD5: B4306234A3B45C69DF6A6A7CECD6070C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.alkuwaiti.com", "Username": "electronics@alkuwaiti.com", "Password": "Ele@1804"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.2591871064.0000000002D1C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.2591871064.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2591871064.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.2589430439.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2589430439.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1386811526.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1386811526.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PO#50124.exe PID: 7072	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PO#50124.exe PID: 7072	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PO#50124.exe PID: 7252	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PO#50124.exe PID: 7252	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.PO#50124.exe.3fc3688.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO#50124.exe.3fc3688.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO#50124.exe.3fc3688.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316bd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3172f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317b9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3184b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318b5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31927:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319bd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a4d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.PO#50124.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.PO#50124.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.PO#50124.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334bd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3352f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335b9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3364b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336b5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33727:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337bd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3384d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.PO#50124.exe.3ffe0a8.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO#50124.exe.3ffe0a8.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO#50124.exe.3ffe0a8.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316bd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3172f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317b9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3184b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318b5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31927:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319bd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a4d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.PO#50124.exe.3ffe0a8.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO#50124.exe.3ffe0a8.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO#50124.exe.3ffe0a8.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334bd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dcdd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3352f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dd4f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335b9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ddd9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3364b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6de6b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336b5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6ded5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33727:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6df47:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337bd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6dfdd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3384d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e06d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.PO#50124.exe.3fc3688.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO#50124.exe.3fc3688.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO#50124.exe.3fc3688.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334bd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dedd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa86fd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3352f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df4f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa876f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335b9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dfd9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa87f9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3364b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e06b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa888b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336b5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e0d5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa88f5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33727:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e147:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa8967:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337bd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e1dd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa89fd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 50.87.219.149, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\PO#50124.exe, Initiated: true, ProcessId: 7252, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49707

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: PO#50124.exe

Avira: detected

Found malware configuration

Source: 0.2.PO#50124.exe.3ffe0a8.1.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.alkuwaiti.com", "Username": "electronics@alkuwaiti.com", "Password": "Ele@1804"}

Multi AV Scanner detection for submitted file

Source: PO#50124.exe	ReversingLabs: Detection: 83%
Source: PO#50124.exe	Virustotal: Detection: 72%			Perma Link

Machine Learning detection for sample

Source: PO#50124.exe

Joe Sandbox ML: detected

Source: PO#50124.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.7:49706 version: TLS 1.2

Source: PO#50124.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\PO#50124.exe

Code function: 4x nop then jmp 07690113h

0_2_07690588

Source: global traffic

TCP traffic: 192.168.2.7:49707 -> 50.87.219.149:587

Source: Joe Sandbox View	IP Address: 50.87.219.149 50.87.219.149
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.7:49707 -> 50.87.219.149:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.alkuwaiti.com

Source: PO#50124.exe, 00000003.00000002.2591871064.0000000002D1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.alkuwaiti.com
Source: PO#50124.exe, 00000003.00000002.2590375532.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, PO#50124.exe, 00000003.00000002.2591871064.0000000002D24000.00000004.00000800.00020000.00000000.sdmp, PO#50124.exe, 00000003.00000002.2589940978.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: PO#50124.exe, 00000003.00000002.2590375532.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, PO#50124.exe, 00000003.00000002.2591871064.0000000002D24000.00000004.00000800.00020000.00000000.sdmp, PO#50124.exe, 00000003.00000002.2589940978.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: PO#50124.exe, 00000003.00000002.2591871064.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PO#50124.exe, 00000003.00000002.2590375532.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, PO#50124.exe, 00000003.00000002.2591871064.0000000002D24000.00000004.00000800.00020000.00000000.sdmp, PO#50124.exe, 00000003.00000002.2590375532.0000000000F99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: PO#50124.exe, 00000003.00000002.2590375532.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, PO#50124.exe, 00000003.00000002.2591871064.0000000002D24000.00000004.00000800.00020000.00000000.sdmp, PO#50124.exe, 00000003.00000002.2590375532.0000000000F99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: PO#50124.exe, 00000000.00000002.1386811526.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp, PO#50124.exe, 00000003.00000002.2589430439.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: PO#50124.exe, 00000000.00000002.1386811526.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp, PO#50124.exe, 00000003.00000002.2591871064.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, PO#50124.exe, 00000003.00000002.2589430439.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: PO#50124.exe, 00000003.00000002.2591871064.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: PO#50124.exe, 00000003.00000002.2591871064.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.7:49706 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.PO#50124.exe.3ffe0a8.1.raw.unpack, oAKy.cs	.Net Code: CHgRvKS
Source: 0.2.PO#50124.exe.3fc3688.3.raw.unpack, oAKy.cs	.Net Code: CHgRvKS

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.PO#50124.exe.3fc3688.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.PO#50124.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO#50124.exe.3ffe0a8.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO#50124.exe.3ffe0a8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO#50124.exe.3fc3688.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

.NET source code contains very large array initializations

Source: 0.2.PO#50124.exe.2f9e330.0.raw.unpack, SQL.cs	Large array initialization: : array initializer size 33608
Source: 0.2.PO#50124.exe.5840000.5.raw.unpack, SQL.cs	Large array initialization: : array initializer size 33608

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: PO#50124.exe

Source: C:\Users\user\Desktop\PO#50124.exe	Code function: 0_2_07693450	0_2_07693450
Source: C:\Users\user\Desktop\PO#50124.exe	Code function: 3_2_0114A1A0	3_2_0114A1A0
Source: C:\Users\user\Desktop\PO#50124.exe	Code function: 3_2_0114E6B8	3_2_0114E6B8
Source: C:\Users\user\Desktop\PO#50124.exe	Code function: 3_2_0114A968	3_2_0114A968
Source: C:\Users\user\Desktop\PO#50124.exe	Code function: 3_2_01144AA0	3_2_01144AA0
Source: C:\Users\user\Desktop\PO#50124.exe	Code function: 3_2_0114DCC0	3_2_0114DCC0
Source: C:\Users\user\Desktop\PO#50124.exe	Code function: 3_2_01143E88	3_2_01143E88
Source: C:\Users\user\Desktop\PO#50124.exe	Code function: 3_2_011441D0	3_2_011441D0
Source: C:\Users\user\Desktop\PO#50124.exe	Code function: 3_2_068F5598	3_2_068F5598
Source: C:\Users\user\Desktop\PO#50124.exe	Code function: 3_2_068F65E8	3_2_068F65E8
Source: C:\Users\user\Desktop\PO#50124.exe	Code function: 3_2_068F7D78	3_2_068F7D78
Source: C:\Users\user\Desktop\PO#50124.exe	Code function: 3_2_068FB240	3_2_068FB240
Source: C:\Users\user\Desktop\PO#50124.exe	Code function: 3_2_068F2360	3_2_068F2360
Source: C:\Users\user\Desktop\PO#50124.exe	Code function: 3_2_068FC198	3_2_068FC198
Source: C:\Users\user\Desktop\PO#50124.exe	Code function: 3_2_068F7698	3_2_068F7698
Source: C:\Users\user\Desktop\PO#50124.exe	Code function: 3_2_068F5CE8	3_2_068F5CE8
Source: C:\Users\user\Desktop\PO#50124.exe	Code function: 3_2_068FE3B0	3_2_068FE3B0
Source: C:\Users\user\Desktop\PO#50124.exe	Code function: 3_2_068F0167	3_2_068F0167
Source: C:\Users\user\Desktop\PO#50124.exe	Code function: 3_2_068F0007	3_2_068F0007

Source: PO#50124.exe, 00000000.00000002.1386311517.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs PO#50124.exe
Source: PO#50124.exe, 00000000.00000002.1386811526.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename4548b61d-822f-464b-a714-a9778dc216a9.exe4 vs PO#50124.exe
Source: PO#50124.exe, 00000000.00000000.1332123937.0000000000AE6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameOXxu.exe< vs PO#50124.exe
Source: PO#50124.exe, 00000000.00000002.1386311517.000000000305E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename4548b61d-822f-464b-a714-a9778dc216a9.exe4 vs PO#50124.exe
Source: PO#50124.exe, 00000000.00000002.1385640207.00000000011AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PO#50124.exe
Source: PO#50124.exe, 00000000.00000002.1389708327.0000000005840000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs PO#50124.exe
Source: PO#50124.exe, 00000000.00000002.1386811526.0000000004936000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs PO#50124.exe
Source: PO#50124.exe, 00000000.00000002.1391217894.000000000B090000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs PO#50124.exe
Source: PO#50124.exe, 00000003.00000002.2589693632.0000000000CF8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs PO#50124.exe
Source: PO#50124.exe, 00000003.00000002.2589430439.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename4548b61d-822f-464b-a714-a9778dc216a9.exe4 vs PO#50124.exe
Source: PO#50124.exe	Binary or memory string: OriginalFilenameOXxu.exe< vs PO#50124.exe

Source: PO#50124.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.PO#50124.exe.3fc3688.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.PO#50124.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO#50124.exe.3ffe0a8.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO#50124.exe.3ffe0a8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO#50124.exe.3fc3688.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: PO#50124.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.PO#50124.exe.3ffe0a8.1.raw.unpack, ekKu0.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO#50124.exe.3ffe0a8.1.raw.unpack, vKf1z6NvS.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO#50124.exe.3ffe0a8.1.raw.unpack, ZNAvlD7qmXc.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.PO#50124.exe.3ffe0a8.1.raw.unpack, U2doU2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO#50124.exe.3ffe0a8.1.raw.unpack, BgffYko.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO#50124.exe.3ffe0a8.1.raw.unpack, HrTdA63.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.PO#50124.exe.3ffe0a8.1.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO#50124.exe.3ffe0a8.1.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO#50124.exe.3ffe0a8.1.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO#50124.exe.3ffe0a8.1.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.PO#50124.exe.4bb8d40.4.raw.unpack, VCS7wWF7FG29jK2qtE.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PO#50124.exe.4bb8d40.4.raw.unpack, VCS7wWF7FG29jK2qtE.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO#50124.exe.4bb8d40.4.raw.unpack, VCS7wWF7FG29jK2qtE.cs	Security API names: _0020.AddAccessRule
Source: 0.2.PO#50124.exe.4bb8d40.4.raw.unpack, MK1NMKAGNl9pwlKagZ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO#50124.exe.4b3cb20.2.raw.unpack, VCS7wWF7FG29jK2qtE.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PO#50124.exe.4b3cb20.2.raw.unpack, VCS7wWF7FG29jK2qtE.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO#50124.exe.4b3cb20.2.raw.unpack, VCS7wWF7FG29jK2qtE.cs	Security API names: _0020.AddAccessRule
Source: 0.2.PO#50124.exe.b090000.8.raw.unpack, MK1NMKAGNl9pwlKagZ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO#50124.exe.4b3cb20.2.raw.unpack, MK1NMKAGNl9pwlKagZ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO#50124.exe.b090000.8.raw.unpack, VCS7wWF7FG29jK2qtE.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PO#50124.exe.b090000.8.raw.unpack, VCS7wWF7FG29jK2qtE.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO#50124.exe.b090000.8.raw.unpack, VCS7wWF7FG29jK2qtE.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/2

Source: C:\Users\user\Desktop\PO#50124.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO#50124.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\PO#50124.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\PO#50124.exe	Mutant created: \Sessions\1\BaseNamedObjects\bsRSckSPTjZsUAV

Source: PO#50124.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PO#50124.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\PO#50124.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PO#50124.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PO#50124.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\PO#50124.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PO#50124.exe	ReversingLabs: Detection: 83%
Source: PO#50124.exe	Virustotal: Detection: 72%

Source: C:\Users\user\Desktop\PO#50124.exe

File read: C:\Users\user\Desktop\PO#50124.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PO#50124.exe "C:\Users\user\Desktop\PO#50124.exe"
Source: C:\Users\user\Desktop\PO#50124.exe	Process created: C:\Users\user\Desktop\PO#50124.exe "C:\Users\user\Desktop\PO#50124.exe"
Source: C:\Users\user\Desktop\PO#50124.exe	Process created: C:\Users\user\Desktop\PO#50124.exe "C:\Users\user\Desktop\PO#50124.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO#50124.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\PO#50124.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\PO#50124.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: PO#50124.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO#50124.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: PO#50124.exe, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO#50124.exe.4bb8d40.4.raw.unpack, VCS7wWF7FG29jK2qtE.cs	.Net Code: URjwyBgt09 System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO#50124.exe.4b3cb20.2.raw.unpack, VCS7wWF7FG29jK2qtE.cs	.Net Code: URjwyBgt09 System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO#50124.exe.2f9e330.0.raw.unpack, SQL.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO#50124.exe.5840000.5.raw.unpack, SQL.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO#50124.exe.b090000.8.raw.unpack, VCS7wWF7FG29jK2qtE.cs	.Net Code: URjwyBgt09 System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\PO#50124.exe	Code function: 0_2_013A0DBB pushfd ; iretd	0_2_013A0DE9
Source: C:\Users\user\Desktop\PO#50124.exe	Code function: 0_2_013A0DEB pushfd ; iretd	0_2_013A0DE9
Source: C:\Users\user\Desktop\PO#50124.exe	Code function: 3_2_01140C95 push edi; retf	3_2_01140C3A
Source: C:\Users\user\Desktop\PO#50124.exe	Code function: 3_2_01140CB5 push edi; ret	3_2_01140CC2

Source: PO#50124.exe

Static PE information: section name: .text entropy: 7.96596968808791

Source: 0.2.PO#50124.exe.4bb8d40.4.raw.unpack, MK1NMKAGNl9pwlKagZ.cs	High entropy of concatenated method names: 'asWQKYqjBU', 'L1iQ2Ctfpp', 'qhyQtFWF68', 'tOeQJSwt24', 'vM1QfQlbc9', 'Q7QQU7VBWa', 'GuSQHmAsEH', 'xolQumJseL', 'Eh2Q4yAafr', 'GUrQmCOdOg'
Source: 0.2.PO#50124.exe.4bb8d40.4.raw.unpack, dUaCTtl9IEdle8IdlH.cs	High entropy of concatenated method names: 'IAIpEb2YGK', 'jdyp5ekB1W', 'DPypAEToxQ', 'lxtplsG3WQ', 'zfnp0AwfKJ', 'noCpRAx88x', 'ScBpjrg1Hu', 'x5NpBlRXTH', 'AVPpnvOKRj', 'os7pv3qihK'
Source: 0.2.PO#50124.exe.4bb8d40.4.raw.unpack, qfJ6lFtPkHUWK2Yy8d.cs	High entropy of concatenated method names: 'ToString', 'Xs4RgJUxWX', 'mWARrPZkYP', 'MavRkYGrEI', 'PpARLcSHpv', 'OPtRX6DHmi', 'ldkR8dfoZQ', 'KrRRxAfpHw', 'fvpRdAFuAu', 'RtZR9jADra'
Source: 0.2.PO#50124.exe.4bb8d40.4.raw.unpack, DSMMmsmWahJCyHGHY6.cs	High entropy of concatenated method names: 'FS7nWpdK7Q', 'M0jn7wHhZZ', 'XKenw2gGTw', 'NB6n3iExaI', 'oqTnQsnuCi', 'MmtnoWJFSF', 'JCWnYq4QbY', 'EsUBH5ALbG', 'XY5BumUVIS', 'TtCB4QsJWl'
Source: 0.2.PO#50124.exe.4bb8d40.4.raw.unpack, nPXBYBQq0I78xUWaQl.cs	High entropy of concatenated method names: 'Dispose', 'eSkW4Jt665', 'KPKDrRoXrn', 'JDBVVAyBfO', 'i25WmcagEt', 'uQoWzvhH6V', 'ProcessDialogKey', 'lnRDPpnmYt', 'tlhDW6wNwN', 'pN4DDASMMm'
Source: 0.2.PO#50124.exe.4bb8d40.4.raw.unpack, UYH9ZJzGujToqdEPB4.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'WglnC6m30K', 'dDtn0iDR2W', 'S8ZnRYmbSr', 'zYFnjXEGpe', 'sRlnBHkVtI', 'ANCnnMClBP', 'RNCnv4wsY5'
Source: 0.2.PO#50124.exe.4bb8d40.4.raw.unpack, Q73CAQW7OaD9TYA61PB.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LEYvK6IBSq', 'ux3v28fMiK', 'HO4vtA2Syf', 'KygvJBefum', 'J3uvf0PPgR', 'BW8vUQPM1V', 'z9wvHAh2BM'
Source: 0.2.PO#50124.exe.4bb8d40.4.raw.unpack, ppnmYt4Glh6wNwNRN4.cs	High entropy of concatenated method names: 'nCyBSg0ZRf', 'cmUBr6ou32', 'qpZBk2xbEn', 'QZIBL9YqWO', 'yorBKvryNO', 'MjsBXsj6Ma', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO#50124.exe.4bb8d40.4.raw.unpack, bI6ysyiUVXuKRuriOs.cs	High entropy of concatenated method names: 'HHJocu7ESs', 'ncxoqWO6un', 'EuOpksxvlE', 'uO1pLqfyK9', 'L5bpXDVsoa', 'OQTp8bRwqF', 'LyrpxlKC12', 'O3npdsjRdD', 'crJp9fqqWs', 'bZDpOU3PFe'
Source: 0.2.PO#50124.exe.4bb8d40.4.raw.unpack, alPQQUwB4FteeuoGrn.cs	High entropy of concatenated method names: 'Qu9WhK1NMK', 'tNlWF9pwlK', 'T9IWbEdle8', 'PdlWZHWI6y', 'XriW0OsAsR', 'YJ3WRkeAe2', 'rKfySWPQPvsdib5SiM', 'Yv92PxjuCY2OR49H3x', 'wR9WW0PLdy', 'SLwW7EwKnM'
Source: 0.2.PO#50124.exe.4bb8d40.4.raw.unpack, DsRmJ3SkeAe2VEDheA.cs	High entropy of concatenated method names: 'bwgYs11tOp', 'Hj5YQwDbdt', 'dVQYo2VnGw', 'vE2Yhmyedo', 'OmSYFbxqZB', 'I1Lofvo4QZ', 'RafoUbl5KG', 'hhboHtw2EI', 'kTNou8ZJCi', 'h4Ho4T8QHx'
Source: 0.2.PO#50124.exe.4bb8d40.4.raw.unpack, WW06WiWPoas24VvQ4nC.cs	High entropy of concatenated method names: 'wdBnNqU6Bj', 'ajUnTuV2qd', 'oSGnyOB5Cb', 'HeGnEIG7e1', 'mqanc79kTD', 'abcn50baOl', 'WYynqGMDoF', 'TvqnAtSgnV', 'GR9nlevw9C', 'brOniD8IYX'
Source: 0.2.PO#50124.exe.4bb8d40.4.raw.unpack, S5cagEut1QovhH6Ven.cs	High entropy of concatenated method names: 'cFcB3yjCP2', 'xv7BQdqx9h', 'kJFBpl6Gu6', 'FWjBokuE6E', 'OvCBYrkPDK', 'tcZBhsQ2Ga', 'O1qBFqcRlA', 'db8BePSvXB', 'LPXBb95hON', 'lTjBZlKoYT'
Source: 0.2.PO#50124.exe.4bb8d40.4.raw.unpack, PUlYy19abffV21uSgs.cs	High entropy of concatenated method names: 'zQIhNg61HW', 'LYUhTYvlpe', 'WAAhyMaYa3', 'yRihEvY4yk', 'YZUhcZ7exu', 'fV2h5DJWiA', 'QfRhqh0VKB', 'Fv7hA2XksP', 'X2JhltMyrP', 'TdEhiiudeG'
Source: 0.2.PO#50124.exe.4bb8d40.4.raw.unpack, mDdL3pDf3G7VcFOu0c.cs	High entropy of concatenated method names: 'sVDyAo1dT', 'zx5E3qJd4', 'VfW5vKXAw', 'U6UqvlmW6', 'VZRltA2yT', 'o6LiHbfta', 'mkpdoNI2yU51DqOvuy', 'Swex7BkQXQSgm8Y0ye', 'eOqB4Hlyc', 'rPqv2fPtj'
Source: 0.2.PO#50124.exe.4bb8d40.4.raw.unpack, VCS7wWF7FG29jK2qtE.cs	High entropy of concatenated method names: 'J3A7swe7NR', 'QaX73JDXRh', 'DlX7QRJXHj', 'Q937pj3BcD', 'LCY7oa0g8t', 'JR87YRUW25', 'nik7hJTEOr', 'csB7Fn9rLW', 'Oeb7e7xWPW', 'VPg7bC4EyE'
Source: 0.2.PO#50124.exe.4bb8d40.4.raw.unpack, cyiT3gUbZ9FoLA7vcZ.cs	High entropy of concatenated method names: 'M1Lju1VTj7', 'd6Fjm2hxK2', 'SbaBPaIQ6x', 'lZDBWM9GAV', 'CP3jgbetKR', 'KwijILnoMc', 'lK8jMOtJTG', 'z1vjKOMkFP', 'XT7j2shXxK', 'Sb8jth4KWU'
Source: 0.2.PO#50124.exe.4bb8d40.4.raw.unpack, F4ZVrRM1moHK5ZDjGD.cs	High entropy of concatenated method names: 'XrwCAm1y5L', 'OLvCl6vxHq', 'p3aCS04PBi', 'QesCrTQqMk', 'gOaCLEJdCi', 'zcHCX8b1eb', 'bA9CxyiQI4', 'mMgCddMm9a', 'OGOCOIFW2t', 'oJfCgukbtG'
Source: 0.2.PO#50124.exe.4b3cb20.2.raw.unpack, MK1NMKAGNl9pwlKagZ.cs	High entropy of concatenated method names: 'asWQKYqjBU', 'L1iQ2Ctfpp', 'qhyQtFWF68', 'tOeQJSwt24', 'vM1QfQlbc9', 'Q7QQU7VBWa', 'GuSQHmAsEH', 'xolQumJseL', 'Eh2Q4yAafr', 'GUrQmCOdOg'
Source: 0.2.PO#50124.exe.4b3cb20.2.raw.unpack, dUaCTtl9IEdle8IdlH.cs	High entropy of concatenated method names: 'IAIpEb2YGK', 'jdyp5ekB1W', 'DPypAEToxQ', 'lxtplsG3WQ', 'zfnp0AwfKJ', 'noCpRAx88x', 'ScBpjrg1Hu', 'x5NpBlRXTH', 'AVPpnvOKRj', 'os7pv3qihK'
Source: 0.2.PO#50124.exe.4b3cb20.2.raw.unpack, qfJ6lFtPkHUWK2Yy8d.cs	High entropy of concatenated method names: 'ToString', 'Xs4RgJUxWX', 'mWARrPZkYP', 'MavRkYGrEI', 'PpARLcSHpv', 'OPtRX6DHmi', 'ldkR8dfoZQ', 'KrRRxAfpHw', 'fvpRdAFuAu', 'RtZR9jADra'
Source: 0.2.PO#50124.exe.4b3cb20.2.raw.unpack, DSMMmsmWahJCyHGHY6.cs	High entropy of concatenated method names: 'FS7nWpdK7Q', 'M0jn7wHhZZ', 'XKenw2gGTw', 'NB6n3iExaI', 'oqTnQsnuCi', 'MmtnoWJFSF', 'JCWnYq4QbY', 'EsUBH5ALbG', 'XY5BumUVIS', 'TtCB4QsJWl'
Source: 0.2.PO#50124.exe.4b3cb20.2.raw.unpack, nPXBYBQq0I78xUWaQl.cs	High entropy of concatenated method names: 'Dispose', 'eSkW4Jt665', 'KPKDrRoXrn', 'JDBVVAyBfO', 'i25WmcagEt', 'uQoWzvhH6V', 'ProcessDialogKey', 'lnRDPpnmYt', 'tlhDW6wNwN', 'pN4DDASMMm'
Source: 0.2.PO#50124.exe.4b3cb20.2.raw.unpack, UYH9ZJzGujToqdEPB4.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'WglnC6m30K', 'dDtn0iDR2W', 'S8ZnRYmbSr', 'zYFnjXEGpe', 'sRlnBHkVtI', 'ANCnnMClBP', 'RNCnv4wsY5'
Source: 0.2.PO#50124.exe.4b3cb20.2.raw.unpack, Q73CAQW7OaD9TYA61PB.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LEYvK6IBSq', 'ux3v28fMiK', 'HO4vtA2Syf', 'KygvJBefum', 'J3uvf0PPgR', 'BW8vUQPM1V', 'z9wvHAh2BM'
Source: 0.2.PO#50124.exe.4b3cb20.2.raw.unpack, ppnmYt4Glh6wNwNRN4.cs	High entropy of concatenated method names: 'nCyBSg0ZRf', 'cmUBr6ou32', 'qpZBk2xbEn', 'QZIBL9YqWO', 'yorBKvryNO', 'MjsBXsj6Ma', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO#50124.exe.4b3cb20.2.raw.unpack, bI6ysyiUVXuKRuriOs.cs	High entropy of concatenated method names: 'HHJocu7ESs', 'ncxoqWO6un', 'EuOpksxvlE', 'uO1pLqfyK9', 'L5bpXDVsoa', 'OQTp8bRwqF', 'LyrpxlKC12', 'O3npdsjRdD', 'crJp9fqqWs', 'bZDpOU3PFe'
Source: 0.2.PO#50124.exe.4b3cb20.2.raw.unpack, alPQQUwB4FteeuoGrn.cs	High entropy of concatenated method names: 'Qu9WhK1NMK', 'tNlWF9pwlK', 'T9IWbEdle8', 'PdlWZHWI6y', 'XriW0OsAsR', 'YJ3WRkeAe2', 'rKfySWPQPvsdib5SiM', 'Yv92PxjuCY2OR49H3x', 'wR9WW0PLdy', 'SLwW7EwKnM'
Source: 0.2.PO#50124.exe.4b3cb20.2.raw.unpack, DsRmJ3SkeAe2VEDheA.cs	High entropy of concatenated method names: 'bwgYs11tOp', 'Hj5YQwDbdt', 'dVQYo2VnGw', 'vE2Yhmyedo', 'OmSYFbxqZB', 'I1Lofvo4QZ', 'RafoUbl5KG', 'hhboHtw2EI', 'kTNou8ZJCi', 'h4Ho4T8QHx'
Source: 0.2.PO#50124.exe.4b3cb20.2.raw.unpack, WW06WiWPoas24VvQ4nC.cs	High entropy of concatenated method names: 'wdBnNqU6Bj', 'ajUnTuV2qd', 'oSGnyOB5Cb', 'HeGnEIG7e1', 'mqanc79kTD', 'abcn50baOl', 'WYynqGMDoF', 'TvqnAtSgnV', 'GR9nlevw9C', 'brOniD8IYX'
Source: 0.2.PO#50124.exe.4b3cb20.2.raw.unpack, S5cagEut1QovhH6Ven.cs	High entropy of concatenated method names: 'cFcB3yjCP2', 'xv7BQdqx9h', 'kJFBpl6Gu6', 'FWjBokuE6E', 'OvCBYrkPDK', 'tcZBhsQ2Ga', 'O1qBFqcRlA', 'db8BePSvXB', 'LPXBb95hON', 'lTjBZlKoYT'
Source: 0.2.PO#50124.exe.4b3cb20.2.raw.unpack, PUlYy19abffV21uSgs.cs	High entropy of concatenated method names: 'zQIhNg61HW', 'LYUhTYvlpe', 'WAAhyMaYa3', 'yRihEvY4yk', 'YZUhcZ7exu', 'fV2h5DJWiA', 'QfRhqh0VKB', 'Fv7hA2XksP', 'X2JhltMyrP', 'TdEhiiudeG'
Source: 0.2.PO#50124.exe.4b3cb20.2.raw.unpack, mDdL3pDf3G7VcFOu0c.cs	High entropy of concatenated method names: 'sVDyAo1dT', 'zx5E3qJd4', 'VfW5vKXAw', 'U6UqvlmW6', 'VZRltA2yT', 'o6LiHbfta', 'mkpdoNI2yU51DqOvuy', 'Swex7BkQXQSgm8Y0ye', 'eOqB4Hlyc', 'rPqv2fPtj'
Source: 0.2.PO#50124.exe.4b3cb20.2.raw.unpack, VCS7wWF7FG29jK2qtE.cs	High entropy of concatenated method names: 'J3A7swe7NR', 'QaX73JDXRh', 'DlX7QRJXHj', 'Q937pj3BcD', 'LCY7oa0g8t', 'JR87YRUW25', 'nik7hJTEOr', 'csB7Fn9rLW', 'Oeb7e7xWPW', 'VPg7bC4EyE'
Source: 0.2.PO#50124.exe.4b3cb20.2.raw.unpack, cyiT3gUbZ9FoLA7vcZ.cs	High entropy of concatenated method names: 'M1Lju1VTj7', 'd6Fjm2hxK2', 'SbaBPaIQ6x', 'lZDBWM9GAV', 'CP3jgbetKR', 'KwijILnoMc', 'lK8jMOtJTG', 'z1vjKOMkFP', 'XT7j2shXxK', 'Sb8jth4KWU'
Source: 0.2.PO#50124.exe.4b3cb20.2.raw.unpack, F4ZVrRM1moHK5ZDjGD.cs	High entropy of concatenated method names: 'XrwCAm1y5L', 'OLvCl6vxHq', 'p3aCS04PBi', 'QesCrTQqMk', 'gOaCLEJdCi', 'zcHCX8b1eb', 'bA9CxyiQI4', 'mMgCddMm9a', 'OGOCOIFW2t', 'oJfCgukbtG'
Source: 0.2.PO#50124.exe.b090000.8.raw.unpack, MK1NMKAGNl9pwlKagZ.cs	High entropy of concatenated method names: 'asWQKYqjBU', 'L1iQ2Ctfpp', 'qhyQtFWF68', 'tOeQJSwt24', 'vM1QfQlbc9', 'Q7QQU7VBWa', 'GuSQHmAsEH', 'xolQumJseL', 'Eh2Q4yAafr', 'GUrQmCOdOg'
Source: 0.2.PO#50124.exe.b090000.8.raw.unpack, dUaCTtl9IEdle8IdlH.cs	High entropy of concatenated method names: 'IAIpEb2YGK', 'jdyp5ekB1W', 'DPypAEToxQ', 'lxtplsG3WQ', 'zfnp0AwfKJ', 'noCpRAx88x', 'ScBpjrg1Hu', 'x5NpBlRXTH', 'AVPpnvOKRj', 'os7pv3qihK'
Source: 0.2.PO#50124.exe.b090000.8.raw.unpack, qfJ6lFtPkHUWK2Yy8d.cs	High entropy of concatenated method names: 'ToString', 'Xs4RgJUxWX', 'mWARrPZkYP', 'MavRkYGrEI', 'PpARLcSHpv', 'OPtRX6DHmi', 'ldkR8dfoZQ', 'KrRRxAfpHw', 'fvpRdAFuAu', 'RtZR9jADra'
Source: 0.2.PO#50124.exe.b090000.8.raw.unpack, DSMMmsmWahJCyHGHY6.cs	High entropy of concatenated method names: 'FS7nWpdK7Q', 'M0jn7wHhZZ', 'XKenw2gGTw', 'NB6n3iExaI', 'oqTnQsnuCi', 'MmtnoWJFSF', 'JCWnYq4QbY', 'EsUBH5ALbG', 'XY5BumUVIS', 'TtCB4QsJWl'
Source: 0.2.PO#50124.exe.b090000.8.raw.unpack, nPXBYBQq0I78xUWaQl.cs	High entropy of concatenated method names: 'Dispose', 'eSkW4Jt665', 'KPKDrRoXrn', 'JDBVVAyBfO', 'i25WmcagEt', 'uQoWzvhH6V', 'ProcessDialogKey', 'lnRDPpnmYt', 'tlhDW6wNwN', 'pN4DDASMMm'
Source: 0.2.PO#50124.exe.b090000.8.raw.unpack, UYH9ZJzGujToqdEPB4.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'WglnC6m30K', 'dDtn0iDR2W', 'S8ZnRYmbSr', 'zYFnjXEGpe', 'sRlnBHkVtI', 'ANCnnMClBP', 'RNCnv4wsY5'
Source: 0.2.PO#50124.exe.b090000.8.raw.unpack, Q73CAQW7OaD9TYA61PB.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LEYvK6IBSq', 'ux3v28fMiK', 'HO4vtA2Syf', 'KygvJBefum', 'J3uvf0PPgR', 'BW8vUQPM1V', 'z9wvHAh2BM'
Source: 0.2.PO#50124.exe.b090000.8.raw.unpack, ppnmYt4Glh6wNwNRN4.cs	High entropy of concatenated method names: 'nCyBSg0ZRf', 'cmUBr6ou32', 'qpZBk2xbEn', 'QZIBL9YqWO', 'yorBKvryNO', 'MjsBXsj6Ma', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO#50124.exe.b090000.8.raw.unpack, bI6ysyiUVXuKRuriOs.cs	High entropy of concatenated method names: 'HHJocu7ESs', 'ncxoqWO6un', 'EuOpksxvlE', 'uO1pLqfyK9', 'L5bpXDVsoa', 'OQTp8bRwqF', 'LyrpxlKC12', 'O3npdsjRdD', 'crJp9fqqWs', 'bZDpOU3PFe'
Source: 0.2.PO#50124.exe.b090000.8.raw.unpack, alPQQUwB4FteeuoGrn.cs	High entropy of concatenated method names: 'Qu9WhK1NMK', 'tNlWF9pwlK', 'T9IWbEdle8', 'PdlWZHWI6y', 'XriW0OsAsR', 'YJ3WRkeAe2', 'rKfySWPQPvsdib5SiM', 'Yv92PxjuCY2OR49H3x', 'wR9WW0PLdy', 'SLwW7EwKnM'
Source: 0.2.PO#50124.exe.b090000.8.raw.unpack, DsRmJ3SkeAe2VEDheA.cs	High entropy of concatenated method names: 'bwgYs11tOp', 'Hj5YQwDbdt', 'dVQYo2VnGw', 'vE2Yhmyedo', 'OmSYFbxqZB', 'I1Lofvo4QZ', 'RafoUbl5KG', 'hhboHtw2EI', 'kTNou8ZJCi', 'h4Ho4T8QHx'
Source: 0.2.PO#50124.exe.b090000.8.raw.unpack, WW06WiWPoas24VvQ4nC.cs	High entropy of concatenated method names: 'wdBnNqU6Bj', 'ajUnTuV2qd', 'oSGnyOB5Cb', 'HeGnEIG7e1', 'mqanc79kTD', 'abcn50baOl', 'WYynqGMDoF', 'TvqnAtSgnV', 'GR9nlevw9C', 'brOniD8IYX'
Source: 0.2.PO#50124.exe.b090000.8.raw.unpack, S5cagEut1QovhH6Ven.cs	High entropy of concatenated method names: 'cFcB3yjCP2', 'xv7BQdqx9h', 'kJFBpl6Gu6', 'FWjBokuE6E', 'OvCBYrkPDK', 'tcZBhsQ2Ga', 'O1qBFqcRlA', 'db8BePSvXB', 'LPXBb95hON', 'lTjBZlKoYT'
Source: 0.2.PO#50124.exe.b090000.8.raw.unpack, PUlYy19abffV21uSgs.cs	High entropy of concatenated method names: 'zQIhNg61HW', 'LYUhTYvlpe', 'WAAhyMaYa3', 'yRihEvY4yk', 'YZUhcZ7exu', 'fV2h5DJWiA', 'QfRhqh0VKB', 'Fv7hA2XksP', 'X2JhltMyrP', 'TdEhiiudeG'
Source: 0.2.PO#50124.exe.b090000.8.raw.unpack, mDdL3pDf3G7VcFOu0c.cs	High entropy of concatenated method names: 'sVDyAo1dT', 'zx5E3qJd4', 'VfW5vKXAw', 'U6UqvlmW6', 'VZRltA2yT', 'o6LiHbfta', 'mkpdoNI2yU51DqOvuy', 'Swex7BkQXQSgm8Y0ye', 'eOqB4Hlyc', 'rPqv2fPtj'
Source: 0.2.PO#50124.exe.b090000.8.raw.unpack, VCS7wWF7FG29jK2qtE.cs	High entropy of concatenated method names: 'J3A7swe7NR', 'QaX73JDXRh', 'DlX7QRJXHj', 'Q937pj3BcD', 'LCY7oa0g8t', 'JR87YRUW25', 'nik7hJTEOr', 'csB7Fn9rLW', 'Oeb7e7xWPW', 'VPg7bC4EyE'
Source: 0.2.PO#50124.exe.b090000.8.raw.unpack, cyiT3gUbZ9FoLA7vcZ.cs	High entropy of concatenated method names: 'M1Lju1VTj7', 'd6Fjm2hxK2', 'SbaBPaIQ6x', 'lZDBWM9GAV', 'CP3jgbetKR', 'KwijILnoMc', 'lK8jMOtJTG', 'z1vjKOMkFP', 'XT7j2shXxK', 'Sb8jth4KWU'
Source: 0.2.PO#50124.exe.b090000.8.raw.unpack, F4ZVrRM1moHK5ZDjGD.cs	High entropy of concatenated method names: 'XrwCAm1y5L', 'OLvCl6vxHq', 'p3aCS04PBi', 'QesCrTQqMk', 'gOaCLEJdCi', 'zcHCX8b1eb', 'bA9CxyiQI4', 'mMgCddMm9a', 'OGOCOIFW2t', 'oJfCgukbtG'

Source: C:\Users\user\Desktop\PO#50124.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\PO#50124.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\PO#50124.exe	Memory allocated: 1160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Memory allocated: 2F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Memory allocated: 14D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Memory allocated: 8C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Memory allocated: 7310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Memory allocated: 9C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Memory allocated: AC30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Memory allocated: B110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Memory allocated: 8C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Memory allocated: 1140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Memory allocated: 2CA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Memory allocated: 4CA0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\PO#50124.exe	Window / User API: threadDelayed 8248			Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Window / User API: threadDelayed 1574			Jump to behavior

Source: C:\Users\user\Desktop\PO#50124.exe TID: 4636	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7416	Thread sleep count: 8248 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -99891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7416	Thread sleep count: 1574 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -99672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -99563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -99452s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -99344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -99235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -99110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -98985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -98860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -98735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -98610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -98485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -98360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -98235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -98110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -97985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -97860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -97735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -97610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -97485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -97360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -97235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -97110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -96985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -96860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -96735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -96610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -96485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -96360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -96235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -96110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -95985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -95860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -95735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -95610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -95485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -95360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -95235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -95110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -94985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -94860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -94735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -94610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -94485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -94360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -94235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -94110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe TID: 7400	Thread sleep time: -93985s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\PO#50124.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\PO#50124.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PO#50124.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 99891	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 99563	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 99452	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 99344	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 99235	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 99110	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 98985	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 98860	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 98735	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 98610	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 98485	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 98360	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 98235	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 98110	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 97985	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 97860	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 97735	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 97610	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 97485	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 97360	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 97235	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 97110	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 96985	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 96860	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 96735	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 96610	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 96485	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 96360	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 96235	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 96110	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 95985	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 95860	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 95735	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 95610	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 95485	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 95360	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 95235	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 95110	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 94985	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 94860	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 94735	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 94610	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 94485	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 94360	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 94235	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 94110	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Thread delayed: delay time: 93985	Jump to behavior

Source: PO#50124.exe, 00000003.00000002.2590375532.0000000000F99000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\PO#50124.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PO#50124.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\PO#50124.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\PO#50124.exe

Process created: C:\Users\user\Desktop\PO#50124.exe "C:\Users\user\Desktop\PO#50124.exe"

Jump to behavior

Source: C:\Users\user\Desktop\PO#50124.exe	Queries volume information: C:\Users\user\Desktop\PO#50124.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Queries volume information: C:\Users\user\Desktop\PO#50124.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PO#50124.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.PO#50124.exe.3fc3688.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.PO#50124.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#50124.exe.3ffe0a8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#50124.exe.3ffe0a8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#50124.exe.3fc3688.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2591871064.0000000002D1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2591871064.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2589430439.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1386811526.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO#50124.exe PID: 7072, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO#50124.exe PID: 7252, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\PO#50124.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\PO#50124.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\PO#50124.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\PO#50124.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\PO#50124.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.PO#50124.exe.3fc3688.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.PO#50124.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#50124.exe.3ffe0a8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#50124.exe.3ffe0a8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#50124.exe.3fc3688.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2591871064.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2589430439.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1386811526.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO#50124.exe PID: 7072, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO#50124.exe PID: 7252, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.PO#50124.exe.3fc3688.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.PO#50124.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#50124.exe.3ffe0a8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#50124.exe.3ffe0a8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#50124.exe.3fc3688.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2591871064.0000000002D1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2591871064.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2589430439.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1386811526.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO#50124.exe PID: 7072, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO#50124.exe PID: 7252, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	111 Security Software Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO#50124.exe	83%	ReversingLabs	Win32.Trojan.Leonem
PO#50124.exe	72%	Virustotal		Browse
PO#50124.exe	100%	Avira	HEUR/AGEN.1309974
PO#50124.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
mail.alkuwaiti.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://mail.alkuwaiti.com	0%	Avira URL Cloud	safe
http://mail.alkuwaiti.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.alkuwaiti.com	50.87.219.149	true	true	0%, Virustotal, Browse	unknown
api.ipify.org	104.26.13.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mail.alkuwaiti.com	PO#50124.exe, 00000003.00000002.2591871064.0000000002D1C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://r3.o.lencr.org0	PO#50124.exe, 00000003.00000002.2590375532.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, PO#50124.exe, 00000003.00000002.2591871064.0000000002D24000.00000004.00000800.00020000.00000000.sdmp, PO#50124.exe, 00000003.00000002.2589940978.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org	PO#50124.exe, 00000000.00000002.1386811526.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp, PO#50124.exe, 00000003.00000002.2591871064.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, PO#50124.exe, 00000003.00000002.2589430439.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://account.dyn.com/	PO#50124.exe, 00000000.00000002.1386811526.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp, PO#50124.exe, 00000003.00000002.2589430439.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.ipify.org/t	PO#50124.exe, 00000003.00000002.2591871064.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PO#50124.exe, 00000003.00000002.2591871064.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	PO#50124.exe, 00000003.00000002.2590375532.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, PO#50124.exe, 00000003.00000002.2591871064.0000000002D24000.00000004.00000800.00020000.00000000.sdmp, PO#50124.exe, 00000003.00000002.2590375532.0000000000F99000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	PO#50124.exe, 00000003.00000002.2590375532.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, PO#50124.exe, 00000003.00000002.2591871064.0000000002D24000.00000004.00000800.00020000.00000000.sdmp, PO#50124.exe, 00000003.00000002.2590375532.0000000000F99000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r3.i.lencr.org/0	PO#50124.exe, 00000003.00000002.2590375532.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, PO#50124.exe, 00000003.00000002.2591871064.0000000002D24000.00000004.00000800.00020000.00000000.sdmp, PO#50124.exe, 00000003.00000002.2589940978.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
50.87.219.149	mail.alkuwaiti.com	United States		46606	UNIFIEDLAYER-AS-1US	true
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432053
Start date and time:	2024-04-26 11:08:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO#50124.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 84 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:09:18	API Interceptor	65x Sleep call for process: PO#50124.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
50.87.219.149	Ziraat Swift Bildirimi.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.hyperfocusmasterclass.com/gg58/?f0=BXeHzp&3f=5Ix8alVOa82T/DZIfBhrjeSKtZ641IDQQHgZKH1ZvtSurMdm0kyXcXMOnWQHCxpuENZh
50.87.219.149	Ziraat Swift Bildirimi.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.hyperfocusmasterclass.com/gg58/?RZwp=5Ix8alVOa82T/DZIfBhrjeSKtZ641IDQQHgZKH1ZvtSurMdm0kyXcXMOnWQHCxpuENZh&2d6tXz=j8vX
104.26.13.205	SecuriteInfo.com.Trojan.DownLoaderNET.960.9931.28151.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	ArenaWarSetup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.RATX-gen.31127.4101.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.alkuwaiti.com	SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe	Get hash	malicious	AgentTesla	Browse	50.87.219.149
	Bank slip.exe	Get hash	malicious	AgentTesla	Browse	50.87.219.149
	PO#240.exe	Get hash	malicious	AgentTesla	Browse	50.87.219.149
	Shipping Docs.exe	Get hash	malicious	AgentTesla	Browse	50.87.219.149
	SecuriteInfo.com.W32.MSIL_Kryptik.DWR.gen.Eldorado.6551.17723.exe	Get hash	malicious	AgentTesla	Browse	50.87.219.149
api.ipify.org	Statement of Account PDF.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	CHEMICAL SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Payment.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SOA FOR APR 2024 PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	Payment Swift.doc	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://lide.alosalca.fun/highbox#joeblow@xyz.com	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	http://asana.wf	Get hash	malicious	Unknown	Browse	172.67.74.152
	o3KyzpE7F4.ps1	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	http://wsj.pm	Get hash	malicious	NetSupport RAT	Browse	104.26.12.205
	16770075581.zip	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIFIEDLAYER-AS-1US	http://www.tbmuae.com/	Get hash	malicious	GRQ Scam	Browse	198.57.149.230
	Statement of Account PDF.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.195.61
	Quotation Order.exe	Get hash	malicious	AgentTesla	Browse	192.254.225.166
	DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.253.239
	CHEMICAL SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse	192.254.225.136
	SOA FOR APR 2024 PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.195.61
	INQ No. HDPE-16-GM-00- PI-INQ-3001.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	162.240.81.18
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse	192.232.216.145
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse	192.232.216.145
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse	192.232.216.145
CLOUDFLARENETUS	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	https://deebmpapst.ordineproposal.top/	Get hash	malicious	Unknown	Browse	104.17.2.184
	Statement of Account PDF.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	https://powerpointmicrosoftoffice.top/	Get hash	malicious	Unknown	Browse	104.17.3.184
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:d35aec95-f365-414c-8371-68e6d7d2ec41	Get hash	malicious	Unknown	Browse	104.17.28.92
	150-425-2024.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	CHEMICAL SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Payment.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://usigroups-my.sharepoint.com/:o:/p/js/Es3HdUJZlbVJngCJE-Z7JCYBUTZvd1ZCMQwZhhlQoy_hDw?e=mT2aQm	Get hash	malicious	HTMLPhisher	Browse	172.67.144.70
	SOA FOR APR 2024 PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Statement of Account PDF.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	CHEMICAL SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Payment.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	SOA FOR APR 2024 PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	DHL_ES567436735845755676678877988975877.vbs	Get hash	malicious	FormBook, GuLoader, Remcos	Browse	104.26.13.205
	PO-inv-CQV20(92315).exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	a.cmd	Get hash	malicious	Unknown	Browse	104.26.13.205
	http://papajoeschicago.com	Get hash	malicious	Unknown	Browse	104.26.13.205
	https://www.bing.com/ck/a?!&&p=8c604c2d3901cb1eJmltdHM9MTcxMjc5MzYwMCZpZ3VpZD0wODdjNjgyYy00N2ZlLTYyOGQtMzA1ZC03YmVmNDY5NTYzNjUmaW5zaWQ9NTE2MQ&ptn=3&ver=2&hsh=3&fclid=087c682c-47fe-628d-305d-7bef46956365&u=a1aHR0cHM6Ly9rZWljb3NlY3VyaXR5LmNvbS5teC8&ntb=1	Get hash	malicious	Unknown	Browse	104.26.13.205
	o3KyzpE7F4.ps1	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205

Process:	C:\Users\user\Desktop\PO#50124.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2056
Entropy (8bit):	5.342567089024067
Encrypted:	false
SSDEEP:	48:MxHKlYHKh3ouHgJHreylEHMHKo/tHo6hAHKzeRHKx1qHKHxvj:iqlYqh3ou0aymsqwtI6eqzqqxwqRb
MD5:	83A6E29FD802325CCCB720870B60C618
SHA1:	4CD8AC6CA2659E4E32D1B27A8A4E77ABF980EE43
SHA-256:	A81A5B984180553C06E7C9CAE0BAF7E195950801F493996F48FA59F1ACC135B2
SHA-512:	69CC81145ACCA3D5C154D3A11396C2AFAEC4135662A82124EA249817BE7066D782DE2C79FE985E23F32F9709C144E2C513C727CFD1A88D677F34EB25E868B560
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\4d760e3e4675c4a4c66b64205fb0d001\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\17470ef0c7a174f38bdcadacc3e310ad\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.928711808007621
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	PO#50124.exe
File size:	684'032 bytes
MD5:	b4306234a3b45c69df6a6a7cecd6070c
SHA1:	323197c988bc794e3a6314fce81dc20c48d234ee
SHA256:	13129eaaaee8200a17214e947f0e984d10050e79c2cd5a963d7ada54ce3aa0a8
SHA512:	a30bd4b6365ced8bf53fd6f57c0e30896bdea733305c2c51bd4e63f7c3451a12b64e85cd16c292a02cae6ae2083532ec72ff5151dfed7aa708279aa259cefe16
SSDEEP:	12288:cHgnFyHgP/NbIyeSPqBFAbCS2m+2hTMRZuEAFgzknK7N8VJqaW:c+yHs/Nt8BUCmZhTGZuBFKR8V
TLSH:	15E423B5323D8127C92C9BB91160D8E203F6D1492A82E3DC2D6765FD3BDB7028F12697
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............0..0...0......v@... ...`....@.. ....................................@................................

File Icon


Icon Hash:	0f235999b9792317

Static PE Info

General

Entrypoint:	0x4a4076
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x661FE895 [Wed Apr 17 15:19:49 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
aaa
dec eax
inc edi
inc edx
inc esi
inc ebx
add byte ptr [eax], al
cmp byte ptr [eax], dh
cmp byte ptr [48383441h], dh
dec eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+34h], dl
push edi
push ebx
push edx
inc esi
xor eax, 0012C000h
add byte ptr [eax+00000025h], al
dec ebx
add byte ptr [eax], al
add byte ptr [esi-1F000000h], dl
add byte ptr [eax], al
add dl, al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa4024	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa6000	0x1eb8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa20b4	0xa3000	bcb5223f8b89915134d542b5f61b354c	False	0.9603189105636503	data	7.96596968808791	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa6000	0x1eb8	0x2000	ceead6708bb187bb17ad3545be7a554d	False	0.85107421875	data	7.304829849514365	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa8000	0xc	0x1000	55651858f4e62ebeb23c3eaacb01c3fc	False	0.0087890625	data	0.016408464515625623	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xa6100	0x1834	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9917688831504197
RT_GROUP_ICON	0xa7944	0x14	data	1.05
RT_VERSION	0xa7968	0x350	data	0.44221698113207547
RT_MANIFEST	0xa7cc8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 11:09:21.727916002 CEST	49706	443	192.168.2.7	104.26.13.205
Apr 26, 2024 11:09:21.727952003 CEST	443	49706	104.26.13.205	192.168.2.7
Apr 26, 2024 11:09:21.728034973 CEST	49706	443	192.168.2.7	104.26.13.205
Apr 26, 2024 11:09:21.734937906 CEST	49706	443	192.168.2.7	104.26.13.205
Apr 26, 2024 11:09:21.734956980 CEST	443	49706	104.26.13.205	192.168.2.7
Apr 26, 2024 11:09:21.997566938 CEST	443	49706	104.26.13.205	192.168.2.7
Apr 26, 2024 11:09:21.997647047 CEST	49706	443	192.168.2.7	104.26.13.205
Apr 26, 2024 11:09:22.000809908 CEST	49706	443	192.168.2.7	104.26.13.205
Apr 26, 2024 11:09:22.000821114 CEST	443	49706	104.26.13.205	192.168.2.7
Apr 26, 2024 11:09:22.001096964 CEST	443	49706	104.26.13.205	192.168.2.7
Apr 26, 2024 11:09:22.053286076 CEST	49706	443	192.168.2.7	104.26.13.205
Apr 26, 2024 11:09:22.100111008 CEST	443	49706	104.26.13.205	192.168.2.7
Apr 26, 2024 11:09:22.322062969 CEST	443	49706	104.26.13.205	192.168.2.7
Apr 26, 2024 11:09:22.322122097 CEST	443	49706	104.26.13.205	192.168.2.7
Apr 26, 2024 11:09:22.322180033 CEST	49706	443	192.168.2.7	104.26.13.205
Apr 26, 2024 11:09:22.329534054 CEST	49706	443	192.168.2.7	104.26.13.205
Apr 26, 2024 11:09:23.114649057 CEST	49707	587	192.168.2.7	50.87.219.149
Apr 26, 2024 11:09:23.311001062 CEST	587	49707	50.87.219.149	192.168.2.7
Apr 26, 2024 11:09:23.311104059 CEST	49707	587	192.168.2.7	50.87.219.149
Apr 26, 2024 11:09:23.580672979 CEST	587	49707	50.87.219.149	192.168.2.7
Apr 26, 2024 11:09:23.580873966 CEST	49707	587	192.168.2.7	50.87.219.149
Apr 26, 2024 11:09:23.777550936 CEST	587	49707	50.87.219.149	192.168.2.7
Apr 26, 2024 11:09:23.778237104 CEST	49707	587	192.168.2.7	50.87.219.149
Apr 26, 2024 11:09:23.976628065 CEST	587	49707	50.87.219.149	192.168.2.7
Apr 26, 2024 11:09:23.977077961 CEST	49707	587	192.168.2.7	50.87.219.149
Apr 26, 2024 11:09:24.187994003 CEST	587	49707	50.87.219.149	192.168.2.7
Apr 26, 2024 11:09:24.188236952 CEST	587	49707	50.87.219.149	192.168.2.7
Apr 26, 2024 11:09:24.188302994 CEST	587	49707	50.87.219.149	192.168.2.7
Apr 26, 2024 11:09:24.188321114 CEST	49707	587	192.168.2.7	50.87.219.149
Apr 26, 2024 11:09:24.234986067 CEST	49707	587	192.168.2.7	50.87.219.149
Apr 26, 2024 11:09:24.431734085 CEST	587	49707	50.87.219.149	192.168.2.7
Apr 26, 2024 11:09:24.434525967 CEST	49707	587	192.168.2.7	50.87.219.149
Apr 26, 2024 11:09:24.631253004 CEST	587	49707	50.87.219.149	192.168.2.7
Apr 26, 2024 11:09:24.632227898 CEST	49707	587	192.168.2.7	50.87.219.149
Apr 26, 2024 11:09:24.869391918 CEST	587	49707	50.87.219.149	192.168.2.7
Apr 26, 2024 11:09:28.831072092 CEST	587	49707	50.87.219.149	192.168.2.7
Apr 26, 2024 11:09:28.832226038 CEST	49707	587	192.168.2.7	50.87.219.149
Apr 26, 2024 11:09:29.028562069 CEST	587	49707	50.87.219.149	192.168.2.7
Apr 26, 2024 11:09:30.516271114 CEST	587	49707	50.87.219.149	192.168.2.7
Apr 26, 2024 11:09:30.516583920 CEST	49707	587	192.168.2.7	50.87.219.149
Apr 26, 2024 11:09:30.713332891 CEST	587	49707	50.87.219.149	192.168.2.7
Apr 26, 2024 11:09:30.713393927 CEST	587	49707	50.87.219.149	192.168.2.7
Apr 26, 2024 11:09:30.714318991 CEST	587	49707	50.87.219.149	192.168.2.7
Apr 26, 2024 11:09:30.714421988 CEST	49707	587	192.168.2.7	50.87.219.149
Apr 26, 2024 11:09:30.719206095 CEST	49707	587	192.168.2.7	50.87.219.149
Apr 26, 2024 11:09:30.915602922 CEST	587	49707	50.87.219.149	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 11:09:21.595833063 CEST	57789	53	192.168.2.7	1.1.1.1
Apr 26, 2024 11:09:21.720652103 CEST	53	57789	1.1.1.1	192.168.2.7
Apr 26, 2024 11:09:22.954212904 CEST	52832	53	192.168.2.7	1.1.1.1
Apr 26, 2024 11:09:23.113743067 CEST	53	52832	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 11:09:21.595833063 CEST	192.168.2.7	1.1.1.1	0x6f3d	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:09:22.954212904 CEST	192.168.2.7	1.1.1.1	0xbbb7	Standard query (0)	mail.alkuwaiti.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 11:09:21.720652103 CEST	1.1.1.1	192.168.2.7	0x6f3d	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:09:21.720652103 CEST	1.1.1.1	192.168.2.7	0x6f3d	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:09:21.720652103 CEST	1.1.1.1	192.168.2.7	0x6f3d	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:09:23.113743067 CEST	1.1.1.1	192.168.2.7	0xbbb7	No error (0)	mail.alkuwaiti.com	50.87.219.149	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49706	104.26.13.205	443	7252	C:\Users\user\Desktop\PO#50124.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 09:09:22 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-26 09:09:22 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 09:09:22 GMT Content-Type: text/plain Content-Length: 15 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87a56efdda2931e6-MIA
2024-04-26 09:09:22 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 32 30 Data Ascii: 102.129.152.220

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 26, 2024 11:09:23.580672979 CEST	587	49707	50.87.219.149	192.168.2.7	220-box2389.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 03:09:23 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 11:09:23.580873966 CEST	49707	587	192.168.2.7	50.87.219.149	EHLO 579569
Apr 26, 2024 11:09:23.777550936 CEST	587	49707	50.87.219.149	192.168.2.7	250-box2389.bluehost.com Hello 579569 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 11:09:23.778237104 CEST	49707	587	192.168.2.7	50.87.219.149	STARTTLS
Apr 26, 2024 11:09:23.976628065 CEST	587	49707	50.87.219.149	192.168.2.7	220 TLS go ahead

Target ID:	0
Start time:	11:09:17
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\PO#50124.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO#50124.exe"
Imagebase:	0xa40000
File size:	684'032 bytes
MD5 hash:	B4306234A3B45C69DF6A6A7CECD6070C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1386811526.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1386811526.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:09:20
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\PO#50124.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO#50124.exe"
Imagebase:	0x860000
File size:	684'032 bytes
MD5 hash:	B4306234A3B45C69DF6A6A7CECD6070C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2591871064.0000000002D1C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2591871064.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2591871064.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2589430439.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2589430439.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	10
Total number of Limit Nodes:	1

Executed Functions

Function 07690588 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31bb5249b84435ba372052bf40e83a5762f13d2a255873b7b7e8910d1e599a73
Instruction ID: f9a09c4f2a1448c925f62df6412155e603f42a98d0c85cf2464d7dc511f08a62
Opcode Fuzzy Hash: 31bb5249b84435ba372052bf40e83a5762f13d2a255873b7b7e8910d1e599a73
Instruction Fuzzy Hash: 04E0127481E24ADFCB018F2099155B9FFBC5B5B214F0025A5980A97256D7709959CB04

Uniqueness

Uniqueness Score: -1.00%

Function 013AABD0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,013AB919,00000800,00000000,00000000), ref: 013ABB0A

Memory Dump Source

Source File: 00000000.00000002.1385955915.00000000013A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_PO#50124.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6a4dfb1c593e40d00ab3a367817d58816de6a655d51be728db2f8a27a8ce1e03
Instruction ID: d12b2a32dd4b39331c52df139876fc63332887cef725626a69cd7c8a0f00477b
Opcode Fuzzy Hash: 6a4dfb1c593e40d00ab3a367817d58816de6a655d51be728db2f8a27a8ce1e03
Instruction Fuzzy Hash: 0F1100B6D003098FDB24DF9AC444BAEFBF4EB88314F50842AE919A7200C375A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 013AB838 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 013AB89E

Memory Dump Source

Source File: 00000000.00000002.1385955915.00000000013A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_PO#50124.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 86d97d06473fd6353dd6727a93d1a2b0c2186cf66123fa77cf784518ecdf0338
Instruction ID: d845739be123872971100e7b1c9ff5e3486a5f26c5f3af171b499b17b431d346
Opcode Fuzzy Hash: 86d97d06473fd6353dd6727a93d1a2b0c2186cf66123fa77cf784518ecdf0338
Instruction Fuzzy Hash: 5711E3B5C003498FDB14DF9AC445BDEFBF8EB88314F14842AD529A7214D375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07690656 Relevance: 1.3, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 07690A42

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: ccb266cd2730d95651f9167df2c3395221523b4bb51c451df55305fa16bad222
Instruction ID: f947ddbf28fdf611bdb4b72146649a0ee1ee8904c4983284e6081272376f9c2b
Opcode Fuzzy Hash: ccb266cd2730d95651f9167df2c3395221523b4bb51c451df55305fa16bad222
Instruction Fuzzy Hash: AA2112B0815229CFCBA1CF64C9507ECBBB8FB0E310F1094E9D51EA2282DB315A92CF44

Uniqueness

Uniqueness Score: -1.00%

Function 07691768 Relevance: .3, Instructions: 286
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c70a656164983505377a9f36fcc851c837677149f2dad0762900bf9282193873
Instruction ID: 168bf7900f269bc0629a7a16a9ee2641c4f9728431bac95ea10d2831a9222d2d
Opcode Fuzzy Hash: c70a656164983505377a9f36fcc851c837677149f2dad0762900bf9282193873
Instruction Fuzzy Hash: FBB18E74B0120A9FDB18DB78D594BAEB7FAEF89604F2440A9E506DB3A1CB30DD01CB51

Uniqueness

Uniqueness Score: -1.00%

Function 010BD06C Relevance: .1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1385253281.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10bd000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d9caf4c0ebb6d3658229a21d3ecf2b0c6d16f139a4a76d857dc7fd65f6a8a76
Instruction ID: 219c228da2fd6b859e395eab406cc1a1d00811f6349dc7ccd3b03af5365e66ad
Opcode Fuzzy Hash: 2d9caf4c0ebb6d3658229a21d3ecf2b0c6d16f139a4a76d857dc7fd65f6a8a76
Instruction Fuzzy Hash: FE214B71504200EFDB15DF94D9C0B56FFA5FB88318F20C5A9E9490F246C33AC416CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0769010F Relevance: .1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f18704bfef21491d09a87a391a13b42c31670f9c2de520c67de3f5091c2b7956
Instruction ID: 8daebc80a57466226dc1c812f723988bd90a2d113f7172e47c2b487260d2c212
Opcode Fuzzy Hash: f18704bfef21491d09a87a391a13b42c31670f9c2de520c67de3f5091c2b7956
Instruction Fuzzy Hash: A33114B495421ADFDB64CF64C845BE9BBB9BF49300F1090EAD50EA7280EB309A85DF40

Uniqueness

Uniqueness Score: -1.00%

Function 010DD01C Relevance: .1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1385380266.00000000010DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10dd000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ce4c80e203d0f99a1417fa8f5216ef7fa2c653f9d720360efaf0c93c3fe8bbd
Instruction ID: 45eb5833b42a50b1d2feb6d2d57b6f58071423c3e072e22bb02f1183aef4f319
Opcode Fuzzy Hash: 2ce4c80e203d0f99a1417fa8f5216ef7fa2c653f9d720360efaf0c93c3fe8bbd
Instruction Fuzzy Hash: AD21D075604300DFDB25DF64D984B16BFA5EBC8314F24C5ADE98A4B286C336D847CB62

Uniqueness

Uniqueness Score: -1.00%

Function 010DD2F0 Relevance: .1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1385380266.00000000010DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10dd000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 956678b86789cec984ccfbf72714a62be87f4c97b25e82329a3de4c9722614b7
Instruction ID: 719fce973eb51ef4f54a4f41bb3f14fbb5be4917441b906ab4ac7a161024e6a0
Opcode Fuzzy Hash: 956678b86789cec984ccfbf72714a62be87f4c97b25e82329a3de4c9722614b7
Instruction Fuzzy Hash: EF21F5B1604304DFDB15DF94D9C0B2ABBA5EB84314F20C5ADD8894B286C736D446CB61

Uniqueness

Uniqueness Score: -1.00%

Function 07691290 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbfee93f3ae1ec32161d1b4af7142bf47b62dd89b0dbc8247297554277f3b692
Instruction ID: 749d9206c3f75a7a14c98b97f95a920f1e45d749e4d22a03e6d68d18041da489
Opcode Fuzzy Hash: cbfee93f3ae1ec32161d1b4af7142bf47b62dd89b0dbc8247297554277f3b692
Instruction Fuzzy Hash: FB11B47170030A8BEB18DA29C8807AAB6E6FF85211F64C079D40ECB755DE30A8468B94

Uniqueness

Uniqueness Score: -1.00%

Function 07691280 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1732b3f17504c122b8a69d0ac2711281d9048c4ba42245b570410b5115e43c9
Instruction ID: 131c7c1dc0d4621cc6593fa902205b55f41a325d34eb5c31c5bc7e3a7bce8e76
Opcode Fuzzy Hash: a1732b3f17504c122b8a69d0ac2711281d9048c4ba42245b570410b5115e43c9
Instruction Fuzzy Hash: E011E4B17043078BDB18DB68C8907AAB7F6BF85211F28C07AC44ACF756DE309846CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010DD006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1385380266.00000000010DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10dd000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70e1c55ea2d12505c2f58f0750827d822034ccf1cea6a652c25d54b9a0222ea3
Instruction ID: b126655bfce8713523873fbf075707c5008d4d69f2ee8d854660a5f9a0c9dc8b
Opcode Fuzzy Hash: 70e1c55ea2d12505c2f58f0750827d822034ccf1cea6a652c25d54b9a0222ea3
Instruction Fuzzy Hash: 0021C6755093808FCB17CF64D590715BFB1EB85314F28C5DAD8898B697C33AD40ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 010BD067 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1385253281.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10bd000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ce60a6613beba357b00576ac525f5d38281a445edcd2f7d64ba7977a5eeb665
Instruction ID: d8317670683862858a37df7a968b913fa612606597c6cbfd68fb6e5c25d7e13b
Opcode Fuzzy Hash: 5ce60a6613beba357b00576ac525f5d38281a445edcd2f7d64ba7977a5eeb665
Instruction Fuzzy Hash: 50219D76504284EFDB06CF54D9C4B56BFB2FB88318F2486A9D9890B256C33AD426CF91

Uniqueness

Uniqueness Score: -1.00%

Function 010DD2EB Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1385380266.00000000010DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10dd000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: 4c281dfc0560197bc70ce7fbbf1d91c02b1b7c5d0d03048ca372f50f22e6c1c4
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 3711BB75504380CFCB06CF58D5C0B15BBA2FB84324F24C6AAD8894B296C33AD40ACF62

Uniqueness

Uniqueness Score: -1.00%

Function 0769017F Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d9c9492480b088270918e2118dbe81ea76049e127e83e70eb86e1c3e1e29ba4
Instruction ID: ff32afe47ab4ce53cbee9f9b9ea8d0eca9dd010d7ee41673f00484d9bc51e108
Opcode Fuzzy Hash: 1d9c9492480b088270918e2118dbe81ea76049e127e83e70eb86e1c3e1e29ba4
Instruction Fuzzy Hash: 011146B4A15219CFDB60CF64CD45BE8BBB8BF09304F1090EAE54EA7281DB706A81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 076901F9 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42e1e48b11360fc0053b5772c78cf4b89e5a79f4ae793b3c08a450e663572382
Instruction ID: d34d4d6210fe78067f4fd7f93c6649735e010f228eb79f3ff38668eca4aae4a6
Opcode Fuzzy Hash: 42e1e48b11360fc0053b5772c78cf4b89e5a79f4ae793b3c08a450e663572382
Instruction Fuzzy Hash: F9113774919259CFCF64CF20C9547E8BBF9AB4A314F1491E5C41EAB392D7319A86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 010BD92D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1385253281.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10bd000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6d2ec3838c4d8a1f1868ce6eec5c01a68ff0a170e70f39cdece7a8741c6f6b0
Instruction ID: d058f4b93ab2a98defda49d0ab49ce961f83b30224278b12cac91c6503225c62
Opcode Fuzzy Hash: f6d2ec3838c4d8a1f1868ce6eec5c01a68ff0a170e70f39cdece7a8741c6f6b0
Instruction Fuzzy Hash: AB01F7311093049EE7204E55CCC47AAFFD9DF41729F08C45AED990A282C2389844CB75

Uniqueness

Uniqueness Score: -1.00%

Function 0769036E Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5df051b21608022fd85123ec1cbbc9450e27e210fff93a06a5d1308911dc6363
Instruction ID: ebc22a9030126637101bc6330edb3283a35d79ff1001b3f1bd32a3509f8d62e0
Opcode Fuzzy Hash: 5df051b21608022fd85123ec1cbbc9450e27e210fff93a06a5d1308911dc6363
Instruction Fuzzy Hash: 3311E2B5919219CFDB64CF64CD40BE8BBB8BB49305F1091EAD40EA7241DB319E86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 07690823 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f063a4be7a5497e2e7eb6daa888b8a0798916ff2e59d581dd0a7d9be83fc672
Instruction ID: d7ebd5808b034279d412f2919aa831ce129f4003eacf3adf7c3f66a4e049f417
Opcode Fuzzy Hash: 3f063a4be7a5497e2e7eb6daa888b8a0798916ff2e59d581dd0a7d9be83fc672
Instruction Fuzzy Hash: 2311277191522ACFCB61CF68C9487ECBBF8BB4A315F1041E9D54EA7291CB315A92CF40

Uniqueness

Uniqueness Score: -1.00%

Function 07690495 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 265a29410a81d0b210f5cf16939e46de6a6ffaaf9039bc364e576996b6b505f3
Instruction ID: 546c9731dc98b67ff1c71f266d7574e40a99da125c60e975087db73df311a8f9
Opcode Fuzzy Hash: 265a29410a81d0b210f5cf16939e46de6a6ffaaf9039bc364e576996b6b505f3
Instruction Fuzzy Hash: 31012C78909119CFCF64CF10C944AE8BBF8AB8A314F14A1E9841EA7392D7319A86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0769084F Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6195748a107e7ac15353212bc396f8ab947537e686e300bd73bd95af300ac63f
Instruction ID: e1ad71cb64b918850f22ef1b0156c98313f41dd57e0b55f159479dc7a2e9dc1a
Opcode Fuzzy Hash: 6195748a107e7ac15353212bc396f8ab947537e686e300bd73bd95af300ac63f
Instruction Fuzzy Hash: 301113B491422ACFCF64CF64C9447ECBBF8AB4D304F1050E9D94AA2250CB319A91CF44

Uniqueness

Uniqueness Score: -1.00%

Function 010BD92C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1385253281.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10bd000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75f16be8c59520c12dd4f1512f2bc13df5a5880cac7de481c5333d8eb457fc11
Instruction ID: af60374fc18a3bee52f96512e7126ab08e661ef7d14f135c4d32f67d26714416
Opcode Fuzzy Hash: 75f16be8c59520c12dd4f1512f2bc13df5a5880cac7de481c5333d8eb457fc11
Instruction Fuzzy Hash: AFF096714053449EE7508E1ACCC4BA6FFD8EB81738F18C59EED885B287C279A844CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0769074E Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9671fe58609bf85e3a6d0a2d8d1a51e1112b67a0c16a9288c11a3b64838d513e
Instruction ID: 6423a1098480f3949cd321d1e3d5136269ae4089b607c6f66006450fd7a45155
Opcode Fuzzy Hash: 9671fe58609bf85e3a6d0a2d8d1a51e1112b67a0c16a9288c11a3b64838d513e
Instruction Fuzzy Hash: E7011371D192298FCB61CFA4C9847ECBBF4AB0E300F1040EAD44AA3252C7315A96CF04

Uniqueness

Uniqueness Score: -1.00%

Function 07690210 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f46cc8ce6c902a3cf2a4c195a1925d00ba33dd566c1419018e4467869062820c
Instruction ID: 7e1567c668caa88ddd55aa6c5b0c44e73cfb3a1c19d4db40d4c637c5c45e011e
Opcode Fuzzy Hash: f46cc8ce6c902a3cf2a4c195a1925d00ba33dd566c1419018e4467869062820c
Instruction Fuzzy Hash: FE01AF35A051299FDB60CF54C980FE9BBB9AB09304F1480D9E509A7252CB32AE82DF40

Uniqueness

Uniqueness Score: -1.00%

Function 0769031B Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd6cfd5b3851bfc78bd592e35ffc7c503b8b1f6308e513803b5280d102586076
Instruction ID: 87052c8489dd0da09dc09d4d0717a5f87f79409b11b872104bcf52380cdfc34b
Opcode Fuzzy Hash: fd6cfd5b3851bfc78bd592e35ffc7c503b8b1f6308e513803b5280d102586076
Instruction Fuzzy Hash: 17F0B77491921ADFDF10CF64C644BE8BBF9BB5A315F0890E5940EAB252C3319A86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 076905C2 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4edba55d5f7b90887e43a447693a60c41e7afd011ba124a973c102da57ef2b5f
Instruction ID: f8139265bcd114ccf730b4f86474ae3677ee0376c96d00ed14184f765e918ae8
Opcode Fuzzy Hash: 4edba55d5f7b90887e43a447693a60c41e7afd011ba124a973c102da57ef2b5f
Instruction Fuzzy Hash: 15F0A974E08218DBCF54CF94D851AEDFBB9BF49304F2091A9950DA7246D7315942CF80

Uniqueness

Uniqueness Score: -1.00%

Function 07690406 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e795cff9403c4c12edc46433d3aa4654459ef0f253657ca3267e461de72988e4
Instruction ID: 2f03a28797f286d9aa19360791b59cd165840b4dd36618e9307511882bbd0dd3
Opcode Fuzzy Hash: e795cff9403c4c12edc46433d3aa4654459ef0f253657ca3267e461de72988e4
Instruction Fuzzy Hash: 8EF09078919246CFCB20CF20C1445B87BBCAB47320F1491EA845B9B292D731D946CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0769064A Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64820763369206fffb8f3414a70effa961183f1ee35f97747a71ce5e646b41ea
Instruction ID: 83da0a28125500360de5cbc2ca109a31e44a1a10e1bac30f432f4073ea7610ff
Opcode Fuzzy Hash: 64820763369206fffb8f3414a70effa961183f1ee35f97747a71ce5e646b41ea
Instruction Fuzzy Hash: 24F015B59042088FDB04CF95C881AE8B7F8AB49300F1090A6D50AE7241C770AA86CB50

Uniqueness

Uniqueness Score: -1.00%

Function 07690ACA Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35dcbaa6e633fb69b4613e82b9750ebca994a421b7f0d288e55c34d4f17e7a71
Instruction ID: 1def2e13809edebd672955782d56165d49214553d451295de3f826086a2b1b73
Opcode Fuzzy Hash: 35dcbaa6e633fb69b4613e82b9750ebca994a421b7f0d288e55c34d4f17e7a71
Instruction Fuzzy Hash: AFF01274914219CFCF64CF20C5947E8B7B8AB4A314F1091E9841EA33A1DB315EC6CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0769086B Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408be0b462aa3467af692b15bcd4c20bc5d09321e94391143cc766c50d4ff712
Instruction ID: 7899ee9a74079fae652a0404ae0947de2cbcd83b8562a0fe4b4e645205a5c4e7
Opcode Fuzzy Hash: 408be0b462aa3467af692b15bcd4c20bc5d09321e94391143cc766c50d4ff712
Instruction Fuzzy Hash: 69F07F75A051199FDB50CF64C980BE8BBB9AB09314F1485D9E509A3252CB32AA85DF00

Uniqueness

Uniqueness Score: -1.00%

Function 07690781 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e868a1f306090f1111991cda6abb044963ee591b008a081debc6a97c7e122ffa
Instruction ID: 4924a3de183eae77bdc0ee0270c30de6e99f63ffa8eb85405f33ef1303226f11
Opcode Fuzzy Hash: e868a1f306090f1111991cda6abb044963ee591b008a081debc6a97c7e122ffa
Instruction Fuzzy Hash: 1EE0E578A09208DFCB51CBA8C950AA9BFB9AB4D300F209198950DAB342C7325942CF80

Uniqueness

Uniqueness Score: -1.00%

Function 07690A7F Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 394eb6bf4ae7a2b25d4bfc2c63e7b399c73e0bc1113bca57bc4d698be008e716
Instruction ID: e2533422a4d7a4646b7c11ff0e548532ea35f81733ea8fc954bddc2d0e05018f
Opcode Fuzzy Hash: 394eb6bf4ae7a2b25d4bfc2c63e7b399c73e0bc1113bca57bc4d698be008e716
Instruction Fuzzy Hash: E0E0ED389002188FCBA4CF20C9546DCBBB4AB89310F1495E9841EA33A1DB309E82CF40

Uniqueness

Uniqueness Score: -1.00%

Function 07692D16 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b3d934a5af7602fbe1bd793949cf865c9196f59a241c4f8ea5091c05b1001a
Instruction ID: 2ce794cb9306c22bf3c3efc654f5333fd707ab3a68f6fbaaa7ed8f2d63b8276a
Opcode Fuzzy Hash: 84b3d934a5af7602fbe1bd793949cf865c9196f59a241c4f8ea5091c05b1001a
Instruction Fuzzy Hash: 93D022FBB0411AEA4E2009C6B0821FDBF04F1C22AE7481477D2178A502CA25830B6B92

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07693450 Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1390347406.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7690000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fd6c02d4f46824c9d1a34f0ebb4384a9d6f6e343fc7e7de02d7ce37d1f573f4
Instruction ID: aa0e1adf85a413fe934be69df44704a1bdb83779f0d46f98ab448fedb257122a
Opcode Fuzzy Hash: 7fd6c02d4f46824c9d1a34f0ebb4384a9d6f6e343fc7e7de02d7ce37d1f573f4
Instruction Fuzzy Hash: D8D1A9B17007019FEB2ADB7AC450BAABBEAAF89704F14847DD156DB390DB35E801CB51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: PO#50124.exePID: 7252, Parent PID: 7072COMMON

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	4

Executed Functions

Function 068F2360 Relevance: 9.0, Strings: 6, Instructions: 1491COMMON

Download Yara Rule

Strings

$q, xrefs: 068F371E
$q, xrefs: 068F376B
$q, xrefs: 068F3747
$q, xrefs: 068F3777
$q, xrefs: 068F3753
$q, xrefs: 068F372A

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: 5b7bd5ae2b1356a35d264d63add9a57c6f64ed039c021a570b8acae0b345a63e
Instruction ID: 32f3701eb32b0afc49af86888d44ae9d4254b7380694a2ecb657006ab7574ea9
Opcode Fuzzy Hash: 5b7bd5ae2b1356a35d264d63add9a57c6f64ed039c021a570b8acae0b345a63e
Instruction Fuzzy Hash: 3ED24834E107048FDB64DBA8C494A9DB7B2FF89314F5585A9E609EB354EB30ED85CB80

Uniqueness

Uniqueness Score: -1.00%

Function 068FB240 Relevance: 8.3, Strings: 6, Instructions: 772COMMON

Download Yara Rule

Strings

$q, xrefs: 068FBBFF
$q, xrefs: 068FBBBF
$q, xrefs: 068FBBF3
$q, xrefs: 068FBB97
$q, xrefs: 068FBB8B
$q, xrefs: 068FBBCB

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: f3f85fbddc4b0d02ed6225895b6e5bb553c5a6944a597b49f3933262f185ba3c
Instruction ID: e2813d5fd8c258d721fd4cf5fec8aabe71e9581ae717315fefe40d28aad36403
Opcode Fuzzy Hash: f3f85fbddc4b0d02ed6225895b6e5bb553c5a6944a597b49f3933262f185ba3c
Instruction Fuzzy Hash: 23527430F202098FDF64DB69D4907ADBBB2FB89310F24856AE605DB395DA35DC81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 068F7D78 Relevance: 3.0, Strings: 2, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 068F80E7
$q, xrefs: 068F80DB

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 69aa03ed1b25257b8dcf9e63e287756311a37aa958fb303ce4d5502970b4c955
Instruction ID: 5e6e44571ee051b5ece3e6a62c99bfb6da40ce9b5e44d988049dabb1f6c3556f
Opcode Fuzzy Hash: 69aa03ed1b25257b8dcf9e63e287756311a37aa958fb303ce4d5502970b4c955
Instruction Fuzzy Hash: A2029A70B102058FDB64DB68D850BAEBBB2FF84314F648569D615DB394EB71EC82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 068F5598 Relevance: 1.8, Strings: 1, Instructions: 593
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 068F5970

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: df66e4543529be6db2d2540678bc2d21b7afc34d05dd19212e97a5f088415cb3
Instruction ID: 6b9b52b235e6a3e1ae4b482fe492aab656286c5733ccf9e2711bc5b199b13de6
Opcode Fuzzy Hash: df66e4543529be6db2d2540678bc2d21b7afc34d05dd19212e97a5f088415cb3
Instruction Fuzzy Hash: CF22BF35F202048FDF64DBA8C4806AEBBF2EF95310F25846AD656EB384DA35DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 068F65E8 Relevance: .8, Instructions: 813COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddd9143f57d0d8dd423f627a056f7c4c3ce05506de12f52e88eb5f26bd49ec93
Instruction ID: c417619d4f2bc95f7f48c3976639ac53780d83a22411835ea3c8663292ccf039
Opcode Fuzzy Hash: ddd9143f57d0d8dd423f627a056f7c4c3ce05506de12f52e88eb5f26bd49ec93
Instruction Fuzzy Hash: 3D628E35B102048FDB64DB68D594BADBBF2EF84314F148669E605EB354EB35EC86CB80

Uniqueness

Uniqueness Score: -1.00%

Function 068FC198 Relevance: .6, Instructions: 641COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d66dae22a083d9dae2fd83061649d6b3217fd0c7fd71dcd6677be48bd46f3439
Instruction ID: f45be69fbf5a5779394a8ac6da08d31692679ef0608ee44fff28219a8c27caac
Opcode Fuzzy Hash: d66dae22a083d9dae2fd83061649d6b3217fd0c7fd71dcd6677be48bd46f3439
Instruction Fuzzy Hash: 71329375F102098FDB64DB68D490BAEBBB2FB88314F108525E605EB394DB35ED42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 068FACD8 Relevance: 10.4, Strings: 8, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 068FADF9
$q, xrefs: 068FAE87
$q, xrefs: 068FAE7B
$q, xrefs: 068FAE4C
$q, xrefs: 068FAEA4
$q, xrefs: 068FAE05
$q, xrefs: 068FAE58
$q, xrefs: 068FAEB0

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-3886557441
Opcode ID: 591fb1f257f676e40fc1a0ed479133258f750f48fffd5f940277274b65655be7
Instruction ID: e83ce11043e122eac89d5849802d00b43191d99b689d113ab7ff451cf5a0a0dd
Opcode Fuzzy Hash: 591fb1f257f676e40fc1a0ed479133258f750f48fffd5f940277274b65655be7
Instruction Fuzzy Hash: 5FE16130E20309CFDB69DB69D4906AEBBB2FF85314F118529D609EB344DB71EC468B91

Uniqueness

Uniqueness Score: -1.00%

Function 068F9150 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 068F91A3
$q, xrefs: 068F91DE
$q, xrefs: 068F91D2
$q, xrefs: 068F9197

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 666b0d38a0e11e117c2ecfe03a744ecabf4cadc392e4cb48e196ac2d9e13cafd
Instruction ID: c03eca6198125869c45e0a34322d959fc0bc810d68ebded643536f0bd6bdffce
Opcode Fuzzy Hash: 666b0d38a0e11e117c2ecfe03a744ecabf4cadc392e4cb48e196ac2d9e13cafd
Instruction Fuzzy Hash: BB916330F102198FDB64DB69D850BAEBBF2BF89300F108565D919EB344EE71DD818B91

Uniqueness

Uniqueness Score: -1.00%

Function 068FCF58 Relevance: 4.5, Strings: 3, Instructions: 796
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 068FD34B
$q, xrefs: 068FD353
$q, xrefs: 068FD35F

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID: $q$$q$$q
API String ID: 0-3067366958
Opcode ID: 2e909d40528ee6d7e7722c2df8d175ac25890fc7b43337cb5bbf9ec87a3e0538
Instruction ID: 0c0e28f997ac786e5217a5af05ac346a1cb984f723a034942776a1b5b8df4063
Opcode Fuzzy Hash: 2e909d40528ee6d7e7722c2df8d175ac25890fc7b43337cb5bbf9ec87a3e0538
Instruction Fuzzy Hash: 91625834A107198FCB65EB68D591A9EBBE2FF84304B208A68D505DF358DB71FC46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 068F4B58 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Oq, xrefs: 068F4D0F
fq, xrefs: 068F5265
XPq, xrefs: 068F4C85

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID: fq$XPq$\Oq
API String ID: 0-132346853
Opcode ID: f6c7b2c4170c48b2330e704f6bed22fc5a84163378f36509f9ac55650c797436
Instruction ID: 2e4e4a759f18147c274847a8fd3fd3264385afbf7caba221ef63ea10e24cfae9
Opcode Fuzzy Hash: f6c7b2c4170c48b2330e704f6bed22fc5a84163378f36509f9ac55650c797436
Instruction Fuzzy Hash: C0617F30E102089FEB549BA9C8557AEBEF6FF88300F20852AE205EB395DE754C45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0114EB50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_, xrefs: 0114EBA3

Memory Dump Source

Source File: 00000003.00000002.2591052710.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1140000_PO#50124.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 7568d695be304a023af5da9fbf94c8ecae5d1975f3ea631f827e034bc9eae4f5
Instruction ID: 37a77d6e022e3a6ee7c2762c1fe1b936b40f17520bcb531a7f14cceecf678023
Opcode Fuzzy Hash: 7568d695be304a023af5da9fbf94c8ecae5d1975f3ea631f827e034bc9eae4f5
Instruction Fuzzy Hash: 25412472D043498FDB18DFA9D80479EBBF0AF89210F15856AD504A7381EB389845CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 068F9141 Relevance: 2.7, Strings: 2, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 068F91D2
$q, xrefs: 068F9197

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 78ed597026b5c50203aa4fededbccd349ea3fc56cb91a01ca864947f376ecea5
Instruction ID: 360b5562f2b8dd8e4c64f02a8b2f44c7a2dffdfe9d219b1ab2d62a5d8154d24c
Opcode Fuzzy Hash: 78ed597026b5c50203aa4fededbccd349ea3fc56cb91a01ca864947f376ecea5
Instruction Fuzzy Hash: 9F516031F102159FDB54DB69D850BAE7BF2BF88300F108469D919DB348EA71DC828B91

Uniqueness

Uniqueness Score: -1.00%

Function 0114E2B8 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,0114EBA2), ref: 0114EC8F

Memory Dump Source

Source File: 00000003.00000002.2591052710.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1140000_PO#50124.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: afdb1dd25dd154e413bc6c1b97d7f49cdc25cb2e78e2473c36cc9e7c5fb94d1f
Instruction ID: 01ca0bb09a58ab63219fae517c591f361b33985548796f3012ac0435cf7f3768
Opcode Fuzzy Hash: afdb1dd25dd154e413bc6c1b97d7f49cdc25cb2e78e2473c36cc9e7c5fb94d1f
Instruction Fuzzy Hash: 931142B1C0065A9BDB24DF9AC545B9EFBF4FF08320F11812AE918B7240D778A941CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 068F4B48 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

XPq, xrefs: 068F4C85

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID: XPq
API String ID: 0-1601936878
Opcode ID: adef97fb306bc86548355c9f2a17e15e966ca4843a4d28f9351c0f104616ec58
Instruction ID: 3e018e47e93889220938a14d94cfa25d55a19a8079a8654f6d00e54d353d5bb6
Opcode Fuzzy Hash: adef97fb306bc86548355c9f2a17e15e966ca4843a4d28f9351c0f104616ec58
Instruction Fuzzy Hash: 6D419C30A102089FDB549FA9C81579EBFF2FF88300F21852AE145AB395DA758C01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 068FDAD8 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PHq, xrefs: 068FDC21

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: 0b969e3a478dbb44b5689a3865d05032d118fe92dec2c905a12a6466ddf7d947
Instruction ID: f33482d6b1ad4a2b3f2fd4570aa913defb9f2e686df3d431042aae0aff51438d
Opcode Fuzzy Hash: 0b969e3a478dbb44b5689a3865d05032d118fe92dec2c905a12a6466ddf7d947
Instruction Fuzzy Hash: AC417C30E106099FDB65DF65C4547AEBBB2FF89344F204929E606EB344EB70A846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 068FDAC5 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

PHq, xrefs: 068FDC21

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: a93baa52f0202217f4d6b59a7106e0f4a5f60c570059109ec13ad51ccbfa8921
Instruction ID: ccb29bca94e6483fc2349cde5487e709524c1e274bd88761c74a3b146bd06188
Opcode Fuzzy Hash: a93baa52f0202217f4d6b59a7106e0f4a5f60c570059109ec13ad51ccbfa8921
Instruction Fuzzy Hash: 5B418F30E10709CFDB65DF65C4546AEBBB2FF85340F24492AE605EB244EB75E846CB41

Uniqueness

Uniqueness Score: -1.00%

Function 068F21C5 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

PHq, xrefs: 068F2313

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: 377838f37d6a9215a7503e321167f3feee80be0d4b76b574ea57e34484fa1a83
Instruction ID: 08eb3a39bacbf836176cb616858679f0ee7cfe83c94404840c336dab7a800427
Opcode Fuzzy Hash: 377838f37d6a9215a7503e321167f3feee80be0d4b76b574ea57e34484fa1a83
Instruction Fuzzy Hash: A4311030B202058FDB5A9BB5C02476EBBE2BB89200F244578D502DB398DF36DD42C790

Uniqueness

Uniqueness Score: -1.00%

Function 068F21D8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHq, xrefs: 068F2313

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: c6ed4cc4d33b5a412ae244ef0b9a1baa47984ffbe132a36df23b948c9ecb4743
Instruction ID: 25ecd07473b6baa612fb56f4a914e286a8dddc565596840efe6815db331ea3b5
Opcode Fuzzy Hash: c6ed4cc4d33b5a412ae244ef0b9a1baa47984ffbe132a36df23b948c9ecb4743
Instruction Fuzzy Hash: E331EF30B202058FDB69ABB5D46476EBBE3BB89640F244578D502DB388DE32DD42C791

Uniqueness

Uniqueness Score: -1.00%

Function 068FB230 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1474e675f78a844f625e5ba3128a9c552560b6807a0b2dd56b9cc181171e6cef
Instruction ID: eccae875356615ff4cb9f3f2562acc7126436b553e1471a5adba971f0570db33
Opcode Fuzzy Hash: 1474e675f78a844f625e5ba3128a9c552560b6807a0b2dd56b9cc181171e6cef
Instruction Fuzzy Hash: 8CA18370F202098FEF74DBA9C4907AEBBE6EB89310F248429E605DB395CA35DC819751

Uniqueness

Uniqueness Score: -1.00%

Function 068FB648 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99e096132168566d969c5a8aaa7b9f6e33ba983ec63f246edd671698b2ba04f1
Instruction ID: 117115b3fd9fff3ef19850e8f1ba49ecd5a0182f768bb1fbbc500307a3c59831
Opcode Fuzzy Hash: 99e096132168566d969c5a8aaa7b9f6e33ba983ec63f246edd671698b2ba04f1
Instruction Fuzzy Hash: 14A15A34E202098FDFA4DF58C4807ADBBB1FB85310F248526E655DB355DA34EC82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 068F61E0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf778108d873bb8420f998a57d4195906131f99c2724d960a9422d5db795e3c5
Instruction ID: 7eee854ad73a1738a7a89fbcf0ed7105aed13d9f67b4cd5c8a93eefface7b842
Opcode Fuzzy Hash: cf778108d873bb8420f998a57d4195906131f99c2724d960a9422d5db795e3c5
Instruction Fuzzy Hash: 9E61C471F101214FDF549B7DC84069EBADBAFC4224B154539D90AEB364EEB6EC8287C2

Uniqueness

Uniqueness Score: -1.00%

Function 068F4288 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa4f43cce39a57b85a74a475b2a2f7845de63586bdd0b8fab88a4dd9d6dd494f
Instruction ID: e173ed5dc46e36ab3639e947409615ccbdfac75c67bc99bc120273daedb857f1
Opcode Fuzzy Hash: aa4f43cce39a57b85a74a475b2a2f7845de63586bdd0b8fab88a4dd9d6dd494f
Instruction Fuzzy Hash: BC814D34B102098FDB54DFA9C4547AEBBF2AF89304F248529E50AEB349EF34EC428741

Uniqueness

Uniqueness Score: -1.00%

Function 068F45A8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c34f34bb497eda555a848d592007b57188585e3a8cb3cbb167fad840e618dc1
Instruction ID: bb2eefba1623c2db6eb12e97d7399507b289b64c66dcfe0aafd0c9d3d864f4f2
Opcode Fuzzy Hash: 0c34f34bb497eda555a848d592007b57188585e3a8cb3cbb167fad840e618dc1
Instruction Fuzzy Hash: F3913F34E102198FDF60DF68C850B9DBBB1FF85310F20869AD649EB255DB70A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 068F4298 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 001599eb5b9783669ec8be25893903a8bfd980cdc71a1ba807d1ca98013f6ab2
Instruction ID: 091e5dcc05b0acf9195309420f0cce390ea02545a5a1d168b116ae55d9ed9113
Opcode Fuzzy Hash: 001599eb5b9783669ec8be25893903a8bfd980cdc71a1ba807d1ca98013f6ab2
Instruction Fuzzy Hash: 39813F34B102099FDB54DFA9C4547AEBBF2AF89304F118529E50AEB349EF74DC428751

Uniqueness

Uniqueness Score: -1.00%

Function 068F45C0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2aca973f7c05a1f4d5582c2bb9f47f0bd4f4be3f40c120098871d473eb2dc3a
Instruction ID: 041f06d05b41188a495e3516f04a1209ac181f4ded22b10183e57ec66ae53fb9
Opcode Fuzzy Hash: c2aca973f7c05a1f4d5582c2bb9f47f0bd4f4be3f40c120098871d473eb2dc3a
Instruction Fuzzy Hash: A0911F34E102198BDF60DF68C850B9DB7B1FF89310F208699D649BB355DB71A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 068FEB18 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bb425c9dc6cd19f4ae6a610e63c0e8b68065b8198bef949937376fdcbeee0bf
Instruction ID: 3a46f3a79b8f26cf792fa48bfb7b8345655a42b917ae627bb4f1a087f3956e7c
Opcode Fuzzy Hash: 3bb425c9dc6cd19f4ae6a610e63c0e8b68065b8198bef949937376fdcbeee0bf
Instruction Fuzzy Hash: 01714030E102099FDB54EBA9C894AAEBBF6FF84304F248529E515EB354DB30ED46CB40

Uniqueness

Uniqueness Score: -1.00%

Function 068FEB28 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b0028ec1c60ecfe55f5d050e061bc904ba478d3606e811b15f6dc3781be84bf
Instruction ID: dc2b5eefbda9c4019f80ca39b9634e6d6f09af86ef81c1874a63d7c3e83bd9de
Opcode Fuzzy Hash: 1b0028ec1c60ecfe55f5d050e061bc904ba478d3606e811b15f6dc3781be84bf
Instruction Fuzzy Hash: A7713D30E102099FDB54EBA9C994AAEBBF6FF84304F248529D505EB364DB30ED46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 068FFA40 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94f16f039f07ecd05e8d2a4c008aaf3fc5a72efd909e95089fac63a7b045e57f
Instruction ID: 45c232f8ed808a70ee46a65828cfbec07727a7dfe676de0da2f050121ce7ea09
Opcode Fuzzy Hash: 94f16f039f07ecd05e8d2a4c008aaf3fc5a72efd909e95089fac63a7b045e57f
Instruction Fuzzy Hash: 2751C970F202148BEFB46768D89576F3A9ADB8D715F20442AE70AD73D4CB78DC4293A1

Uniqueness

Uniqueness Score: -1.00%

Function 068FFCA0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3087df0e5873ac31ecf35559b8137b86920295db18bfbc4f7419b5e285a463ff
Instruction ID: 533869795327cc7ab23f3e41a8153a9e6167b279051d9b68399c15ab6a7c13df
Opcode Fuzzy Hash: 3087df0e5873ac31ecf35559b8137b86920295db18bfbc4f7419b5e285a463ff
Instruction Fuzzy Hash: A751B231E102089FDB64EB78E4946ADBBB2FF84315F208879E316EB250DB359C55CB80

Uniqueness

Uniqueness Score: -1.00%

Function 068FFA50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95e4eec75bd016fc1f4db311aa78fb8416c5886528be9f243f13eee800b79e90
Instruction ID: 45fc41648c08d60c26f9de39f2d50fad6a091e2a4ea46481958b60141796ea51
Opcode Fuzzy Hash: 95e4eec75bd016fc1f4db311aa78fb8416c5886528be9f243f13eee800b79e90
Instruction Fuzzy Hash: 7A51B670F202189BEFB46768D89476F3A9ADB8D715F204429E70AD73D4CB78DC4293A1

Uniqueness

Uniqueness Score: -1.00%

Function 068F5418 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbc7c4f421e66036173c6fff15f9139f3b40dc8ea167c855796208057d731c80
Instruction ID: 6d922ecab1d1249a0beed4b171414a5ffccdd6ca7de18e50faf1e7acbc512d2d
Opcode Fuzzy Hash: cbc7c4f421e66036173c6fff15f9139f3b40dc8ea167c855796208057d731c80
Instruction Fuzzy Hash: 12412D71E106098FDF70CF99D881AAFFBF2FBA8210F10492AE355D7650D630E9558B92

Uniqueness

Uniqueness Score: -1.00%

Function 068F5588 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bddb794117704b2aedef41e69896aae54840dec7aa407e1a1e02d5fd10cad4c
Instruction ID: 0e30b37495978bd54ea91dcd777656f0790677fc30e42e576ea617523be6cd82
Opcode Fuzzy Hash: 8bddb794117704b2aedef41e69896aae54840dec7aa407e1a1e02d5fd10cad4c
Instruction Fuzzy Hash: 3531A471E142058FDB608F69C8C466EBBB1EB55310F15886AE36ADB651D638E840CB91

Uniqueness

Uniqueness Score: -1.00%

Function 068F2088 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3820351d14f5445b5ee8abd8d1e3574831e817962c2c7e4835b668978e54407c
Instruction ID: ea482d6d73e39e9683aae29df630be5229180f4c39f14916eac33758f20d1e39
Opcode Fuzzy Hash: 3820351d14f5445b5ee8abd8d1e3574831e817962c2c7e4835b668978e54407c
Instruction Fuzzy Hash: 1B316234E106058FCB59DFA4C46569EBBF2FF89300F108519E906EB354DB71AD42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 068F2098 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fac45e38f7125773bdc1bd6c0f6f427e5d611e3e2f788b530fa92ca82d384f0f
Instruction ID: 7a74102bd535f8c18a7eb3c38baf9b3c3dd8497ac3f4932a91c2b06efb00a023
Opcode Fuzzy Hash: fac45e38f7125773bdc1bd6c0f6f427e5d611e3e2f788b530fa92ca82d384f0f
Instruction Fuzzy Hash: C3317234E106099BCB19DFA4C86569EB7B2FF89300F10C519EA06E7344DB71BD42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 068F3A88 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f0fc14e67f9d5012f8ff715dfda05c67968cc339d9a7c041b8bd49b6d203dfc
Instruction ID: a193585f3d2eaa18896b076e3815b2a9f514b2e9ccc36fa411da577924a75da7
Opcode Fuzzy Hash: 5f0fc14e67f9d5012f8ff715dfda05c67968cc339d9a7c041b8bd49b6d203dfc
Instruction Fuzzy Hash: 60216976E106189FDB54DF69D891BAEBBF5FB48710F118025EA05EB344EB30D9408B94

Uniqueness

Uniqueness Score: -1.00%

Function 068F3A98 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f558fd8e462f57f7eba036b70b75203542fa9d2c5283d969a64e144f4c9fc4f
Instruction ID: bb855b24a879e26cb0623011e385a0b86eb900ef912d11d81ee7475a331751be
Opcode Fuzzy Hash: 8f558fd8e462f57f7eba036b70b75203542fa9d2c5283d969a64e144f4c9fc4f
Instruction Fuzzy Hash: 8D216676E107189FDB50DFA9D890BAEBBF5FB48710F118029EA05EB344EB30D8408B94

Uniqueness

Uniqueness Score: -1.00%

Function 010FD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2590730806.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10fd000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58ed1c91946ea32bce28d3f8ad824a6ed729406832bccfaeb07e56fdc631090f
Instruction ID: 2c2448c2f5846c44d7d7d0df280ba8755ba4dcdbb1ac4b6c415a3b7224fefa6d
Opcode Fuzzy Hash: 58ed1c91946ea32bce28d3f8ad824a6ed729406832bccfaeb07e56fdc631090f
Instruction Fuzzy Hash: E8214271604204AFDB11CF64D9C1B26BBA5FB84314F20C6ADEA890F742C736D847CB62

Uniqueness

Uniqueness Score: -1.00%

Function 068FFC91 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44926e00d8dd1f2d6f367851cf299be53106012dec96b71050d28dd7bc47b57a
Instruction ID: 4f8a01278daeefae1c788b1741f20358efd7f802651dc74488099304318146e8
Opcode Fuzzy Hash: 44926e00d8dd1f2d6f367851cf299be53106012dec96b71050d28dd7bc47b57a
Instruction Fuzzy Hash: F811E532F101144BCBA9AB69D4A426EB7E6EB85210B24843AE70AD7344EA249C428381

Uniqueness

Uniqueness Score: -1.00%

Function 068F3BA8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58b0b068ac440371d1f7349c092aa2d29812432c88205d89c8c15b00f4154e78
Instruction ID: 22a4a12d3010ea799ea8956afccb83c94035d62b7c0854205476db78ee17bc1a
Opcode Fuzzy Hash: 58b0b068ac440371d1f7349c092aa2d29812432c88205d89c8c15b00f4154e78
Instruction Fuzzy Hash: C511A136B101284FDB95A77DC8246EE7BA7ABC8310F008539D60AE7348DE65DC0287D0

Uniqueness

Uniqueness Score: -1.00%

Function 068FA308 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93584480b06b5deca25d6a0f11c6c685778e1eb43c749401e070b236634ab9a0
Instruction ID: 8b0f9ecd85d150fc427e93a8d595a84142b1c8ea5304fd0e30e0c4eef18fd9a8
Opcode Fuzzy Hash: 93584480b06b5deca25d6a0f11c6c685778e1eb43c749401e070b236634ab9a0
Instruction Fuzzy Hash: 0D01F734B242104FC765963CE86175E7BEAEB8A720F108469E60ECB385EE11EC028791

Uniqueness

Uniqueness Score: -1.00%

Function 068F41E9 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9cc3dc4936242dae14d2c315dfdaf027979c28ec7950404105ad741bb1eb2e9
Instruction ID: 28ddf6483d5e851cb99f60ea2620f0be56a11a26cfef36946d39d4feb2217a49
Opcode Fuzzy Hash: d9cc3dc4936242dae14d2c315dfdaf027979c28ec7950404105ad741bb1eb2e9
Instruction Fuzzy Hash: 7301D434B241100FDB6097ADA41476FABC7EBC9310F24843AE20AC735ADE62DC428391

Uniqueness

Uniqueness Score: -1.00%

Function 010FD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2590730806.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10fd000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: e8b0c1af198cceab9bdaa607945737ff73c30a15e7786ab8c222c7d50f7e2ad2
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 3F11DD75504284DFCB16CF54C9C5B15BFA2FB84324F24C6ADE9894B692C33AD44ACF62

Uniqueness

Uniqueness Score: -1.00%

Function 068F3861 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1f99ef9e747a925e04b66bfc0c1f2fc3550fedaa60fcdb1e5df1f08f97813a
Instruction ID: c5fa7362671d653b04aedcb9f5c2ec19e2428c000484dbc65a280978645d04dd
Opcode Fuzzy Hash: 8b1f99ef9e747a925e04b66bfc0c1f2fc3550fedaa60fcdb1e5df1f08f97813a
Instruction Fuzzy Hash: CE21F2B1D11219AFCB10DF9AD884ACEFBF4FB48310F10812AEA18B7240C3756944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 068F3B97 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c8dc5745aa920ab37b1c2f184270a95cd81a2f21722cc99720fa7e1b7206489
Instruction ID: adce8fc43fa4573c598196db4f9385608fbb120eafce2f12eebb78944e5c5407
Opcode Fuzzy Hash: 5c8dc5745aa920ab37b1c2f184270a95cd81a2f21722cc99720fa7e1b7206489
Instruction Fuzzy Hash: F5012436B201180BDFA5A67DCC243EE3AA79BC9310F00443AE60AE7348EE608C0287D0

Uniqueness

Uniqueness Score: -1.00%

Function 068F3868 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d0e6970d3e31cd995a9d1a95fe8a8165316019ad7e667b2688197598c88c6d1
Instruction ID: e08c0bb65cee02fce35e128c26619f265769a489270d006a557bcbcfefd903d1
Opcode Fuzzy Hash: 3d0e6970d3e31cd995a9d1a95fe8a8165316019ad7e667b2688197598c88c6d1
Instruction Fuzzy Hash: 1B11E4B5D112199FCB10DF9AD885ADEFBB4FF48310F10812AE918A7340D3756944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 068FED99 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81779d889f99d70941744d42ef2f04ecaec55e5c7780839d90eabc0a2f909a7c
Instruction ID: 25de51ddd96c1fe90870a2812bf7d64ca812988ec51afd3267b8ab3355b6e5ca
Opcode Fuzzy Hash: 81779d889f99d70941744d42ef2f04ecaec55e5c7780839d90eabc0a2f909a7c
Instruction Fuzzy Hash: 1C01DF35B101102BCB71AA6DA86472F77DAEBC9710F10842AE70ECB385EA61EC028381

Uniqueness

Uniqueness Score: -1.00%

Function 068F41F8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cb0a7e2571c4ba2a2774ce467706c5cc5e6b7c70992368936f6ef51ef22714b
Instruction ID: 2d07a4e475620eee1f05430e2e9517de3ebce073b25d258bb64f99bd162497c1
Opcode Fuzzy Hash: 3cb0a7e2571c4ba2a2774ce467706c5cc5e6b7c70992368936f6ef51ef22714b
Instruction Fuzzy Hash: 24018135B201144FDB6496AEA45572FA7DADBCD720F20843AF60AC735ADE72EC424391

Uniqueness

Uniqueness Score: -1.00%

Function 068FEDA8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97e39377d869a365e89b2588723a35c38700deb05453f7d2c71094faaa09118f
Instruction ID: 098690dcce4c8827a786d782b81c84f362adfb5f9291b71c0d2ef423e63d6d2b
Opcode Fuzzy Hash: 97e39377d869a365e89b2588723a35c38700deb05453f7d2c71094faaa09118f
Instruction Fuzzy Hash: A3018135B201101BDBB5A66DA46872F66DAEBC9710F10843AE70EC7354EA65DC0243D1

Uniqueness

Uniqueness Score: -1.00%

Function 068FA318 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c40862871bd91b535146d85f395c3124530fb08e18eec23ec25e5a0166e74a5
Instruction ID: a74f63932415270192be1bf1273ab1a77290c12943d66188c9222c39ae12451d
Opcode Fuzzy Hash: 0c40862871bd91b535146d85f395c3124530fb08e18eec23ec25e5a0166e74a5
Instruction Fuzzy Hash: 8E013135B202104FDBA5E66DE85572E77DAEB89724F108469E60EDB384EE21EC018791

Uniqueness

Uniqueness Score: -1.00%

Function 068F6469 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb35797997aacceadb1326c49f1bba6ef0987bffa372ad76c459c229c132e16a
Instruction ID: f1cb075648198afa88687315aab6aed55f28cc6a14a91b470e6c1b931cc08e12
Opcode Fuzzy Hash: fb35797997aacceadb1326c49f1bba6ef0987bffa372ad76c459c229c132e16a
Instruction Fuzzy Hash: 9CE09271E34208ABDB70EF64C91876E77699752208F244AA1D704DB241F236D941C791

Uniqueness

Uniqueness Score: -1.00%

Function 068F6478 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3f40778c56a94cb1829351910999078a94cedfe7366333d70a95a28b265ea9a
Instruction ID: 114f545757e90d7fb81bfb27ffca33b48838705b8f51ba0ff0f808914c273d6b
Opcode Fuzzy Hash: a3f40778c56a94cb1829351910999078a94cedfe7366333d70a95a28b265ea9a
Instruction Fuzzy Hash: 55E01271E34108ABDF60EFB4D95575E77ADDB05214F208AA5D608D7201F176DE4187C1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 068F7698 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$q, xrefs: 068F7788
$q, xrefs: 068F7BF0
$q, xrefs: 068F77B9
$q, xrefs: 068F7C06
$q, xrefs: 068F7BFA
$q, xrefs: 068F77C5
$q, xrefs: 068F7BE4
$q, xrefs: 068F7794
$q, xrefs: 068F7B45
$q, xrefs: 068F7B51

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-1298971921
Opcode ID: 65a767a2179156307e2f372be31a12a941b48853b9721e3f40d992585261997c
Instruction ID: a3a0390976b874a19304826e117795a2cbfe6d5000683cd4e17e192135e4ec9e
Opcode Fuzzy Hash: 65a767a2179156307e2f372be31a12a941b48853b9721e3f40d992585261997c
Instruction Fuzzy Hash: 31121B31E102198FEB64DB69E854B9EB7B2FF88705F218569D606EB354DB30DD81CB80

Uniqueness

Uniqueness Score: -1.00%

Function 068FA940 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$q, xrefs: 068FAAFE
$q, xrefs: 068FAA9D
$q, xrefs: 068FAAF2
$q, xrefs: 068FAA91
$q, xrefs: 068FAA42
$q, xrefs: 068FAAC8
$q, xrefs: 068FAA36
$q, xrefs: 068FAABC

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-3886557441
Opcode ID: 63652d0ffd744ad88649f92e3cfdc295903a5833313b91230c12238a97c492d8
Instruction ID: ae37a68d00ad39516fd63e8648eeeea450ed7a28551738d602525f6246a380a7
Opcode Fuzzy Hash: 63652d0ffd744ad88649f92e3cfdc295903a5833313b91230c12238a97c492d8
Instruction Fuzzy Hash: 6391CF30E20209DFEB68DB65D544BAE7BF2BF44314F108529EA09EB384DB74AC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 068F7098 Relevance: 7.9, Strings: 6, Instructions: 405COMMON

Download Yara Rule

Strings

$q, xrefs: 068F73E0
$q, xrefs: 068F75AC
$q, xrefs: 068F73D4
$q, xrefs: 068F737A
$q, xrefs: 068F7534
$q, xrefs: 068F75A0

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: bd48055952aee1751394e1c1e97032397c84940d3ff8e8c398cf5bbaa381b3c8
Instruction ID: adb5abefb03833a26a43e4d831b410c53eccb27c5acb039640ae03de2da5a879
Opcode Fuzzy Hash: bd48055952aee1751394e1c1e97032397c84940d3ff8e8c398cf5bbaa381b3c8
Instruction Fuzzy Hash: DDF14F30A10309CFEB58EB65D454BAEBBB2BF88705F248568D615DB398DB35EC42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 068F83D0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$q, xrefs: 068F8636
$q, xrefs: 068F869B
$q, xrefs: 068F868F
$q, xrefs: 068F862A

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 060bdd371d3537f6ac79fed92d0b9dcfcec96fe16766e3b1a96fa96719cb9057
Instruction ID: f0f891c9ec7e20455fff3c581ddb6a47a4180b32128963cfdfb0ab18053c5218
Opcode Fuzzy Hash: 060bdd371d3537f6ac79fed92d0b9dcfcec96fe16766e3b1a96fa96719cb9057
Instruction Fuzzy Hash: 60B14C70F202098FDB68DBA5D8547AEBBB2BF88305F248569D605DB394DB74DC42CB80

Uniqueness

Uniqueness Score: -1.00%

Function 068FACC8 Relevance: 5.2, Strings: 4, Instructions: 169COMMON

Download Yara Rule

Strings

$q, xrefs: 068FADF9
$q, xrefs: 068FAE7B
$q, xrefs: 068FAE4C
$q, xrefs: 068FAEA4

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: ac8337ec35dffe4e16613ba9b30dbbfce85ba381c67fdd05e5f63248dfc4e7c9
Instruction ID: 47d61e298d2fa64034b5f9b1e34e8b7f585f0ff4cf1b21b14b351f8ff03fbbd5
Opcode Fuzzy Hash: ac8337ec35dffe4e16613ba9b30dbbfce85ba381c67fdd05e5f63248dfc4e7c9
Instruction Fuzzy Hash: 69519534F20205CFDFA9EB64D4806ADB7B6EB88725F148529EA09DB344DB31EC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 068F87E8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LRq, xrefs: 068F88DB
$q, xrefs: 068F8867
LRq, xrefs: 068F892A
$q, xrefs: 068F8873

Memory Dump Source

Source File: 00000003.00000002.2598021793.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68f0000_PO#50124.jbxd

Similarity

API ID:
String ID: LRq$LRq$$q$$q
API String ID: 0-2204215535
Opcode ID: a30e8c8fa20d4b6507278bd9d7771478bc8ca7f9eb242f5489f0b79677f2b889
Instruction ID: 4d37595e9a984dd8f1f22744f0126a4cbd096964a648e1d040742faa8028ff6f
Opcode Fuzzy Hash: a30e8c8fa20d4b6507278bd9d7771478bc8ca7f9eb242f5489f0b79677f2b889
Instruction Fuzzy Hash: AC51A170B202058FDB58DB68D840B6EB7F6BF89714B148669E601DB354DA30EC45CB91

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO#50124.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO#50124.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
PO#50124.exe

Function 013AABD0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 013AB838 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 07690656 Relevance: 1.3, Strings: 1, Instructions: 51
COMMON

Function 07691768 Relevance: .3, Instructions: 286
COMMON

Function 010BD06C Relevance: .1, Instructions: 77
COMMON

Function 0769010F Relevance: .1, Instructions: 73
COMMON

Function 010DD01C Relevance: .1, Instructions: 72
COMMON

Function 010DD2F0 Relevance: .1, Instructions: 72
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre