Play interactive tour

Edit tour

Analysis Report NDKr3inJa9dXEu3.exe

Overview

General Information

Sample Name:	NDKr3inJa9dXEu3.exe
Analysis ID:	358345
MD5:	c52d827c2b63af9a81b1328a2c027cd7
SHA1:	397dba569945139e35a83d27fcddf6dc59b8570d
SHA256:	63e89e3a9aa5843b13a2148eb97a2a2168f15953ec31a31d819b29e770bb7ac0
Tags:	AgentTeslaexe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AgentTesla

Yara detected AntiVM_3

.NET source code contains very large array initializations

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains strange resources

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

NDKr3inJa9dXEu3.exe (PID: 2148 cmdline: 'C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe' MD5: C52D827C2B63AF9A81B1328A2C027CD7)

schtasks.exe (PID: 6120 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\WnAbgkeoRZ' /XML 'C:\Users\user\AppData\Local\Temp\tmp5ED6.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

NDKr3inJa9dXEu3.exe (PID: 5464 cmdline: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe MD5: C52D827C2B63AF9A81B1328A2C027CD7)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "FTP Info": "admin@estagold.com.myestagold202584mail.estagold.com.mybmathena@accesesdata.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.208485443.0000000003D57000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.465125878.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.207036719.0000000002AF1000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000004.00000002.470294179.00000000032C1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.470294179.00000000032C1000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.207090813.0000000002B34000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: NDKr3inJa9dXEu3.exe PID: 5464	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: NDKr3inJa9dXEu3.exe PID: 5464	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: NDKr3inJa9dXEu3.exe PID: 2148	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: NDKr3inJa9dXEu3.exe PID: 2148	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.NDKr3inJa9dXEu3.exe.3daa5c0.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.NDKr3inJa9dXEu3.exe.2b20560.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
4.2.NDKr3inJa9dXEu3.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.NDKr3inJa9dXEu3.exe.3daa5c0.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Sigma Overview

System Summary:

Sigma detected: Scheduled temp file as task from temp location

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\WnAbgkeoRZ' /XML 'C:\Users\user\AppData\Local\Temp\tmp5ED6.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\WnAbgkeoRZ' /XML 'C:\Users\user\AppData\Local\Temp\tmp5ED6.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe' , ParentImage: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe, ParentProcessId: 2148, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\WnAbgkeoRZ' /XML 'C:\Users\user\AppData\Local\Temp\tmp5ED6.tmp', ProcessId: 6120

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 1.2.NDKr3inJa9dXEu3.exe.3daa5c0.4.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "FTP Info": "admin@estagold.com.myestagold202584mail.estagold.com.mybmathena@accesesdata.com"}

Multi AV Scanner detection for submitted file

Show sources

Source: NDKr3inJa9dXEu3.exe

Virustotal: Detection: 23%

Perma Link

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\WnAbgkeoRZ.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: NDKr3inJa9dXEu3.exe

Joe Sandbox ML: detected

Source: 4.2.NDKr3inJa9dXEu3.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Compliance:

Uses 32bit PE files

Show sources

Source: NDKr3inJa9dXEu3.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: NDKr3inJa9dXEu3.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49740 -> 103.6.196.156:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49741 -> 103.6.196.156:587

Source: global traffic

TCP traffic: 192.168.2.3:49740 -> 103.6.196.156:587

Source: Joe Sandbox View

IP Address: 103.6.196.156 103.6.196.156

Source: Joe Sandbox View

ASN Name: EXABYTES-AS-APExaBytesNetworkSdnBhdMY EXABYTES-AS-APExaBytesNetworkSdnBhdMY

Source: global traffic

TCP traffic: 192.168.2.3:49740 -> 103.6.196.156:587

Source: unknown

DNS traffic detected: queries for: mail.estagold.com.my

Source: NDKr3inJa9dXEu3.exe, 00000004.00000002.470294179.00000000032C1000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: NDKr3inJa9dXEu3.exe, 00000004.00000002.470294179.00000000032C1000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: NDKr3inJa9dXEu3.exe, 00000004.00000002.470294179.00000000032C1000.00000004.00000001.sdmp	String found in binary or memory: http://d58Epg6G54Y2z.org
Source: NDKr3inJa9dXEu3.exe, 00000004.00000002.472593846.0000000003574000.00000004.00000001.sdmp	String found in binary or memory: http://estagold.com.my
Source: NDKr3inJa9dXEu3.exe, 00000004.00000002.472593846.0000000003574000.00000004.00000001.sdmp	String found in binary or memory: http://mail.estagold.com.my
Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.207036719.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: NDKr3inJa9dXEu3.exe, 00000004.00000002.470294179.00000000032C1000.00000004.00000001.sdmp	String found in binary or memory: http://vHuoap.com
Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.207036719.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.208485443.0000000003D57000.00000004.00000001.sdmp, NDKr3inJa9dXEu3.exe, 00000004.00000002.465125878.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: NDKr3inJa9dXEu3.exe, 00000004.00000002.470294179.00000000032C1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 4.2.NDKr3inJa9dXEu3.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b0A69782Cu002dCC38u002d4531u002d980Du002d15391B4A1CA5u007d/u00305C1E7E3u002d84D2u002d49AEu002d9CDBu002d7125A6AE99F0.cs

Large array initialization: .cctor: array initializer size 11963

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 1_2_00F2C888	1_2_00F2C888
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 1_2_00F2AED4	1_2_00F2AED4
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_0143C968	4_2_0143C968
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_01432520	4_2_01432520
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_01430040	4_2_01430040
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_014366B1	4_2_014366B1
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_0143C570	4_2_0143C570
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_0143D8B0	4_2_0143D8B0
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_016E1908	4_2_016E1908
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_016E299C	4_2_016E299C
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_016E0040	4_2_016E0040
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_016EB7E8	4_2_016EB7E8
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_016E5E10	4_2_016E5E10
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_016E0022	4_2_016E0022
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_016EAF98	4_2_016EAF98
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_016EF230	4_2_016EF230
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_032747A0	4_2_032747A0
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_03273CCC	4_2_03273CCC
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_03274730	4_2_03274730
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_03274750	4_2_03274750
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_032746B0	4_2_032746B0
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_032746F0	4_2_032746F0
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_03275490	4_2_03275490
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_0327D820	4_2_0327D820
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_06696C68	4_2_06696C68
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_066994F8	4_2_066994F8
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_06697538	4_2_06697538
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_06696920	4_2_06696920

Source: NDKr3inJa9dXEu3.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WnAbgkeoRZ.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.211264396.0000000005D10000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLegacyPathHandling.dllN vs NDKr3inJa9dXEu3.exe
Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.211484699.0000000006458000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignatureDescription.exe< vs NDKr3inJa9dXEu3.exe
Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.208485443.0000000003D57000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamemVwpcvWDCJFhCKROeeZLxPCBImYvnKQqhjmag.exe4 vs NDKr3inJa9dXEu3.exe
Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.211550303.00000000067D0000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs NDKr3inJa9dXEu3.exe
Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.207036719.0000000002AF1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameAsyncState.dllF vs NDKr3inJa9dXEu3.exe
Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.211746810.00000000068C0000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs NDKr3inJa9dXEu3.exe
Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.211746810.00000000068C0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs NDKr3inJa9dXEu3.exe
Source: NDKr3inJa9dXEu3.exe, 00000004.00000002.466417006.0000000000FE4000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameDSASignatureDescription.exe< vs NDKr3inJa9dXEu3.exe
Source: NDKr3inJa9dXEu3.exe, 00000004.00000002.466551814.0000000001198000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs NDKr3inJa9dXEu3.exe
Source: NDKr3inJa9dXEu3.exe, 00000004.00000002.465125878.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamemVwpcvWDCJFhCKROeeZLxPCBImYvnKQqhjmag.exe4 vs NDKr3inJa9dXEu3.exe
Source: NDKr3inJa9dXEu3.exe, 00000004.00000002.468991903.00000000016F0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs NDKr3inJa9dXEu3.exe
Source: NDKr3inJa9dXEu3.exe, 00000004.00000002.469220197.00000000017B0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx.mui vs NDKr3inJa9dXEu3.exe
Source: NDKr3inJa9dXEu3.exe, 00000004.00000002.469131698.00000000017A0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx vs NDKr3inJa9dXEu3.exe
Source: NDKr3inJa9dXEu3.exe	Binary or memory string: OriginalFilenameDSASignatureDescription.exe< vs NDKr3inJa9dXEu3.exe

Source: NDKr3inJa9dXEu3.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 4.2.NDKr3inJa9dXEu3.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.NDKr3inJa9dXEu3.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/5@4/1

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe

File created: C:\Users\user\AppData\Roaming\WnAbgkeoRZ.exe

Jump to behavior

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Mutant created: \Sessions\1\BaseNamedObjects\EOvWcjvLJWhNJaPsmkEpkX
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6080:120:WilError_01

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe

File created: C:\Users\user\AppData\Local\Temp\tmp5ED6.tmp

Jump to behavior

Source: NDKr3inJa9dXEu3.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.207036719.0000000002AF1000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.207036719.0000000002AF1000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);

Source: NDKr3inJa9dXEu3.exe

Virustotal: Detection: 23%

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe

File read: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe 'C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\WnAbgkeoRZ' /XML 'C:\Users\user\AppData\Local\Temp\tmp5ED6.tmp'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\WnAbgkeoRZ' /XML 'C:\Users\user\AppData\Local\Temp\tmp5ED6.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process created: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Jump to behavior

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: NDKr3inJa9dXEu3.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: NDKr3inJa9dXEu3.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_01434DCC push es; ret		4_2_01434DD0
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Code function: 4_2_06698540 push es; ret		4_2_06698550

Source: initial sample	Static PE information: section name: .text entropy: 7.00995424289
Source: initial sample	Static PE information: section name: .text entropy: 7.00995424289

Persistence and Installation Behavior:

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe

File created: C:\Users\user\AppData\Roaming\WnAbgkeoRZ.exe

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: unknown

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\WnAbgkeoRZ' /XML 'C:\Users\user\AppData\Local\Temp\tmp5ED6.tmp'

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM_3

Show sources

Source: Yara match	File source: 00000001.00000002.207036719.0000000002AF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.207090813.0000000002B34000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NDKr3inJa9dXEu3.exe PID: 2148, type: MEMORY
Source: Yara match	File source: 1.2.NDKr3inJa9dXEu3.exe.2b20560.1.raw.unpack, type: UNPACKEDPE

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.207090813.0000000002B34000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.207036719.0000000002AF1000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.207036719.0000000002AF1000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum name: 0	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Window / User API: threadDelayed 3247			Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Window / User API: threadDelayed 6565			Jump to behavior

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe TID: 2992	Thread sleep time: -100139s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe TID: 5492	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe TID: 6128	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe TID: 952	Thread sleep count: 3247 > 30	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe TID: 952	Thread sleep count: 6565 > 30	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe TID: 6128	Thread sleep count: 39 > 30	Jump to behavior

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.207036719.0000000002AF1000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.207036719.0000000002AF1000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.207090813.0000000002B34000.00000004.00000001.sdmp	Binary or memory string: l%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.207090813.0000000002B34000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.207036719.0000000002AF1000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.207090813.0000000002B34000.00000004.00000001.sdmp	Binary or memory string: l"SOFTWARE\VMware, Inc.\VMware T<
Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.207090813.0000000002B34000.00000004.00000001.sdmp	Binary or memory string: l"SOFTWARE\VMware, Inc.\VMware T
Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.207090813.0000000002B34000.00000004.00000001.sdmp	Binary or memory string: l"SOFTWARE\VMware, Inc.\VMware Tools
Source: NDKr3inJa9dXEu3.exe, 00000004.00000002.468709042.0000000001668000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: NDKr3inJa9dXEu3.exe, 00000001.00000002.207036719.0000000002AF1000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe

Code function: 4_2_01431790 LdrInitializeThunk,

4_2_01431790

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\WnAbgkeoRZ' /XML 'C:\Users\user\AppData\Local\Temp\tmp5ED6.tmp'			Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Process created: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe			Jump to behavior

Source: NDKr3inJa9dXEu3.exe, 00000004.00000002.469892438.0000000001D00000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: NDKr3inJa9dXEu3.exe, 00000004.00000002.469892438.0000000001D00000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: NDKr3inJa9dXEu3.exe, 00000004.00000002.469892438.0000000001D00000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: NDKr3inJa9dXEu3.exe, 00000004.00000002.469892438.0000000001D00000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Queries volume information: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Queries volume information: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe

Code function: 4_2_0669516C GetUserNameW,

4_2_0669516C

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000001.00000002.208485443.0000000003D57000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.465125878.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.470294179.00000000032C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NDKr3inJa9dXEu3.exe PID: 5464, type: MEMORY
Source: Yara match	File source: Process Memory Space: NDKr3inJa9dXEu3.exe PID: 2148, type: MEMORY
Source: Yara match	File source: 1.2.NDKr3inJa9dXEu3.exe.3daa5c0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.NDKr3inJa9dXEu3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.NDKr3inJa9dXEu3.exe.3daa5c0.4.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: 00000004.00000002.470294179.00000000032C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NDKr3inJa9dXEu3.exe PID: 5464, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000001.00000002.208485443.0000000003D57000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.465125878.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.470294179.00000000032C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NDKr3inJa9dXEu3.exe PID: 5464, type: MEMORY
Source: Yara match	File source: Process Memory Space: NDKr3inJa9dXEu3.exe PID: 2148, type: MEMORY
Source: Yara match	File source: 1.2.NDKr3inJa9dXEu3.exe.3daa5c0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.NDKr3inJa9dXEu3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.NDKr3inJa9dXEu3.exe.3daa5c0.4.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation311	Scheduled Task/Job1	Process Injection12	Disable or Modify Tools1	OS Credential Dumping2	Account Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job1	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Deobfuscate/Decode Files or Information1	Credentials in Registry1	File and Directory Discovery1	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information2	Security Account Manager	System Information Discovery114	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing2	NTDS	Query Registry1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Masquerading1	LSA Secrets	Security Software Discovery321	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion24	Cached Domain Credentials	Virtualization/Sandbox Evasion24	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Process Injection12	DCSync	Process Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	System Owner/User Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	Remote System Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
NDKr3inJa9dXEu3.exe	24%	Virustotal		Browse
NDKr3inJa9dXEu3.exe	9%	ReversingLabs	Win32.Trojan.Wacatac
NDKr3inJa9dXEu3.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\WnAbgkeoRZ.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\WnAbgkeoRZ.exe	9%	ReversingLabs	Win32.Trojan.Wacatac

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
4.2.NDKr3inJa9dXEu3.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

Source	Detection	Scanner	Label	Link
estagold.com.my	0%	Virustotal		Browse
mail.estagold.com.my	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://mail.estagold.com.my	0%	Avira URL Cloud	safe
http://vHuoap.com	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://d58Epg6G54Y2z.org	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://estagold.com.my	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
estagold.com.my	103.6.196.156	true	true	0%, Virustotal, Browse	unknown
mail.estagold.com.my	unknown	unknown	true	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	NDKr3inJa9dXEu3.exe, 00000004.00000002.470294179.00000000032C1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://DynDns.comDynDNS	NDKr3inJa9dXEu3.exe, 00000004.00000002.470294179.00000000032C1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://mail.estagold.com.my	NDKr3inJa9dXEu3.exe, 00000004.00000002.472593846.0000000003574000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://vHuoap.com	NDKr3inJa9dXEu3.exe, 00000004.00000002.470294179.00000000032C1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	NDKr3inJa9dXEu3.exe, 00000004.00000002.470294179.00000000032C1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://d58Epg6G54Y2z.org	NDKr3inJa9dXEu3.exe, 00000004.00000002.470294179.00000000032C1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	NDKr3inJa9dXEu3.exe, 00000001.00000002.207036719.0000000002AF1000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	NDKr3inJa9dXEu3.exe, 00000001.00000002.208485443.0000000003D57000.00000004.00000001.sdmp, NDKr3inJa9dXEu3.exe, 00000004.00000002.465125878.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	NDKr3inJa9dXEu3.exe, 00000001.00000002.207036719.0000000002AF1000.00000004.00000001.sdmp	false		high
http://estagold.com.my	NDKr3inJa9dXEu3.exe, 00000004.00000002.472593846.0000000003574000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.6.196.156	unknown	Malaysia		46015	EXABYTES-AS-APExaBytesNetworkSdnBhdMY	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	358345
Start date:	25.02.2021
Start time:	13:13:09
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	NDKr3inJa9dXEu3.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/5@4/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 1% (good quality ratio 0.7%) Quality average: 45.7% Quality standard deviation: 36.4%
HCA Information:	Successful, ratio: 100% Number of executed functions: 82 Number of non-executed functions: 2
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 104.42.151.234, 131.253.33.200, 13.107.22.200, 52.255.188.83, 104.43.193.48, 104.43.139.144, 51.104.139.180, 184.30.20.56, 20.54.26.129, 13.88.21.125, 8.253.95.249, 67.27.158.126, 8.248.139.254, 67.26.73.254, 8.248.115.254, 168.61.161.212, 13.64.90.137, 51.104.144.132, 92.122.213.194, 92.122.213.247 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, watson.telemetry.microsoft.com, auto.au.download.windowsupdate.com.c.footprint.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus17.cloudapp.net, skypedataprdcolcus16.cloudapp.net, skypedataprdcolcus15.cloudapp.net, dual-a-0001.dc-msedge.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net, skypedataprdcolwus15.cloudapp.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:13:55	API Interceptor	735x Sleep call for process: NDKr3inJa9dXEu3.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
103.6.196.156	https://www.webveiviseren.no/statistikk/usage/	Get hash	malicious	Browse	aunlianplastic.com/site_light/usage/owa/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
EXABYTES-AS-APExaBytesNetworkSdnBhdMY	Purchase List.exe	Get hash	malicious	Browse	103.6.196.156
	RFQ- 978002410.exe	Get hash	malicious	Browse	103.6.196.138
	CompensationClaim-46373845-02032021.xls	Get hash	malicious	Browse	103.6.198.29
	CompensationClaim-46373845-02032021.xls	Get hash	malicious	Browse	103.6.198.29
	bank TT slip.exe	Get hash	malicious	Browse	103.6.198.37
	Request Quotation.exe	Get hash	malicious	Browse	103.6.198.37
	bank details.exe	Get hash	malicious	Browse	103.6.198.37
	Statement Of Account.exe	Get hash	malicious	Browse	103.6.196.175
	3-321-68661.xls	Get hash	malicious	Browse	103.6.196.88
	Detailed 079.xls	Get hash	malicious	Browse	110.4.45.32
	Invoice_#_76493.xls	Get hash	malicious	Browse	110.4.45.32
	Notification #591501.xls	Get hash	malicious	Browse	110.4.45.32
	Notification #591501.xls	Get hash	malicious	Browse	110.4.45.32
	Notification #591501.xls	Get hash	malicious	Browse	110.4.45.32
	Report 290.xls	Get hash	malicious	Browse	110.4.45.32
	Report 290.xls	Get hash	malicious	Browse	110.4.45.32
	Report 290.xls	Get hash	malicious	Browse	110.4.45.32
	Fax 740.xls	Get hash	malicious	Browse	110.4.45.32
	iZT2CEFqiVFCf9W.exe	Get hash	malicious	Browse	103.6.198.43
	FFWMQQSH.EXE	Get hash	malicious	Browse	103.6.198.43

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NDKr3inJa9dXEu3.exe.log Download File
Process:	C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1406
Entropy (8bit):	5.341099307467139
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmER:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHg
MD5:	E5FA1A53BA6D70E18192AF6AF7CFDBFA
SHA1:	1C076481F11366751B8DA795C98A54DE8D1D82D5
SHA-256:	1D7BAA6D3EB5A504FD4652BC01A0864DEE898D35D9E29D03EB4A60B0D6405D83
SHA-512:	77850814E24DB48E3DDF9DF5B6A8110EE1A823BAABA800F89CD353EAC7F72E48B13F3F4A4DC8E5F0FAA707A7F14ED90577CF1CB106A0422F0BEDD1EFD2E940E4
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Temp\tmp5ED6.tmp Download File
Process:	C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1643
Entropy (8bit):	5.187928282029358
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBjtn:cbh47TlNQ//rydbz9I3YODOLNdq3L
MD5:	86DFB223E06A7EB192A19D6A1A5F5991
SHA1:	245EBB6FEF323BA97AB0AEFB9F69DC25EB326D92
SHA-256:	C3107DCD31C2E3AC283F48C2F2EC81A063ADCB4D5DD382B66F668D2DF303D87B
SHA-512:	3C48C74E8C4C7A01A6AA4728E01A64CD1A4F56AD8B8A68FDB12D0AC7B39A2717B67E3EBEB72EDC65E6A2FE09DED1767AF252E8978E432DB4B5E35257AE87889F
Malicious:	true
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Roaming\WnAbgkeoRZ.exe Download File
Process:	C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1024512
Entropy (8bit):	6.795376997370158
Encrypted:	false
SSDEEP:	12288:K+rReYqTLTxRdnHpe1QFl1rHWd9yWXVa2A///vOq:DrReYqTXx7Je1QFl1rHeXVG/Z
MD5:	C52D827C2B63AF9A81B1328A2C027CD7
SHA1:	397DBA569945139E35A83D27FCDDF6DC59B8570D
SHA-256:	63E89E3A9AA5843B13A2148EB97A2A2168F15953EC31A31D819B29E770BB7AC0
SHA-512:	3974E79EB87DBD0DC18BBAB000E9FAC031CFECE7BF0132F211D07066032B434593B1B75AF74F4258E9963784D1F863DDC647496D2BD58759BE3D54FF9E7E4C69
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 9%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....m7`..............P..............,... ........@.. ....................................@..................................,..K....@............................................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc..............................@..B.................,......H...........~...........................................................0..#.......+.&...(....(..........(.....o.......................0..........+.&..8......8.....+:...a.+....a....XE............"...X.....(m....+......&...+..8..&(m....+...&YE............(...7...Q...Z...c...l...u..........+.8~.....(.....4.8o.....(.....3.8`.....(.....2.8Q........&+.(....8<....7.87.....9.8......1.8%.....0.8......6.8......(....+..8.....5.8........0..........+.&...+$.."a.+..."a8s.....#Y+@..+...

C:\Users\user\AppData\Roaming\WnAbgkeoRZ.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\fqwupbgg.4et\Chrome\Default\Cookies Download File
Process:	C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6970840431455908
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBocLgAZOZD/0:T5LLOpEO5J/Kn7U1uBo8NOZ0
MD5:	00681D89EDDB6AD25E6F4BD2E66C61C6
SHA1:	14B2FBFB460816155190377BBC66AB5D2A15F7AB
SHA-256:	8BF06FD5FAE8199D261EB879E771146AE49600DBDED7FDC4EAC83A8C6A7A5D85
SHA-512:	159A9DE664091A3986042B2BE594E989FD514163094AC606DC3A6A7661A66A78C0D365B8CA2C94B8BC86D552E59D50407B4680EDADB894320125F0E9F48872D3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.795376997370158
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	NDKr3inJa9dXEu3.exe
File size:	1024512
MD5:	c52d827c2b63af9a81b1328a2c027cd7
SHA1:	397dba569945139e35a83d27fcddf6dc59b8570d
SHA256:	63e89e3a9aa5843b13a2148eb97a2a2168f15953ec31a31d819b29e770bb7ac0
SHA512:	3974e79eb87dbd0dc18bbab000e9fac031cfece7bf0132f211d07066032b434593b1b75af74f4258e9963784d1f863ddc647496d2bd58759be3d54ff9e7e4c69
SSDEEP:	12288:K+rReYqTLTxRdnHpe1QFl1rHWd9yWXVa2A///vOq:DrReYqTXx7Je1QFl1rHeXVG/Z
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....m7`..............P..............,... ........@.. ....................................@................................

File Icon


Icon Hash:	206ae682a280a906

Static PE Info

General
Entrypoint:	0x4d2cde
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x60376DFC [Thu Feb 25 09:29:32 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd2c90	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x29000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xfe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xd0ce4	0xd0e00	False	0.592011940829	data	7.00995424289	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xd4000	0x29000	0x29000	False	0.0339176829268	data	3.30773665372	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xfe000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xd42e0	0x4f2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0xd47d4	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 4278496986, next used block 4278496986
RT_ICON	0xe4ffc	0x94a8	data
RT_ICON	0xee4a4	0x5488	data
RT_ICON	0xf392c	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 0, next used block 0
RT_ICON	0xf7b54	0x25a8	data
RT_ICON	0xfa0fc	0x10a8	data
RT_ICON	0xfb1a4	0x988	data
RT_ICON	0xfbb2c	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0xfbf94	0x84	data
RT_GROUP_ICON	0xfc018	0x14	data
RT_VERSION	0xfc02c	0x368	data
RT_MANIFEST	0xfc394	0xb15	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF, LF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2014
Assembly Version	3.0.0.0
InternalName	DSASignatureDescription.exe
FileVersion	3.0.0.0
CompanyName	KTV
LegalTrademarks
Comments
ProductName	KTVManagement
ProductVersion	3.0.0.0
FileDescription	KTVManagement
OriginalFilename	DSASignatureDescription.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
02/25/21-13:15:39.408011	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49740	587	192.168.2.3	103.6.196.156
02/25/21-13:15:43.573991	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49741	587	192.168.2.3	103.6.196.156

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 25, 2021 13:15:37.219960928 CET	49740	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:37.462656975 CET	587	49740	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:37.462773085 CET	49740	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:37.988204002 CET	587	49740	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:37.988688946 CET	49740	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:38.222326994 CET	587	49740	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:38.224571943 CET	49740	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:38.458317041 CET	587	49740	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:38.458898067 CET	49740	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:38.699927092 CET	587	49740	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:38.700957060 CET	49740	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:38.934817076 CET	587	49740	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:38.935199022 CET	49740	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:39.170259953 CET	587	49740	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:39.170469999 CET	49740	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:39.403994083 CET	587	49740	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:39.404026985 CET	587	49740	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:39.408010960 CET	49740	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:39.408222914 CET	49740	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:39.408355951 CET	49740	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:39.408499956 CET	49740	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:39.641700983 CET	587	49740	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:39.641877890 CET	587	49740	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:39.738096952 CET	587	49740	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:39.786835909 CET	49740	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:40.673029900 CET	49740	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:40.909938097 CET	587	49740	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:40.910262108 CET	49740	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:40.911627054 CET	49740	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:41.132333994 CET	49741	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:41.145011902 CET	587	49740	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:41.359195948 CET	587	49741	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:41.359333038 CET	49741	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:42.196867943 CET	587	49741	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:42.197593927 CET	49741	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:42.424637079 CET	587	49741	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:42.425134897 CET	49741	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:42.652947903 CET	587	49741	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:42.653850079 CET	49741	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:42.884433031 CET	587	49741	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:42.886369944 CET	49741	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:43.115370035 CET	587	49741	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:43.115833044 CET	49741	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:43.344393015 CET	587	49741	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:43.344901085 CET	49741	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:43.571710110 CET	587	49741	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:43.571811914 CET	587	49741	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:43.573740005 CET	49741	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:43.573991060 CET	49741	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:43.574096918 CET	49741	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:43.574201107 CET	49741	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:43.574368954 CET	49741	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:43.574455023 CET	49741	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:43.574537992 CET	49741	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:43.574619055 CET	49741	587	192.168.2.3	103.6.196.156
Feb 25, 2021 13:15:43.803039074 CET	587	49741	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:43.803369999 CET	587	49741	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:43.803601027 CET	587	49741	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:43.897942066 CET	587	49741	103.6.196.156	192.168.2.3
Feb 25, 2021 13:15:43.943551064 CET	49741	587	192.168.2.3	103.6.196.156

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 25, 2021 13:13:47.794286013 CET	49199	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:13:47.844525099 CET	53	49199	8.8.8.8	192.168.2.3
Feb 25, 2021 13:13:47.849242926 CET	50620	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:13:47.900942087 CET	53	50620	8.8.8.8	192.168.2.3
Feb 25, 2021 13:13:48.966368914 CET	64938	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:13:49.015219927 CET	53	64938	8.8.8.8	192.168.2.3
Feb 25, 2021 13:13:49.823757887 CET	60152	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:13:49.875453949 CET	53	60152	8.8.8.8	192.168.2.3
Feb 25, 2021 13:13:50.651333094 CET	57544	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:13:50.700170994 CET	53	57544	8.8.8.8	192.168.2.3
Feb 25, 2021 13:13:51.622975111 CET	55984	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:13:51.672077894 CET	53	55984	8.8.8.8	192.168.2.3
Feb 25, 2021 13:14:21.063409090 CET	64185	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:14:21.112258911 CET	53	64185	8.8.8.8	192.168.2.3
Feb 25, 2021 13:14:23.213094950 CET	65110	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:14:23.265486956 CET	53	65110	8.8.8.8	192.168.2.3
Feb 25, 2021 13:14:26.502511978 CET	58361	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:14:26.572556019 CET	53	58361	8.8.8.8	192.168.2.3
Feb 25, 2021 13:14:39.245309114 CET	63492	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:14:39.310409069 CET	53	63492	8.8.8.8	192.168.2.3
Feb 25, 2021 13:14:42.618647099 CET	60831	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:14:42.671966076 CET	53	60831	8.8.8.8	192.168.2.3
Feb 25, 2021 13:14:43.174786091 CET	60100	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:14:43.224875927 CET	53	60100	8.8.8.8	192.168.2.3
Feb 25, 2021 13:14:45.860286951 CET	53195	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:14:45.908855915 CET	53	53195	8.8.8.8	192.168.2.3
Feb 25, 2021 13:14:47.382839918 CET	50141	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:14:47.434655905 CET	53	50141	8.8.8.8	192.168.2.3
Feb 25, 2021 13:14:48.567085981 CET	53023	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:14:48.615760088 CET	53	53023	8.8.8.8	192.168.2.3
Feb 25, 2021 13:14:49.699915886 CET	49563	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:14:49.749664068 CET	53	49563	8.8.8.8	192.168.2.3
Feb 25, 2021 13:14:50.645895958 CET	51352	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:14:50.697346926 CET	53	51352	8.8.8.8	192.168.2.3
Feb 25, 2021 13:14:53.509497881 CET	59349	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:14:53.561062098 CET	53	59349	8.8.8.8	192.168.2.3
Feb 25, 2021 13:14:57.048566103 CET	57084	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:14:57.098632097 CET	53	57084	8.8.8.8	192.168.2.3
Feb 25, 2021 13:15:02.154098034 CET	58823	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:15:02.212759972 CET	53	58823	8.8.8.8	192.168.2.3
Feb 25, 2021 13:15:14.683739901 CET	57568	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:15:14.735873938 CET	53	57568	8.8.8.8	192.168.2.3
Feb 25, 2021 13:15:15.841717005 CET	50540	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:15:15.890506029 CET	53	50540	8.8.8.8	192.168.2.3
Feb 25, 2021 13:15:16.807022095 CET	54366	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:15:16.858503103 CET	53	54366	8.8.8.8	192.168.2.3
Feb 25, 2021 13:15:22.443159103 CET	53034	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:15:22.493446112 CET	53	53034	8.8.8.8	192.168.2.3
Feb 25, 2021 13:15:23.283706903 CET	57762	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:15:23.344743967 CET	53	57762	8.8.8.8	192.168.2.3
Feb 25, 2021 13:15:32.037843943 CET	55435	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:15:32.086483955 CET	53	55435	8.8.8.8	192.168.2.3
Feb 25, 2021 13:15:34.483572960 CET	50713	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:15:34.553822041 CET	53	50713	8.8.8.8	192.168.2.3
Feb 25, 2021 13:15:36.720400095 CET	56132	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:15:36.902743101 CET	53	56132	8.8.8.8	192.168.2.3
Feb 25, 2021 13:15:36.916362047 CET	58987	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:15:37.112339973 CET	53	58987	8.8.8.8	192.168.2.3
Feb 25, 2021 13:15:40.963608027 CET	56579	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:15:41.020692110 CET	53	56579	8.8.8.8	192.168.2.3
Feb 25, 2021 13:15:41.072596073 CET	60633	53	192.168.2.3	8.8.8.8
Feb 25, 2021 13:15:41.129863977 CET	53	60633	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 25, 2021 13:15:36.720400095 CET	192.168.2.3	8.8.8.8	0xa08f	Standard query (0)	mail.estagold.com.my	A (IP address)	IN (0x0001)
Feb 25, 2021 13:15:36.916362047 CET	192.168.2.3	8.8.8.8	0x58be	Standard query (0)	mail.estagold.com.my	A (IP address)	IN (0x0001)
Feb 25, 2021 13:15:40.963608027 CET	192.168.2.3	8.8.8.8	0x38f4	Standard query (0)	mail.estagold.com.my	A (IP address)	IN (0x0001)
Feb 25, 2021 13:15:41.072596073 CET	192.168.2.3	8.8.8.8	0xc70b	Standard query (0)	mail.estagold.com.my	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Feb 25, 2021 13:15:36.902743101 CET	8.8.8.8	192.168.2.3	0xa08f	No error (0)	mail.estagold.com.my	estagold.com.my		CNAME (Canonical name)	IN (0x0001)
Feb 25, 2021 13:15:36.902743101 CET	8.8.8.8	192.168.2.3	0xa08f	No error (0)	estagold.com.my		103.6.196.156	A (IP address)	IN (0x0001)
Feb 25, 2021 13:15:37.112339973 CET	8.8.8.8	192.168.2.3	0x58be	No error (0)	mail.estagold.com.my	estagold.com.my		CNAME (Canonical name)	IN (0x0001)
Feb 25, 2021 13:15:37.112339973 CET	8.8.8.8	192.168.2.3	0x58be	No error (0)	estagold.com.my		103.6.196.156	A (IP address)	IN (0x0001)
Feb 25, 2021 13:15:41.020692110 CET	8.8.8.8	192.168.2.3	0x38f4	No error (0)	mail.estagold.com.my	estagold.com.my		CNAME (Canonical name)	IN (0x0001)
Feb 25, 2021 13:15:41.020692110 CET	8.8.8.8	192.168.2.3	0x38f4	No error (0)	estagold.com.my		103.6.196.156	A (IP address)	IN (0x0001)
Feb 25, 2021 13:15:41.129863977 CET	8.8.8.8	192.168.2.3	0xc70b	No error (0)	mail.estagold.com.my	estagold.com.my		CNAME (Canonical name)	IN (0x0001)
Feb 25, 2021 13:15:41.129863977 CET	8.8.8.8	192.168.2.3	0xc70b	No error (0)	estagold.com.my		103.6.196.156	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Feb 25, 2021 13:15:37.988204002 CET	587	49740	103.6.196.156	192.168.2.3	220-datousaurus.mschosting.com ESMTP Exim 4.93 #2 Thu, 25 Feb 2021 20:15:21 +0800 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Feb 25, 2021 13:15:37.988688946 CET	49740	587	192.168.2.3	103.6.196.156	EHLO 910646
Feb 25, 2021 13:15:38.222326994 CET	587	49740	103.6.196.156	192.168.2.3	250-datousaurus.mschosting.com Hello 910646 [84.17.52.78] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Feb 25, 2021 13:15:38.224571943 CET	49740	587	192.168.2.3	103.6.196.156	AUTH login YWRtaW5AZXN0YWdvbGQuY29tLm15
Feb 25, 2021 13:15:38.458317041 CET	587	49740	103.6.196.156	192.168.2.3	334 UGFzc3dvcmQ6
Feb 25, 2021 13:15:38.699927092 CET	587	49740	103.6.196.156	192.168.2.3	235 Authentication succeeded
Feb 25, 2021 13:15:38.700957060 CET	49740	587	192.168.2.3	103.6.196.156	MAIL FROM:<admin@estagold.com.my>
Feb 25, 2021 13:15:38.934817076 CET	587	49740	103.6.196.156	192.168.2.3	250 OK
Feb 25, 2021 13:15:38.935199022 CET	49740	587	192.168.2.3	103.6.196.156	RCPT TO:<bmathena@accesesdata.com>
Feb 25, 2021 13:15:39.170259953 CET	587	49740	103.6.196.156	192.168.2.3	250 Accepted
Feb 25, 2021 13:15:39.170469999 CET	49740	587	192.168.2.3	103.6.196.156	DATA
Feb 25, 2021 13:15:39.404026985 CET	587	49740	103.6.196.156	192.168.2.3	354 Enter message, ending with "." on a line by itself
Feb 25, 2021 13:15:39.408499956 CET	49740	587	192.168.2.3	103.6.196.156	.
Feb 25, 2021 13:15:39.738096952 CET	587	49740	103.6.196.156	192.168.2.3	250 OK id=1lFFYB-00CrHB-2O
Feb 25, 2021 13:15:40.673029900 CET	49740	587	192.168.2.3	103.6.196.156	QUIT
Feb 25, 2021 13:15:40.909938097 CET	587	49740	103.6.196.156	192.168.2.3	221 datousaurus.mschosting.com closing connection
Feb 25, 2021 13:15:42.196867943 CET	587	49741	103.6.196.156	192.168.2.3	220-datousaurus.mschosting.com ESMTP Exim 4.93 #2 Thu, 25 Feb 2021 20:15:25 +0800 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Feb 25, 2021 13:15:42.197593927 CET	49741	587	192.168.2.3	103.6.196.156	EHLO 910646
Feb 25, 2021 13:15:42.424637079 CET	587	49741	103.6.196.156	192.168.2.3	250-datousaurus.mschosting.com Hello 910646 [84.17.52.78] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Feb 25, 2021 13:15:42.425134897 CET	49741	587	192.168.2.3	103.6.196.156	AUTH login YWRtaW5AZXN0YWdvbGQuY29tLm15
Feb 25, 2021 13:15:42.652947903 CET	587	49741	103.6.196.156	192.168.2.3	334 UGFzc3dvcmQ6
Feb 25, 2021 13:15:42.884433031 CET	587	49741	103.6.196.156	192.168.2.3	235 Authentication succeeded
Feb 25, 2021 13:15:42.886369944 CET	49741	587	192.168.2.3	103.6.196.156	MAIL FROM:<admin@estagold.com.my>
Feb 25, 2021 13:15:43.115370035 CET	587	49741	103.6.196.156	192.168.2.3	250 OK
Feb 25, 2021 13:15:43.115833044 CET	49741	587	192.168.2.3	103.6.196.156	RCPT TO:<bmathena@accesesdata.com>
Feb 25, 2021 13:15:43.344393015 CET	587	49741	103.6.196.156	192.168.2.3	250 Accepted
Feb 25, 2021 13:15:43.344901085 CET	49741	587	192.168.2.3	103.6.196.156	DATA
Feb 25, 2021 13:15:43.571811914 CET	587	49741	103.6.196.156	192.168.2.3	354 Enter message, ending with "." on a line by itself
Feb 25, 2021 13:15:43.574619055 CET	49741	587	192.168.2.3	103.6.196.156	.
Feb 25, 2021 13:15:43.897942066 CET	587	49741	103.6.196.156	192.168.2.3	250 OK id=1lFFYF-00CrHy-7w

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: NDKr3inJa9dXEu3.exe PID: 2148 Parent PID: 5732

General

Start time:	13:13:54
Start date:	25/02/2021
Path:	C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe'
Imagebase:	0x700000
File size:	1024512 bytes
MD5 hash:	C52D827C2B63AF9A81B1328A2C027CD7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.208485443.0000000003D57000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.207036719.0000000002AF1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.207090813.0000000002B34000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 6120 Parent PID: 2148

General

Start time:	13:13:57
Start date:	25/02/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\WnAbgkeoRZ' /XML 'C:\Users\user\AppData\Local\Temp\tmp5ED6.tmp'
Imagebase:	0xe60000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6080 Parent PID: 6120

General

Start time:	13:13:58
Start date:	25/02/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: NDKr3inJa9dXEu3.exe PID: 5464 Parent PID: 2148

General

Start time:	13:13:58
Start date:	25/02/2021
Path:	C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\NDKr3inJa9dXEu3.exe
Imagebase:	0xf10000
File size:	1024512 bytes
MD5 hash:	C52D827C2B63AF9A81B1328A2C027CD7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.465125878.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.470294179.00000000032C1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.470294179.00000000032C1000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: NDKr3inJa9dXEu3.exe PID: 2148 Parent PID: 5732 NDKr3inJa9dXEu3.exeCOMMON

Executed Functions

Function 00F27181, Relevance: 6.1, APIs: 4, Instructions: 123threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00F271F0
GetCurrentThread.KERNEL32 ref: 00F2722D
GetCurrentProcess.KERNEL32 ref: 00F2726A
GetCurrentThreadId.KERNEL32 ref: 00F272C3

Memory Dump Source

Source File: 00000001.00000002.206907191.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 2b720dbe944611b767ff0a86a1402aeb05d25ba393731e0379449f6db7402be4
Instruction ID: 335aa72782e190b940a3cb21e8d6a201aeafb4b6567dc77a7c17ea5d8bf217b2
Opcode Fuzzy Hash: 2b720dbe944611b767ff0a86a1402aeb05d25ba393731e0379449f6db7402be4
Instruction Fuzzy Hash: F15144B0E047498FDB14CFA9D688BAEBBF0EF49314F208459E019A7290D774A945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00F27190, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00F271F0
GetCurrentThread.KERNEL32 ref: 00F2722D
GetCurrentProcess.KERNEL32 ref: 00F2726A
GetCurrentThreadId.KERNEL32 ref: 00F272C3

Memory Dump Source

Source File: 00000001.00000002.206907191.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 9a425886f2fa42d54233416822d7340a3621cedc8c5df1cfc7eb25f8ec7c7163
Instruction ID: 04fccefce52ee103e30d5d45cd7835fcc427d74fc971be5000836de03d6570cc
Opcode Fuzzy Hash: 9a425886f2fa42d54233416822d7340a3621cedc8c5df1cfc7eb25f8ec7c7163
Instruction Fuzzy Hash: 9E5133B0E047498FDB14DFA9E648BAEBBF0AF48314F208459E019A7290D774A944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00F2C190, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F2C3E6

Strings

n, xrefs: 00F2C31E
n, xrefs: 00F2C343

Memory Dump Source

Source File: 00000001.00000002.206907191.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID: HandleModule
String ID: n$n
API String ID: 4139908857-2252431473
Opcode ID: b42af965c2029327b71bd10ed829d52bd8cec712c24f59aadcf210e1eb4dcd82
Instruction ID: 2f12e6e2e8d0b999224546098785ceae0de3e7aaf15d8af4cfabd9783be5fd11
Opcode Fuzzy Hash: b42af965c2029327b71bd10ed829d52bd8cec712c24f59aadcf210e1eb4dcd82
Instruction Fuzzy Hash: 9B713470A00B158FD724DF6AE4417AABBF1FF88314F108929E45ADBA40EB75E905CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F2E24C, Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00F2E36A

Memory Dump Source

Source File: 00000001.00000002.206907191.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 1456a42bd4122be7e648fdfaa90e4200ff1d2271e03578113591157854b944cb
Instruction ID: b1788e3eb217d8bb5a8bf039b696a33bfdd7db8fe661f31debaea82018e2d22a
Opcode Fuzzy Hash: 1456a42bd4122be7e648fdfaa90e4200ff1d2271e03578113591157854b944cb
Instruction Fuzzy Hash: 8A51DFB1D00318DFDB14CFA9D884ADEBFB5BF48314F24822AE819AB250D7749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F2E258, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00F2E36A

Memory Dump Source

Source File: 00000001.00000002.206907191.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 283b19666ad772e7154bf8287f35035158baf96d36873e6aa8612c67821cb9f5
Instruction ID: b339e5029f0fcd06ee425b0eeb7c639f511e5201c8dca19436b4bc1b50e095ca
Opcode Fuzzy Hash: 283b19666ad772e7154bf8287f35035158baf96d36873e6aa8612c67821cb9f5
Instruction Fuzzy Hash: 1141BEB1D00319DFDB14CFA9D884ADEBFB5BF48314F24822AE819AB250D7749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F28F1B, Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000004B), ref: 00F28F8D

Memory Dump Source

Source File: 00000001.00000002.206907191.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 5cdcca9a60889ad5d2790e1463c4cf8254a59111b71b0e074e12e40ce42373f9
Instruction ID: 7b11b8f3ed5d6996aa7727a369999acc5d75c8b748b01603623556129885932e
Opcode Fuzzy Hash: 5cdcca9a60889ad5d2790e1463c4cf8254a59111b71b0e074e12e40ce42373f9
Instruction Fuzzy Hash: 0C313E71E093948FDB00DFA9E5043BA7FF4EF04364F184869E844A7281DB78A956CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F277B8, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F27847

Memory Dump Source

Source File: 00000001.00000002.206907191.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e67699c170ac44c60814d4026d5c79e8c3bef318e6a013a3545ace4a687529da
Instruction ID: 412746f472c9c72b5e84d8a471925c2abf5c54b40ba90290fa2d5ee7e72ca6ec
Opcode Fuzzy Hash: e67699c170ac44c60814d4026d5c79e8c3bef318e6a013a3545ace4a687529da
Instruction Fuzzy Hash: F821E5B5D043089FDB10CFAAD484AEEBBF4FB48324F14841AE914A7350D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F277C0, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F27847

Memory Dump Source

Source File: 00000001.00000002.206907191.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ddfb05a33531976296d82beb43f0bd554b1b5c92e1e890765d7cf4e7ffac50fb
Instruction ID: f4f58b24ce0cf793d86472d756a44c3eb3dddfbbb75753a724ccb4c8cd4ab285
Opcode Fuzzy Hash: ddfb05a33531976296d82beb43f0bd554b1b5c92e1e890765d7cf4e7ffac50fb
Instruction Fuzzy Hash: 5721D5B5D002599FDB10CF9AD984ADEBBF4FF48324F14841AE914A7750D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F2B118, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00F2C461,00000800,00000000,00000000), ref: 00F2C672

Memory Dump Source

Source File: 00000001.00000002.206907191.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 27294cd9f2493453ef4b7c664437ff6ad6c976f4f3dca83a498fd72dd35dade8
Instruction ID: 2ea30f3d2ba98057747cf587bcf0186c63e820ea8edcb25fc5c1f685054cce0a
Opcode Fuzzy Hash: 27294cd9f2493453ef4b7c664437ff6ad6c976f4f3dca83a498fd72dd35dade8
Instruction Fuzzy Hash: 561103B2D042088FCB10CF9AD444BDEBBF4EB58324F15852AE519A7600C374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F2C600, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00F2C461,00000800,00000000,00000000), ref: 00F2C672

Memory Dump Source

Source File: 00000001.00000002.206907191.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ca50bc4fd9a02c295f8f3f177fded107d08332f49c3fa9be2aed542c0d2b0f60
Instruction ID: 4139434cfc189029a16649a59e2765643afee8a6d41eabad7c62be6b5b530872
Opcode Fuzzy Hash: ca50bc4fd9a02c295f8f3f177fded107d08332f49c3fa9be2aed542c0d2b0f60
Instruction Fuzzy Hash: 7D1114B6D043089FDB10CF9AD444BEEFBF4EB58324F14852AD819A7600C774A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F2C380, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F2C3E6

Memory Dump Source

Source File: 00000001.00000002.206907191.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: bdeae8d752918018a6c52f2ddb05e7b51a0f26eec0fbbc401974107086c90298
Instruction ID: 4da151750198def1be30cb5de0621e993cb79d6124a1074ed0f21ea7360b6a59
Opcode Fuzzy Hash: bdeae8d752918018a6c52f2ddb05e7b51a0f26eec0fbbc401974107086c90298
Instruction Fuzzy Hash: 6311C0B6D006598BDB10CF9AD444B9EBBF4AF88324F14842AD419A7600C374AA45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EAD4D8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.206841313.0000000000EAD000.00000040.00000001.sdmp, Offset: 00EAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19f4c99251d4f3a29347ffb3a45ee9cde7be52a5ab4dcd16c29f816c57dd3542
Instruction ID: a8cda2e0ba43cc7554b3df03225ad39ec6e59b0e37163a04d4cd75472f267946
Opcode Fuzzy Hash: 19f4c99251d4f3a29347ffb3a45ee9cde7be52a5ab4dcd16c29f816c57dd3542
Instruction Fuzzy Hash: D0214572908240DFCB00CF04DDC4B6ABBA5FB8D328F248569E8065F646C336E846DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EBD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.206854861.0000000000EBD000.00000040.00000001.sdmp, Offset: 00EBD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bf773ede0c6bbc777308e62692b82d0b526d339674696ca8231f40d1879af10
Instruction ID: 3a0c6180273757715329898fc30a969f5969ac35583ec691fdf2c67dfd0efb9c
Opcode Fuzzy Hash: 2bf773ede0c6bbc777308e62692b82d0b526d339674696ca8231f40d1879af10
Instruction Fuzzy Hash: 44212575508240DFCB14EF14DDC4B97BB66FB88318F24C969D8095B246D33AD846DA61

Uniqueness

Uniqueness Score: -1.00%

Function 00EBD005, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.206854861.0000000000EBD000.00000040.00000001.sdmp, Offset: 00EBD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6563dd6845e5532a132c87d264d482acae83e9bf72d25d8c8a03a4dd3bdde0cd
Instruction ID: 9a55a9d5a297cf85c51661f8627113f6964c8122a2f06d5e8a609be3eee0196c
Opcode Fuzzy Hash: 6563dd6845e5532a132c87d264d482acae83e9bf72d25d8c8a03a4dd3bdde0cd
Instruction Fuzzy Hash: 8521807550D3C08FCB02CF20D994756BF71EB46314F28C5EAD8498B697C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00EAD4D3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.206841313.0000000000EAD000.00000040.00000001.sdmp, Offset: 00EAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2afa457568e0bb640a5e96658e9777ab49a47e984ab559958fa4953148591eca
Instruction ID: 439d9bb7c82414196c9c67659731118a53410daf938b460389c0189de190d241
Opcode Fuzzy Hash: 2afa457568e0bb640a5e96658e9777ab49a47e984ab559958fa4953148591eca
Instruction Fuzzy Hash: 8211D676804240CFCB11CF10D9C4B56BF71FB99328F2486A9D8051F656C336D956CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EAD749, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.206841313.0000000000EAD000.00000040.00000001.sdmp, Offset: 00EAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdbbd279e1cc749d2a14858c74de4b1d28921cbc398a3c824d42dc52c0ca6a6f
Instruction ID: b70f3da4795acab59df9c8b2b784a183e941faceb1990f8b8a003e3e3d06b9ec
Opcode Fuzzy Hash: fdbbd279e1cc749d2a14858c74de4b1d28921cbc398a3c824d42dc52c0ca6a6f
Instruction Fuzzy Hash: 7001F77100C3849AE7244A15DD84BA7BB9CEF4A338F18D55BF9066FA82C379AC44C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 00EAD748, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.206841313.0000000000EAD000.00000040.00000001.sdmp, Offset: 00EAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 267423c872ba79b73d801114dca0860e574767264832d161eeffc5654ecc6eaa
Instruction ID: 28eb3c9b0898b6007374345c1d74a0833ef608e2af8d58b5d39be5ef67dd4f0c
Opcode Fuzzy Hash: 267423c872ba79b73d801114dca0860e574767264832d161eeffc5654ecc6eaa
Instruction Fuzzy Hash: 07F0C8714082449AE7248A05DC847A2FB98EB45738F18C45BFD051F682C379AC44CAB0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00F2C888, Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.206907191.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3ebfce53d540a4892eda951fdbb00444edac552c0dd068d7fb660e859adbf29
Instruction ID: 151823b0ca8016dc9d464279e1378bc832262808cf4bf589d2ea5ac15e8a6733
Opcode Fuzzy Hash: c3ebfce53d540a4892eda951fdbb00444edac552c0dd068d7fb660e859adbf29
Instruction Fuzzy Hash: 725259B1F497068FD710CF54E4885A97BB1FF40328FD28A09C5625BA91D3B865AACFC4

Uniqueness

Uniqueness Score: -1.00%

Function 00F2AED4, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.206907191.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8581fb85d0871e6522d2631f395425474bd287a47b0ca4d7a8cd7ba63e832ae
Instruction ID: 0e0b5cf4614a2c47f24d934a6391bf09fc74280585db105bdc426849d0f3705e
Opcode Fuzzy Hash: e8581fb85d0871e6522d2631f395425474bd287a47b0ca4d7a8cd7ba63e832ae
Instruction Fuzzy Hash: D3A17032E0021ACFCF05DFA5D8445EEB7F2FF85300B15856AE905AB225EB35A955DF80

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: NDKr3inJa9dXEu3.exe PID: 5464 Parent PID: 2148 NDKr3inJa9dXEu3.exeCOMMON

Executed Functions

Function 016EB7E8, Relevance: 2.3, APIs: 1, Instructions: 760libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 016EBF70

Memory Dump Source

Source File: 00000004.00000002.468954512.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2d5b3de1d051f0b9415241e5c286c63c7117e258b2b736cf4e7ee3514fac8a2f
Instruction ID: bee93e7984c074c7bb06d342d5ff3343404de8f38869764071eaf0c09170b5c7
Opcode Fuzzy Hash: 2d5b3de1d051f0b9415241e5c286c63c7117e258b2b736cf4e7ee3514fac8a2f
Instruction Fuzzy Hash: 3E620831E016198FCB24EF78C8586DDB7F2AF89304F1086A9D549AB354EF309E85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01431790, Relevance: 1.7, APIs: 1, Instructions: 180libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 014317D1

Memory Dump Source

Source File: 00000004.00000002.466944893.0000000001430000.00000040.00000001.sdmp, Offset: 01430000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 85517b6b27ef68d34ed6d4cc12f93d4dc9159881b0c0639a65d960475da1df04
Instruction ID: bf8641235c51fc392ff3a51f52acc4fb2b282d7bdb8d0d8fe3bbcfe73fbe2fc9
Opcode Fuzzy Hash: 85517b6b27ef68d34ed6d4cc12f93d4dc9159881b0c0639a65d960475da1df04
Instruction Fuzzy Hash: 42618E34A10208DBDB14EFB8E5487AEBBF2BF88715F108829D412A7364DF759846CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0669516C, Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 0669B633

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: c6128c1b7afe841db80e2180c289e31fccd715357b2279e63774220b3abf4ca1
Instruction ID: d83042038d736ffffb787ae23218d091c10a5aff151c15c68acde8a450e8abb2
Opcode Fuzzy Hash: c6128c1b7afe841db80e2180c289e31fccd715357b2279e63774220b3abf4ca1
Instruction Fuzzy Hash: 5251F370E002188FDF54CFAAD885BDEBBB5BF48314F158119E815AB350D774A845CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0669C718, Relevance: 7.0, APIs: 4, Instructions: 984libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669CB4D
KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: b74c6acc22c9fdfeb408c86eb5f2ac927e4886e2828c53f9623ad6b638a9af5d
Instruction ID: fa9138b1de80467993eabfb0a4f6b8a01fc0a1ce283fbe5c23dbe901d9c53aa8
Opcode Fuzzy Hash: b74c6acc22c9fdfeb408c86eb5f2ac927e4886e2828c53f9623ad6b638a9af5d
Instruction Fuzzy Hash: C6A2F774A01228CFCB64EF60D85869DB7B6BF89205F5085EED90AA3744DF349E85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0669C739, Relevance: 6.6, APIs: 4, Instructions: 637libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669CB4D
KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 44454db352373420fc143b4705867ef86357afc1e829336ba61dab1f3a6d9ec7
Instruction ID: 34d45325934c8a0602afdc3e4f010500acf5fbbd3f36fe638225b8d3657a1968
Opcode Fuzzy Hash: 44454db352373420fc143b4705867ef86357afc1e829336ba61dab1f3a6d9ec7
Instruction Fuzzy Hash: 4B62FA74901218CFCBA4EF60D85869DB7B6BF49206F5084EEDA0AA3744CF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669C77E, Relevance: 6.6, APIs: 4, Instructions: 630libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669CB4D
KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: d55a28ebd703e36caa73ee399fba54d06cf734300f80ff0851cd8a021c10e9fa
Instruction ID: 14c4ad945a66d23bbebe072384a7767a9f09fdb4e5b413e3b3689ae7cffa49d0
Opcode Fuzzy Hash: d55a28ebd703e36caa73ee399fba54d06cf734300f80ff0851cd8a021c10e9fa
Instruction Fuzzy Hash: B862FA74901218CFCBA4EF64D85869DB7B6BF49206F5084EEDA0AA3744CF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669C7C3, Relevance: 6.6, APIs: 4, Instructions: 623libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669CB4D
KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: fc83c1886e7e16dbe5392cebd96c61b423fd7a9546bfb2aa81a8597297ee1d37
Instruction ID: 587ca6f3970fb2cf48cfc69b98a268bcff78451e63a631268bbf6f9ae49b1138
Opcode Fuzzy Hash: fc83c1886e7e16dbe5392cebd96c61b423fd7a9546bfb2aa81a8597297ee1d37
Instruction Fuzzy Hash: 5C52FA74901218CFCBA4EF64D85869DB7B6BF49206F5084EEDA0AA3744CF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669CA1E, Relevance: 6.6, APIs: 4, Instructions: 560libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669CB4D
KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 541f38f73e99d6b3e5e5a1e9a388cdd0d5e27deafad095f9415687f3a4ceb250
Instruction ID: 693decc1e393a450c41b8aab89cb3c831260ce3f204e9e0dfcdffa323dc2f608
Opcode Fuzzy Hash: 541f38f73e99d6b3e5e5a1e9a388cdd0d5e27deafad095f9415687f3a4ceb250
Instruction Fuzzy Hash: 0A420B74901218CFCBA4EF64D85869DB7B6BF48206F5084EEDA0AA3744CF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669CA63, Relevance: 6.6, APIs: 4, Instructions: 551libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669CB4D
KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 67cc9832ccc8e93fe95800a816330e4f8ba21855998b6c40f0151402c79a24c8
Instruction ID: ab9e8240e3202b4f4a752095850c836dbdc46caf268ee5825dbb2ccacd47bb68
Opcode Fuzzy Hash: 67cc9832ccc8e93fe95800a816330e4f8ba21855998b6c40f0151402c79a24c8
Instruction Fuzzy Hash: 5042FA74901258CFCBA4EF64D85869DB7B6BF48206F5084EEDA0AA3744CF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669CA9F, Relevance: 6.5, APIs: 4, Instructions: 546libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669CB4D
KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: d76c5734aab1cfff4b83e55775364490adafd553bbb0f4322e6fe67033844bf1
Instruction ID: 1ac767ce74bdb6bfad46d3468793cd915ef431d80ad771902af19a3023b8f88b
Opcode Fuzzy Hash: d76c5734aab1cfff4b83e55775364490adafd553bbb0f4322e6fe67033844bf1
Instruction Fuzzy Hash: DC42FB74901258CFCBA4EF64D85869DB7B6BF48206F5084EEDA0AA3744CF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669CAE4, Relevance: 6.5, APIs: 4, Instructions: 539libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669CB4D
KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 2a9f482291ba17d6f105c83f19d7e0a219ece013a4054eee2f00f74690361fbe
Instruction ID: 745b3009dbc1e462c17acbf27aa06d784587e92629a54003437e977e2fcf615e
Opcode Fuzzy Hash: 2a9f482291ba17d6f105c83f19d7e0a219ece013a4054eee2f00f74690361fbe
Instruction Fuzzy Hash: 2642FB74901218CFCBA4EF64D85869DB7B6BF48206F5084EEDA0AA3744CF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669CB29, Relevance: 6.5, APIs: 4, Instructions: 532libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669CB4D
KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: f3ec904d14fd4d895179d05bb628b5cc243e047cc221753d43b9a262fbb3e5f0
Instruction ID: ebdfed1750a0b48955c86954306232a3b4256f1c014c4bf569349e0181896fae
Opcode Fuzzy Hash: f3ec904d14fd4d895179d05bb628b5cc243e047cc221753d43b9a262fbb3e5f0
Instruction Fuzzy Hash: B242FB74901218CFCB64EF64D85869DB7B6BF48206F5084EEDA0AA3744DF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 03276B1F, Relevance: 6.1, APIs: 4, Instructions: 147threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 03276BB0
GetCurrentThread.KERNEL32 ref: 03276BED
GetCurrentProcess.KERNEL32 ref: 03276C2A
GetCurrentThreadId.KERNEL32 ref: 03276C83

Memory Dump Source

Source File: 00000004.00000002.470193273.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: e28e3b0f0ea3b6ce9910e4499e97be32daba66632b01c647ee515fee8408722d
Instruction ID: 0679d4370d7ff448d227a9ef0af1a3e62057be12b42d8de320e00d7f7c419928
Opcode Fuzzy Hash: e28e3b0f0ea3b6ce9910e4499e97be32daba66632b01c647ee515fee8408722d
Instruction Fuzzy Hash: F1519BB09187898FDB11CFA9D94879EBFF0FF4A304F14849AD058AB391D7345888CB62

Uniqueness

Uniqueness Score: -1.00%

Function 03276B50, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 03276BB0
GetCurrentThread.KERNEL32 ref: 03276BED
GetCurrentProcess.KERNEL32 ref: 03276C2A
GetCurrentThreadId.KERNEL32 ref: 03276C83

Memory Dump Source

Source File: 00000004.00000002.470193273.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b48a35796319183d354d3f820cf8b37e4a24f5b2ede5d264db65ff8b7ca11ce0
Instruction ID: 6af4b27d0fa4ddcf0b9c9616deddeff8dfe939c7afd61956a050242a0718f878
Opcode Fuzzy Hash: b48a35796319183d354d3f820cf8b37e4a24f5b2ede5d264db65ff8b7ca11ce0
Instruction Fuzzy Hash: 025144B0A10A498FDB14CFA9D648BEEBBF1FF48314F248459E119A7350DB746988CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0669CB6E, Relevance: 5.0, APIs: 3, Instructions: 525libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 885c997ce6d79da00c391b70f2ee0b0cdf38aca967d67ccf146ad043464d42a0
Instruction ID: db2135e2488f9c444a603451b8bdf74808912824cdb182b208d0fef2e3c86c2c
Opcode Fuzzy Hash: 885c997ce6d79da00c391b70f2ee0b0cdf38aca967d67ccf146ad043464d42a0
Instruction Fuzzy Hash: 0A32FB74901228CFCB64EF64D85869DB7B6BF48206F5084EEDA0AA3744DF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669CBB3, Relevance: 5.0, APIs: 3, Instructions: 518libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 8753b6c8c9beef09012e7791f14cfebc579b23e6f3699f184e7ffaede96e791b
Instruction ID: c66b233326364f9d6c4aa8fb0a6bdf8f21b53e9c544fde4d945cbdcf7696e07d
Opcode Fuzzy Hash: 8753b6c8c9beef09012e7791f14cfebc579b23e6f3699f184e7ffaede96e791b
Instruction Fuzzy Hash: 5832FB74A01218CFCB64EF64D85869DB7B6BF48206F5084EEDA0AA3744DF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669CBF8, Relevance: 5.0, APIs: 3, Instructions: 511libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: a511909ff08ea930e70de67ee916d4102bb0549aab626263398ada5354303ec5
Instruction ID: e07bf8bcf991fae9999f5f1344f94a4df90726af44eccd613aa6efc8f11601a5
Opcode Fuzzy Hash: a511909ff08ea930e70de67ee916d4102bb0549aab626263398ada5354303ec5
Instruction Fuzzy Hash: 6C32FB74A01218CFCB64EF64D85869DB7B6BF48206F5084EEDA0AA3744DF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669CC3D, Relevance: 5.0, APIs: 3, Instructions: 504libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: ee832b8bb97a65ab24e4176a0b48117d92c685f5d28412a249bcefb37820105f
Instruction ID: 25c43bcedc225e50c552630a44ca854a167f47e4777b3b78fb09b05f2634612d
Opcode Fuzzy Hash: ee832b8bb97a65ab24e4176a0b48117d92c685f5d28412a249bcefb37820105f
Instruction Fuzzy Hash: 5132FB74A01218CFCB64EF64D85869DB7B6BF48206F5084EEDA0AA3744DF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669CC82, Relevance: 5.0, APIs: 3, Instructions: 497libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 98fc7e441b1e2a1fb33939bf5e95909f09489f2eb39f2e964af28362bc96801f
Instruction ID: 64ecaeaccf0ce482caab31090335b462ef3072b1b050c860f2239e68c2f260eb
Opcode Fuzzy Hash: 98fc7e441b1e2a1fb33939bf5e95909f09489f2eb39f2e964af28362bc96801f
Instruction Fuzzy Hash: D632FB74A01218CFCB64EF64D85869DB7B6BF48206F5084EEDA0AA3744DF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669CCC7, Relevance: 5.0, APIs: 3, Instructions: 490libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 8dafbd56fe3a1303272a8b150a3d8c3ee84151e06be46fed4a101f7bae7d9b00
Instruction ID: 9d263169337d0bfeda677a615f88e937a742869bb4dd87e3e7a67607aa3915ae
Opcode Fuzzy Hash: 8dafbd56fe3a1303272a8b150a3d8c3ee84151e06be46fed4a101f7bae7d9b00
Instruction Fuzzy Hash: DE320B74A01218CFCB64EF64D85869DB7B6BF48206F5084EEDA0AA3744DF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669CD0C, Relevance: 5.0, APIs: 3, Instructions: 483libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: d48f2b39cc23e8cc8ba6c967224f479369a395fb8fcfe9078e46acced0aae307
Instruction ID: dc6f4bbdbe075bedc20b2aa679e618cadd91b7947cf0bd1a3c2a54ce9199f0ef
Opcode Fuzzy Hash: d48f2b39cc23e8cc8ba6c967224f479369a395fb8fcfe9078e46acced0aae307
Instruction Fuzzy Hash: 2E22FA74A01228CFCB64EF64D85869DB7B6BF48206F5084EDDA0AA3744DF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669CD51, Relevance: 5.0, APIs: 3, Instructions: 476libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: bf567e73d0ebed92078e37dea4a588f8594dc23e83886709b6b0e6e6a092f4fa
Instruction ID: 6425c84b87ac16a838f4bb1d472efc989d9664b1841cec3f469684e8604df0af
Opcode Fuzzy Hash: bf567e73d0ebed92078e37dea4a588f8594dc23e83886709b6b0e6e6a092f4fa
Instruction Fuzzy Hash: 3D220974A01228CFCB64EF74D85869DB7B6BF48206F5084E9DA0AA3744CF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669CD96, Relevance: 5.0, APIs: 3, Instructions: 469libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 5d852b790e05d3164d65e79bb568b6697215aaa260ce7e6e5f7c7d894f5316e9
Instruction ID: 2aed315bc6882b9c9d261d1a440e2fa7f7880d12428d8cdffefec027e574de7d
Opcode Fuzzy Hash: 5d852b790e05d3164d65e79bb568b6697215aaa260ce7e6e5f7c7d894f5316e9
Instruction Fuzzy Hash: 8F220974A01228CFCB64EF74D85869DB7B6BF48206F5084E9DA0AA3744DF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669CDDB, Relevance: 5.0, APIs: 3, Instructions: 462libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: f25f4174dcd31fad2efb0439042bdd5b1cd0d62aa595459577d74cfa108a7fbc
Instruction ID: 925f01c510483053eb2569793cdd59955b174618a8f27ecb319f39d0da516649
Opcode Fuzzy Hash: f25f4174dcd31fad2efb0439042bdd5b1cd0d62aa595459577d74cfa108a7fbc
Instruction Fuzzy Hash: C4220A74A01228CFCB64EF74D85869DB7B6BF48206F5084E9DA0AA3744DF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669CE23, Relevance: 5.0, APIs: 3, Instructions: 455libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 6150b224a549166788a6cc96f87792a7c3666cce9e00ed6ddd2087eeeee0d6d6
Instruction ID: aa007a10777d2f00a6563b141f6bc4d79e7035b73c8a42b3c7e02392e42faf6e
Opcode Fuzzy Hash: 6150b224a549166788a6cc96f87792a7c3666cce9e00ed6ddd2087eeeee0d6d6
Instruction Fuzzy Hash: 46220B74A01228CFCB64EF74D85869DB7B6BF48206F5084E9DA0AA3744DF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669CE6B, Relevance: 4.9, APIs: 3, Instructions: 448libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 30d5bfbcc8f9a33fb36107193fc222f699543b5af8c7f7f60da95142c06986d6
Instruction ID: 5d16198baeb921c2f36b09867ffbd69f40f50fdc143c697e63425d856600b950
Opcode Fuzzy Hash: 30d5bfbcc8f9a33fb36107193fc222f699543b5af8c7f7f60da95142c06986d6
Instruction Fuzzy Hash: DE221B74A01228CFCB64EF74D85869DB7B6BF48206F5084E9DA0AA3744DF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669CEB3, Relevance: 4.9, APIs: 3, Instructions: 441libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 88b1a2407eb206bead31708fcb8a4c271715a6595005de419cb1634435b1d6d6
Instruction ID: b774b66c13bb0a50ee4e1537a98eda23a289f182ab6279b3292d2e7bbf1d486f
Opcode Fuzzy Hash: 88b1a2407eb206bead31708fcb8a4c271715a6595005de419cb1634435b1d6d6
Instruction Fuzzy Hash: 84121B74A01228CFCB64EF74D85869DB7B6BF48206F5084E9DA0AA3744DF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669CEFB, Relevance: 4.9, APIs: 3, Instructions: 434libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 11c70069570080c72438fb8198409b138ebe3ec854cc106a1f7ad896e2681d40
Instruction ID: d24988c493efa3893f0fe581470b86068736f4b576fbfd4d9031d5284fde351d
Opcode Fuzzy Hash: 11c70069570080c72438fb8198409b138ebe3ec854cc106a1f7ad896e2681d40
Instruction Fuzzy Hash: 83122C74A01228CFCB64EF74D85869DB7B6BF48206F5084E9DA0AA3744DF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669CF43, Relevance: 4.9, APIs: 3, Instructions: 427libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 38d59264d9c3d88cd48ab375dc326ee03cda66fd204df706e627c4263e7b922e
Instruction ID: 92f4bfe64aca157cef3b005b6f13264c13ed0e473ce4d2c98b8b590776a95b2b
Opcode Fuzzy Hash: 38d59264d9c3d88cd48ab375dc326ee03cda66fd204df706e627c4263e7b922e
Instruction Fuzzy Hash: FE122CB4A01228CFCB64EF74D85869DB7B6BF48206F5084E9DA0AA3744DF349D85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669CF8B, Relevance: 4.9, APIs: 3, Instructions: 420libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: d58101fd68093d3e69864bc699db93f5c476ee0c96741c1a18002b6a3ad02d20
Instruction ID: 4e405ad7ddaafaddbc170a18515d7326dfce5dc70aff099579ed985ed2723fe8
Opcode Fuzzy Hash: d58101fd68093d3e69864bc699db93f5c476ee0c96741c1a18002b6a3ad02d20
Instruction Fuzzy Hash: B7123CB4A01228CFCB64EF74D85869DB7B6BF48206F5084E9DA0AA3744DF349D85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669CFD3, Relevance: 4.9, APIs: 3, Instructions: 413libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 1a0733f119130f0948df0969e1c032d473398f505c56e9d35151408935896f03
Instruction ID: 5d07a6d1650cd99dc258cff910b76bb04f183db3270f8b521e458955eb29eaaf
Opcode Fuzzy Hash: 1a0733f119130f0948df0969e1c032d473398f505c56e9d35151408935896f03
Instruction Fuzzy Hash: 2E122CB4A01228CFCB64EF74D85869DB7B6BF48206F5084E9DA0AA3744DF349D85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669D063, Relevance: 4.9, APIs: 3, Instructions: 397libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669D0C6
LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: d0b82b26dac5aeb4c31dcd7c7ed4fc048f8dd049c7850dcd5a8f3c8f7077efd6
Instruction ID: c77f828ab9977501215ab24b25bdd2b0f3abd69de9a28e2bb102dfc6deb1b515
Opcode Fuzzy Hash: d0b82b26dac5aeb4c31dcd7c7ed4fc048f8dd049c7850dcd5a8f3c8f7077efd6
Instruction Fuzzy Hash: 95024DB4A01228CFCB64EF74D85869DB7B6BF88206F5084E9D60A93744CF349D85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0669D227, Relevance: 3.3, APIs: 2, Instructions: 349libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 8b5204d9db54181a93a42f15d6a88f2b145ef990dcccba2f6b469c0fe806cf0f
Instruction ID: 31a96b3eab691dca7c2c559b9c577f3b7b4457a518b38f77b3ebdd9b130447b1
Opcode Fuzzy Hash: 8b5204d9db54181a93a42f15d6a88f2b145ef990dcccba2f6b469c0fe806cf0f
Instruction Fuzzy Hash: EFE13774A012288FCB64AF74D85879DB7B6BF88216F5084E9D90AE3744DF349E85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0669D26F, Relevance: 3.3, APIs: 2, Instructions: 342libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 7b1af2ec3a23f4ad29257cc9b4d786a67dd6a939c11e05ab42b68097db776963
Instruction ID: 571d601c79bc188ddb350129a7ea50bbe61465d810c6716ea7401420240dddfd
Opcode Fuzzy Hash: 7b1af2ec3a23f4ad29257cc9b4d786a67dd6a939c11e05ab42b68097db776963
Instruction Fuzzy Hash: 0AE12774A012288FCB64AF74D85879DB7B6BF88216F5084E9D90AE3744DF349E85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0669D2B7, Relevance: 3.3, APIs: 2, Instructions: 335libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: fb84f114eff716b348e0af4a03c9818faee2560c43d2ec99713eb58c1b4d5465
Instruction ID: 2b172b56b14e664513fd3fb1000cfe63fc5f0c844b5ca349e4e51d9ae6f1b6d8
Opcode Fuzzy Hash: fb84f114eff716b348e0af4a03c9818faee2560c43d2ec99713eb58c1b4d5465
Instruction Fuzzy Hash: 9FE12774A012288FCB64AF74D85879DB7B6BF88216F5084E9D90AE3744DF349E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0669D2FF, Relevance: 3.3, APIs: 2, Instructions: 326libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0669D445
KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: fbb9f244aae7aef72d72966b1872b2975f0194dcff920938dc8d6cad136928a3
Instruction ID: a444f5cc5dc35276dc761138c853938622725a6d2d6b61fafb670bb94b64da85
Opcode Fuzzy Hash: fbb9f244aae7aef72d72966b1872b2975f0194dcff920938dc8d6cad136928a3
Instruction Fuzzy Hash: 70E13874A012288FCB68AF74D85879DB7B6BF88216F1084E9D90AE3744DF349E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 03273E4B, Relevance: 1.8, APIs: 1, Instructions: 298COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 03274216

Memory Dump Source

Source File: 00000004.00000002.470193273.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 73d4dc7adb88feff08b3b05fb9dde57471d45fe97eeb8cbf0215c9e3421b2e5d
Instruction ID: 9b0c9eddda1337d031a75ad8054893e810e4a31a26790e8e4e7b8e35076e667f
Opcode Fuzzy Hash: 73d4dc7adb88feff08b3b05fb9dde57471d45fe97eeb8cbf0215c9e3421b2e5d
Instruction Fuzzy Hash: A8B19A74A107068FCB04EF6AD48466EBBF2FF88204B14892DD90ADB751DB75EC468BD1

Uniqueness

Uniqueness Score: -1.00%

Function 0669D7A6, Relevance: 1.7, APIs: 1, Instructions: 156COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 025874d175692119afab8bfaa82db5d2359394b5e7235c694d4852b41c26dd54
Instruction ID: e8d79367cc3c476b74ff9922fb3a42a857cc04701104e447d55097a535e9d407
Opcode Fuzzy Hash: 025874d175692119afab8bfaa82db5d2359394b5e7235c694d4852b41c26dd54
Instruction Fuzzy Hash: FD516CB4A002298FCB64EB24D8587AD77B6BF8821AF1084EDD90AD7744DF349D85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 016E1678, Relevance: 1.6, APIs: 1, Instructions: 148libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 016E16D7

Memory Dump Source

Source File: 00000004.00000002.468954512.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5b12ea3bb9e2a138dda988e5d2540d3011e1f7c2957db7900e03e2df8e55df75
Instruction ID: 905faf0e1765638dbbed11d8efac171e9f9d12e351c1c21d721ece7a26ec26ff
Opcode Fuzzy Hash: 5b12ea3bb9e2a138dda988e5d2540d3011e1f7c2957db7900e03e2df8e55df75
Instruction Fuzzy Hash: 4951C132A102059BCB14EFB4D888AEEB7F6FF84204B14892DD5029B344EF30EC45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0669D7EE, Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0669D851

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 4f1384eb3b48c87bfb521c6b4e82d8f1696dabb5ef5cac195c1178abff3c18d2
Instruction ID: 6424a10fbb42f8f7aeb8e49bd152321358fa16c3c3d8cf2d42a7f90bc40766b3
Opcode Fuzzy Hash: 4f1384eb3b48c87bfb521c6b4e82d8f1696dabb5ef5cac195c1178abff3c18d2
Instruction Fuzzy Hash: F2517CB4A002298FCB68EB34D8587AD77B6BF88219F1084ADD90AD7744DF349D85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 06699228, Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bc01076cefae8c9854b8b5fc828ae480f76929a219d05acd6cad0a402b6a795
Instruction ID: dbc582aeedafe6a3637ed97b8a80a307e8b0b169f79aeab03da1f016a5c3bdad
Opcode Fuzzy Hash: 7bc01076cefae8c9854b8b5fc828ae480f76929a219d05acd6cad0a402b6a795
Instruction Fuzzy Hash: 2E512471E002288FDF58CFA9D894BDEBBB5BF48314F148129E815AB351D774A844CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0669B4EC, Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 0669B633

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 8a9511d068db557a91065a5610ee783449479d2937c387c5ba9dc98821b1fb45
Instruction ID: 2c84a0f7d6491f4926e678222294ec4c6a2ba751dae4bbc2667844389edb6722
Opcode Fuzzy Hash: 8a9511d068db557a91065a5610ee783449479d2937c387c5ba9dc98821b1fb45
Instruction Fuzzy Hash: 47510270E002288FDF54CFAAD885BDEBBB5BF48314F148529E815AB390D774A844CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0669929C, Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 0669B633

Memory Dump Source

Source File: 00000004.00000002.475295831.0000000006690000.00000040.00000001.sdmp, Offset: 06690000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 1bab2bdc4b13cb782fec3adeb75212453ca68bc75a961e911e4ca92e66ab6fe0
Instruction ID: 646d88558d1c46350519f1fb418850e7533931b03d6a2c4ac121cc76f317661b
Opcode Fuzzy Hash: 1bab2bdc4b13cb782fec3adeb75212453ca68bc75a961e911e4ca92e66ab6fe0
Instruction Fuzzy Hash: 50510270E002188FDF54CFAAD884BDEBBB5BF48314F148129E815AB390D774A845CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 016EEA48, Relevance: 1.6, APIs: 1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.468954512.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d380701fa6ef0ff78c85c3b97f677540840abd18a45ed47ba73da2a20e1bdf3a
Instruction ID: 5df78f16e5d2b9c353c0e485381accd08f26214e97fbbf9e589811747fcf750d
Opcode Fuzzy Hash: d380701fa6ef0ff78c85c3b97f677540840abd18a45ed47ba73da2a20e1bdf3a
Instruction Fuzzy Hash: A0412472E043458FCB14CFA9C8046DEBBF5EF89224F05866AD909EB351DB749845CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 016E9A81, Relevance: 1.6, APIs: 1, Instructions: 124registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,00000000,?), ref: 016E9B99

Memory Dump Source

Source File: 00000004.00000002.468954512.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 88b5f8af27c4a1da66582a41f5173fb36af8e05775bd95d845c76c867990dfc7
Instruction ID: d30d88b5d0ee475470672e1a48a8d2b82efa82b5cbb2d77cf5cfc7367e8328b6
Opcode Fuzzy Hash: 88b5f8af27c4a1da66582a41f5173fb36af8e05775bd95d845c76c867990dfc7
Instruction Fuzzy Hash: C24144B1E012489FCB10CFA9C888ADEBBF5BF48318F55816AE859AB751D7349806CF50

Uniqueness

Uniqueness Score: -1.00%

Function 016E97C9, Relevance: 1.6, APIs: 1, Instructions: 117registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,00000000,?,00000001,?), ref: 016E98DC

Memory Dump Source

Source File: 00000004.00000002.468954512.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 5e087a3a5dfbcf7fb2a059ae7df9439d3866fc0cfbec75cd963bc957c70414dd
Instruction ID: 60e16f78b824bbf859e042e53b57783cc6c298ff37447a909382a3b0efd19afd
Opcode Fuzzy Hash: 5e087a3a5dfbcf7fb2a059ae7df9439d3866fc0cfbec75cd963bc957c70414dd
Instruction Fuzzy Hash: 0E417870D01349CFDB10CF99C848A9EBBF5BF49318F29866AD409AB301D7799845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 03275184, Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 032752A2

Memory Dump Source

Source File: 00000004.00000002.470193273.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b5f0115a6f8f8ebc65f175eec63cb0d3f4d8da1caaeb88fb541d44bb17f6c5f8
Instruction ID: c9759aec12e13843fdd35a99ab55676d35d191726a1e5726fc46ba0902d80104
Opcode Fuzzy Hash: b5f0115a6f8f8ebc65f175eec63cb0d3f4d8da1caaeb88fb541d44bb17f6c5f8
Instruction Fuzzy Hash: 0F51DEB1D10349DFDB14CFA9C884ADEFBB5BF49314F64812AE819AB210D770A885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 03275190, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 032752A2

Memory Dump Source

Source File: 00000004.00000002.470193273.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 5f6f2609032ef837293d2491d43b93e998f2c3d4ac3e0164f390f8206ce5e8fe
Instruction ID: 10e633f7581c9d95274ebdd79da7fcc192ec35704987fb8c2e76e431fdba5804
Opcode Fuzzy Hash: 5f6f2609032ef837293d2491d43b93e998f2c3d4ac3e0164f390f8206ce5e8fe
Instruction Fuzzy Hash: 4241CFB1D10349DFDB14CFA9C884ADEFBB5BF48314F64812AE819AB210D774A885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 03276964, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 03277D01

Memory Dump Source

Source File: 00000004.00000002.470193273.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 73cef49fb99c6b9d7fae613a2f8e239c3679a612b76db7f314ada4d0b8ef62ad
Instruction ID: 32c0b03cb5cb137c6911cf10bd046e3e4e32295505f01009894832f31c244f48
Opcode Fuzzy Hash: 73cef49fb99c6b9d7fae613a2f8e239c3679a612b76db7f314ada4d0b8ef62ad
Instruction Fuzzy Hash: ED414BB5A10705CFDB14CF59C488AAABBF5FF88314F15C459E519AB321D774A881CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01431732, Relevance: 1.6, APIs: 1, Instructions: 88libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 014317D1

Memory Dump Source

Source File: 00000004.00000002.466944893.0000000001430000.00000040.00000001.sdmp, Offset: 01430000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d2b94e122c22fc4cf659d7e05a9705a3c0f82597aedca543902f1443c1813a26
Instruction ID: 4e015f5634f013106d2bcc51d66d4e1b5997756e23138bb58fc6b6ca5876c5d3
Opcode Fuzzy Hash: d2b94e122c22fc4cf659d7e05a9705a3c0f82597aedca543902f1443c1813a26
Instruction Fuzzy Hash: 7431AD30A01348CFDB16DFB8D558AEDBBB1FF89715F14886AD001AB261D735D846CB51

Uniqueness

Uniqueness Score: -1.00%

Function 016E9138, Relevance: 1.6, APIs: 1, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,00000000,?), ref: 016E9B99

Memory Dump Source

Source File: 00000004.00000002.468954512.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 5851303cf2e53b96f1da5ed2a63a5e7ac6498dc1069fc5775465e40bdd5711f3
Instruction ID: 6657e45f9d8bfddb9a09a89789c4bb5e38d9aa75ed3922ee46c499aa2c48f7a4
Opcode Fuzzy Hash: 5851303cf2e53b96f1da5ed2a63a5e7ac6498dc1069fc5775465e40bdd5711f3
Instruction Fuzzy Hash: AF31DEB1D01258DFCB20CF9AC988A9EBFF5BF48314F55812AE819AB350D7709945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 016E912C, Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,00000000,?,00000001,?), ref: 016E98DC

Memory Dump Source

Source File: 00000004.00000002.468954512.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8a68d0ffafeee4cbe17e30020881e3bfe79fccf5f915bab67c0947a74b24422c
Instruction ID: 7083433f2451a0fc9affd0cecf0bbd88beb3b781193c9321e4fdd58635500a1a
Opcode Fuzzy Hash: 8a68d0ffafeee4cbe17e30020881e3bfe79fccf5f915bab67c0947a74b24422c
Instruction Fuzzy Hash: 5331F2B1D05249CFDB10CF99C588A8EFBF5BF48318F29856AE409AB300C7759845CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0327C3B9, Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0327C442

Memory Dump Source

Source File: 00000004.00000002.470193273.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 87f09231b7dee133fb53a4bfd82530716777902ce2c21eb9ba88a579732375e1
Instruction ID: 8a31d34c4e0814472b5dd3d8f05ccec5a193934fcfd67b34feb7a0e9edfd277e
Opcode Fuzzy Hash: 87f09231b7dee133fb53a4bfd82530716777902ce2c21eb9ba88a579732375e1
Instruction Fuzzy Hash: EB31D1718183458FDB11DFB8E9097AD7FF8FB05314F188069E445A7241CB78694ACFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03276D73, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 03276DFF

Memory Dump Source

Source File: 00000004.00000002.470193273.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d0bc98ad4994821c5c4b1fd25c021303ac6c28fc18c725f150ebd84f391abf49
Instruction ID: 610895936724b9f90968da1a544b3aff7dabbecb8e4735cd1c3b0b054917618b
Opcode Fuzzy Hash: d0bc98ad4994821c5c4b1fd25c021303ac6c28fc18c725f150ebd84f391abf49
Instruction Fuzzy Hash: 6821E2B5900208AFDB10CFA9D884ADEBBF8FB48324F14801AE914A7310D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03276D78, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 03276DFF

Memory Dump Source

Source File: 00000004.00000002.470193273.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fcda72dff1d49c5cb564776c37e38c133b44078e34bc319a5e100164bfeb6efa
Instruction ID: 2d37c1691e4f12fe969a0c64697d1a34ee688e90d27cbc73d46db357d0211299
Opcode Fuzzy Hash: fcda72dff1d49c5cb564776c37e38c133b44078e34bc319a5e100164bfeb6efa
Instruction Fuzzy Hash: 8021E2B59002089FDB10CFA9D884ADEBBF8FB48324F14801AE914A7310D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03272F30, Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 03274216

Memory Dump Source

Source File: 00000004.00000002.470193273.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5177608aaf4dbbb89f6244369c1363ab3881459705fa4dcf2a07394bbfa66d72
Instruction ID: 520792d31700f23a71880dd51d00b2fca460caf3112d2dbc1080c714890e649b
Opcode Fuzzy Hash: 5177608aaf4dbbb89f6244369c1363ab3881459705fa4dcf2a07394bbfa66d72
Instruction Fuzzy Hash: B32156B28046898FCB10DF9AD844ADEBBF4FF49224F05845AD819AB600D374A586CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 016E94E8, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,016EEA9A), ref: 016EEB87

Memory Dump Source

Source File: 00000004.00000002.468954512.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 926808fcea257150989a329f37898ea029986096e6e6d95a9b52ddf0c9ecdf5c
Instruction ID: 4efb402a3721108ec2480824e71c351b2afae8facbd15181e45e26a1cd1aac9c
Opcode Fuzzy Hash: 926808fcea257150989a329f37898ea029986096e6e6d95a9b52ddf0c9ecdf5c
Instruction Fuzzy Hash: 671133B1C006199BCB10CF9AC944BDEFBF4BF48224F00822AD918A7240D378A945CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 0327C3C8, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0327C442

Memory Dump Source

Source File: 00000004.00000002.470193273.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: bcd69c6064ac6ad96632659a698f02f70927c4c9b573cde6eb0dbd5feb1a59b2
Instruction ID: 0119fb142539ed509248f30d820fbdb914a5735c82ebfe6b97e89c0447744fae
Opcode Fuzzy Hash: bcd69c6064ac6ad96632659a698f02f70927c4c9b573cde6eb0dbd5feb1a59b2
Instruction Fuzzy Hash: 9811ACB19143198FCB10CFA9D9087DEBBF8FB48314F248429D505A7700C738A985CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 016EEB1A, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,016EEA9A), ref: 016EEB87

Memory Dump Source

Source File: 00000004.00000002.468954512.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 1bcfaf5a18e25933195dcbd733fb9e08b0c2387bdea10c4b2b130a4044d6e54c
Instruction ID: 40705634e92ee20adcb661743253617d3e7e5c6f5a8edcd0f8123d54c6bfa7d4
Opcode Fuzzy Hash: 1bcfaf5a18e25933195dcbd733fb9e08b0c2387bdea10c4b2b130a4044d6e54c
Instruction Fuzzy Hash: F31100B1C0061A9FCB10CF9AC944BDEBBF4BF48224F05822AD918A7640D378A945CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 03272F44, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 03274216

Memory Dump Source

Source File: 00000004.00000002.470193273.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: daa8738407356b083c1ed31fd1ddde9857e33befe3325a35d4e94ab8b9611086
Instruction ID: 2b80471e9bb39a41f97319c6b7ae0212fdc77e4a3e882de5633b17b1bf123298
Opcode Fuzzy Hash: daa8738407356b083c1ed31fd1ddde9857e33befe3325a35d4e94ab8b9611086
Instruction Fuzzy Hash: E711F0B2D006498FDB10DF9AD444B9EFBF4FB89224F15852AD829B7600C374A586CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 032741AB, Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 03274216

Memory Dump Source

Source File: 00000004.00000002.470193273.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 35742e687926b93c9f9cd30d443a825450cc12ac154a9fbcb471ce9fbe6d809f
Instruction ID: 37a60a4e8e103980c4e835a88087be5ed3afd5227bdf69297397fee1232b28c1
Opcode Fuzzy Hash: 35742e687926b93c9f9cd30d443a825450cc12ac154a9fbcb471ce9fbe6d809f
Instruction Fuzzy Hash: 8111F0B2D006498FCB10DF9AC844A9EFBF4BB88224F15851AD829B7600C374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 017CD53C, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.469322251.00000000017CD000.00000040.00000001.sdmp, Offset: 017CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f64adbce8023f138bb5a86870c74d8d286fe389297963704d26b5327ab5fd6d8
Instruction ID: 74dd5ef1eb9d6bbdcc5f031e7df42409a48704ff3cb169c4985296a848f781c6
Opcode Fuzzy Hash: f64adbce8023f138bb5a86870c74d8d286fe389297963704d26b5327ab5fd6d8
Instruction Fuzzy Hash: 8421F1B2504240DFDB11DF94E9C0B26FB65FB98728F2485BDE8094B246C33AD856DAA1

Uniqueness

Uniqueness Score: -1.00%

Function 017DD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.469423324.00000000017DD000.00000040.00000001.sdmp, Offset: 017DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe4d466a01dc4f8feaffd8e81c546f01638e9bf13904d39b129f195b4890fd2b
Instruction ID: bd5ce6cbc802a516a30226e2a239a72b764cd7625f9c4d882e2005b94dd5030b
Opcode Fuzzy Hash: fe4d466a01dc4f8feaffd8e81c546f01638e9bf13904d39b129f195b4890fd2b
Instruction Fuzzy Hash: 92212571504248DFCB21CF98D9C4B16FB75FB88354F24C9A9D8094B286C33AD846CA61

Uniqueness

Uniqueness Score: -1.00%

Function 017DD005, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.469423324.00000000017DD000.00000040.00000001.sdmp, Offset: 017DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf5a4dbc03de35050519f939196f764c1a7d10726ec35a4bd2cf34900bb27639
Instruction ID: 518ddcea1c8cb068c6c7873184e4ede02db93fee78e0f794a97e6ad9bb49d4ff
Opcode Fuzzy Hash: bf5a4dbc03de35050519f939196f764c1a7d10726ec35a4bd2cf34900bb27639
Instruction Fuzzy Hash: 022192754083849FCB13CF64D994B15BF71EB86214F28C5EAD8498F297C33AD84ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 017CD537, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.469322251.00000000017CD000.00000040.00000001.sdmp, Offset: 017CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2afa457568e0bb640a5e96658e9777ab49a47e984ab559958fa4953148591eca
Instruction ID: e005c55461dfa591a7cc5f1ed08be3671482aa12deac6ebdecd57d7cd18dfe9a
Opcode Fuzzy Hash: 2afa457568e0bb640a5e96658e9777ab49a47e984ab559958fa4953148591eca
Instruction Fuzzy Hash: B811BE76504280CFCB12CF54D9C4B56FF72FB88724F2886ADD8094B656C33AD45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report NDKr3inJa9dXEu3.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre