Play interactive tour

Edit tour

Analysis Report 6Rn5G1VWPB

Overview

General Information

Sample Name:	6Rn5G1VWPB (renamed file extension from none to exe)
Analysis ID:	412365
MD5:	c12fea2da39e5173fa674ab5e22a928f
SHA1:	ef3754b85ecd9f789bc9bbf8a8c6b36be41cc996
SHA256:	19f2d4a6fe01ce9e0bc8362933e41f0d707df28bf9ab662db7dc7504aef3845a
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains very large array initializations

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Antivirus or Machine Learning detection for unpacked file

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains strange resources

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

6Rn5G1VWPB.exe (PID: 6004 cmdline: 'C:\Users\user\Desktop\6Rn5G1VWPB.exe' MD5: C12FEA2DA39E5173FA674AB5E22A928F)

6Rn5G1VWPB.exe (PID: 6488 cmdline: C:\Users\user\Desktop\6Rn5G1VWPB.exe MD5: C12FEA2DA39E5173FA674AB5E22A928F)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "info@garciadelacruz.comsc9v6b2nmail.garciadelacruz.comwilliamslucy570@gmail.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.912960268.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.912960268.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.657613935.0000000003A71000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.657613935.0000000003A71000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000002.00000002.915088523.0000000002CF1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.915088523.0000000002CF1000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 6Rn5G1VWPB.exe PID: 6004	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: 6Rn5G1VWPB.exe PID: 6004	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 6Rn5G1VWPB.exe PID: 6488	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: 6Rn5G1VWPB.exe PID: 6488	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.6Rn5G1VWPB.exe.3b28798.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.6Rn5G1VWPB.exe.3b28798.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
2.2.6Rn5G1VWPB.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.6Rn5G1VWPB.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.6Rn5G1VWPB.exe.3b28798.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.6Rn5G1VWPB.exe.3b28798.4.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000002.00000002.915088523.0000000002CF1000.00000004.00000001.sdmp

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "info@garciadelacruz.comsc9v6b2nmail.garciadelacruz.comwilliamslucy570@gmail.com"}

Multi AV Scanner detection for submitted file

Show sources

Source: 6Rn5G1VWPB.exe

Virustotal: Detection: 27%

Perma Link

Machine Learning detection for sample

Show sources

Source: 6Rn5G1VWPB.exe

Joe Sandbox ML: detected

Source: 2.2.6Rn5G1VWPB.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: 6Rn5G1VWPB.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 6Rn5G1VWPB.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: C:\Users\Administrator\Desktop\Client\Temp\ZjzglgzLZb\src\obj\Debug\NullableMarshaler.pdb source: 6Rn5G1VWPB.exe

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe

Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h

0_2_0B3CA958

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.4:49765 -> 86.109.178.195:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.4:49766 -> 86.109.178.195:587

Source: global traffic

TCP traffic: 192.168.2.4:49765 -> 86.109.178.195:587

Source: Joe Sandbox View

ASN Name: ABANSYS_AND_HOSTYTEC-ASCCharlesRobertDarwin11ES ABANSYS_AND_HOSTYTEC-ASCCharlesRobertDarwin11ES

Source: global traffic

TCP traffic: 192.168.2.4:49765 -> 86.109.178.195:587

Source: unknown

DNS traffic detected: queries for: mail.garciadelacruz.com

Source: 6Rn5G1VWPB.exe, 00000002.00000002.915088523.0000000002CF1000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: 6Rn5G1VWPB.exe, 00000002.00000002.915088523.0000000002CF1000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: 6Rn5G1VWPB.exe, 00000002.00000002.915088523.0000000002CF1000.00000004.00000001.sdmp	String found in binary or memory: http://EPtbzE.com
Source: 6Rn5G1VWPB.exe, 00000002.00000002.915088523.0000000002CF1000.00000004.00000001.sdmp, 6Rn5G1VWPB.exe, 00000002.00000002.915918195.000000000306D000.00000004.00000001.sdmp	String found in binary or memory: http://ThqqlGVRjff9puHH.com
Source: 6Rn5G1VWPB.exe	String found in binary or memory: http://checkip.dyndns.org/
Source: 6Rn5G1VWPB.exe, 00000002.00000002.915860392.000000000305E000.00000004.00000001.sdmp	String found in binary or memory: http://mail.garciadelacruz.com
Source: 6Rn5G1VWPB.exe, 00000000.00000002.657132516.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 6Rn5G1VWPB.exe	String found in binary or memory: http://servermanager.miixit.org/
Source: 6Rn5G1VWPB.exe	String found in binary or memory: http://servermanager.miixit.org/E
Source: 6Rn5G1VWPB.exe	String found in binary or memory: http://servermanager.miixit.org/downloads/
Source: 6Rn5G1VWPB.exe	String found in binary or memory: http://servermanager.miixit.org/hits/hit_index.php?k=
Source: 6Rn5G1VWPB.exe	String found in binary or memory: http://servermanager.miixit.org/hits/hit_index.php?k=1
Source: 6Rn5G1VWPB.exe	String found in binary or memory: http://servermanager.miixit.org/index_ru.html
Source: 6Rn5G1VWPB.exe	String found in binary or memory: http://servermanager.miixit.org/index_ru.htmlk
Source: 6Rn5G1VWPB.exe	String found in binary or memory: http://servermanager.miixit.org/report/reporter_index.php?name=
Source: 6Rn5G1VWPB.exe, 00000002.00000002.915088523.0000000002CF1000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%$
Source: 6Rn5G1VWPB.exe, 00000002.00000002.915088523.0000000002CF1000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: 6Rn5G1VWPB.exe, 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: 6Rn5G1VWPB.exe	String found in binary or memory: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=CJU3DBQXBUQPC
Source: 6Rn5G1VWPB.exe, 00000000.00000002.657613935.0000000003A71000.00000004.00000001.sdmp, 6Rn5G1VWPB.exe, 00000002.00000002.912960268.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: 6Rn5G1VWPB.exe, 00000002.00000002.915088523.0000000002CF1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Installs a global keyboard hook

Show sources

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\6Rn5G1VWPB.exe

Jump to behavior

Source: 6Rn5G1VWPB.exe, 00000000.00000002.656695118.0000000000DBA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 2.2.6Rn5G1VWPB.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b93583AFAu002d3600u002d4429u002dB88Cu002dB97018CCE186u007d/u00396526966u002dBC46u002d4C39u002dA45Du002d13BC48BBFB17.cs

Large array initialization: .cctor: array initializer size 11984

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 0_2_00627DA2	0_2_00627DA2
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 0_2_0107C2B0	0_2_0107C2B0
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 0_2_01079968	0_2_01079968
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 0_2_0B3C8330	0_2_0B3C8330
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 0_2_0B3C8340	0_2_0B3C8340
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 0_2_0B3C4100	0_2_0B3C4100
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 0_2_0B3C3160	0_2_0B3C3160
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 2_2_007D7DA2	2_2_007D7DA2
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 2_2_010C7560	2_2_010C7560
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 2_2_010CBDB8	2_2_010CBDB8
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 2_2_010C0040	2_2_010C0040
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 2_2_010C5B38	2_2_010C5B38
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 2_2_010C3770	2_2_010C3770
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 2_2_010C8010	2_2_010C8010
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 2_2_010CD878	2_2_010CD878
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 2_2_010D6178	2_2_010D6178
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 2_2_010D68B0	2_2_010D68B0
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 2_2_010D5B40	2_2_010D5B40
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 2_2_010D3698	2_2_010D3698
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 2_2_010E5D68	2_2_010E5D68
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 2_2_010E09C6	2_2_010E09C6
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 2_2_010EA1C4	2_2_010EA1C4
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 2_2_010EAC38	2_2_010EAC38
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 2_2_010E9098	2_2_010E9098
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 2_2_010ECF80	2_2_010ECF80
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 2_2_010EE210	2_2_010EE210
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 2_2_010E70B8	2_2_010E70B8

Source: 6Rn5G1VWPB.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: 6Rn5G1VWPB.exe, 00000000.00000002.656374839.0000000000726000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameNullableMarshaler.exeP vs 6Rn5G1VWPB.exe
Source: 6Rn5G1VWPB.exe, 00000000.00000002.660770620.0000000005E00000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignature.dll@ vs 6Rn5G1VWPB.exe
Source: 6Rn5G1VWPB.exe, 00000000.00000002.657132516.0000000002A71000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSimpleUI.dll( vs 6Rn5G1VWPB.exe
Source: 6Rn5G1VWPB.exe, 00000000.00000002.657132516.0000000002A71000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamermQUBCospdbOYhbGMUBMmNJghaERaRjQZrS.exe4 vs 6Rn5G1VWPB.exe
Source: 6Rn5G1VWPB.exe, 00000000.00000002.656695118.0000000000DBA000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 6Rn5G1VWPB.exe
Source: 6Rn5G1VWPB.exe, 00000002.00000002.912960268.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamermQUBCospdbOYhbGMUBMmNJghaERaRjQZrS.exe4 vs 6Rn5G1VWPB.exe
Source: 6Rn5G1VWPB.exe, 00000002.00000002.914452498.0000000001230000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs 6Rn5G1VWPB.exe
Source: 6Rn5G1VWPB.exe, 00000002.00000002.914284247.00000000010B0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx vs 6Rn5G1VWPB.exe
Source: 6Rn5G1VWPB.exe, 00000002.00000002.913959685.0000000000FAA000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 6Rn5G1VWPB.exe
Source: 6Rn5G1VWPB.exe, 00000002.00000002.913136418.00000000008D6000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameNullableMarshaler.exeP vs 6Rn5G1VWPB.exe
Source: 6Rn5G1VWPB.exe, 00000002.00000002.913204426.0000000000CF8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 6Rn5G1VWPB.exe
Source: 6Rn5G1VWPB.exe	Binary or memory string: OriginalFilenameNullableMarshaler.exeP vs 6Rn5G1VWPB.exe

Source: 6Rn5G1VWPB.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 6Rn5G1VWPB.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 2.2.6Rn5G1VWPB.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.2.6Rn5G1VWPB.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@2/2

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6Rn5G1VWPB.exe.log

Jump to behavior

Source: 6Rn5G1VWPB.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: 6Rn5G1VWPB.exe, 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: 6Rn5G1VWPB.exe, 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: 6Rn5G1VWPB.exe, 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: 6Rn5G1VWPB.exe, 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: 6Rn5G1VWPB.exe, 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: 6Rn5G1VWPB.exe, 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: 6Rn5G1VWPB.exe, 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: 6Rn5G1VWPB.exe, 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: 6Rn5G1VWPB.exe, 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonTypeErro ao listar Banco sql-SecurityLogonType,Select from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)

Source: 6Rn5G1VWPB.exe

Virustotal: Detection: 27%

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe

File read: C:\Users\user\Desktop\6Rn5G1VWPB.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\6Rn5G1VWPB.exe 'C:\Users\user\Desktop\6Rn5G1VWPB.exe'
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process created: C:\Users\user\Desktop\6Rn5G1VWPB.exe C:\Users\user\Desktop\6Rn5G1VWPB.exe
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process created: C:\Users\user\Desktop\6Rn5G1VWPB.exe C:\Users\user\Desktop\6Rn5G1VWPB.exe	Jump to behavior

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 6Rn5G1VWPB.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 6Rn5G1VWPB.exe

Static file information: File size 1162752 > 1048576

Source: 6Rn5G1VWPB.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: 6Rn5G1VWPB.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\Users\Administrator\Desktop\Client\Temp\ZjzglgzLZb\src\obj\Debug\NullableMarshaler.pdb source: 6Rn5G1VWPB.exe

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 0_2_010704D0 push C0330101h; ret		0_2_010704E2
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Code function: 2_2_010DB597 push edi; retn 0000h		2_2_010DB599

Source: initial sample

Static PE information: section name: .text entropy: 7.89681221538

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6Rn5G1VWPB.exe PID: 6004, type: MEMORY

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: 6Rn5G1VWPB.exe, 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: 6Rn5G1VWPB.exe, 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Window / User API: threadDelayed 1351			Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Window / User API: threadDelayed 8457			Jump to behavior

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe TID: 4864	Thread sleep time: -101283s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe TID: 6348	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe TID: 980	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe TID: 4660	Thread sleep count: 1351 > 30	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe TID: 4660	Thread sleep count: 8457 > 30	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe TID: 980	Thread sleep count: 37 > 30	Jump to behavior

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Thread delayed: delay time: 101283	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: 6Rn5G1VWPB.exe, 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: 6Rn5G1VWPB.exe, 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: 6Rn5G1VWPB.exe, 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: 6Rn5G1VWPB.exe, 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: 6Rn5G1VWPB.exe, 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: 6Rn5G1VWPB.exe, 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: 6Rn5G1VWPB.exe, 00000002.00000002.918678159.0000000006150000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllRYr{
Source: 6Rn5G1VWPB.exe, 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: 6Rn5G1VWPB.exe, 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: 6Rn5G1VWPB.exe, 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe

Code function: 2_2_010CF08C LdrInitializeThunk,

2_2_010CF08C

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe

Memory written: C:\Users\user\Desktop\6Rn5G1VWPB.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe

Process created: C:\Users\user\Desktop\6Rn5G1VWPB.exe C:\Users\user\Desktop\6Rn5G1VWPB.exe

Jump to behavior

Source: 6Rn5G1VWPB.exe, 00000002.00000002.914596019.0000000001630000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: 6Rn5G1VWPB.exe, 00000002.00000002.914596019.0000000001630000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: 6Rn5G1VWPB.exe, 00000002.00000002.914596019.0000000001630000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: 6Rn5G1VWPB.exe, 00000002.00000002.914596019.0000000001630000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Queries volume information: C:\Users\user\Desktop\6Rn5G1VWPB.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Queries volume information: C:\Users\user\Desktop\6Rn5G1VWPB.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000002.00000002.912960268.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.657613935.0000000003A71000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.6Rn5G1VWPB.exe.3b28798.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.6Rn5G1VWPB.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6Rn5G1VWPB.exe.3b28798.4.raw.unpack, type: UNPACKEDPE

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000002.00000002.912960268.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.657613935.0000000003A71000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.915088523.0000000002CF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6Rn5G1VWPB.exe PID: 6004, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6Rn5G1VWPB.exe PID: 6488, type: MEMORY
Source: Yara match	File source: 0.2.6Rn5G1VWPB.exe.3b28798.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.6Rn5G1VWPB.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6Rn5G1VWPB.exe.3b28798.4.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\6Rn5G1VWPB.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: 00000002.00000002.915088523.0000000002CF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6Rn5G1VWPB.exe PID: 6488, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000002.00000002.912960268.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.657613935.0000000003A71000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.6Rn5G1VWPB.exe.3b28798.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.6Rn5G1VWPB.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6Rn5G1VWPB.exe.3b28798.4.raw.unpack, type: UNPACKEDPE

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000002.00000002.912960268.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.657613935.0000000003A71000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.915088523.0000000002CF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6Rn5G1VWPB.exe PID: 6004, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6Rn5G1VWPB.exe PID: 6488, type: MEMORY
Source: Yara match	File source: 0.2.6Rn5G1VWPB.exe.3b28798.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.6Rn5G1VWPB.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6Rn5G1VWPB.exe.3b28798.4.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Process Injection112	Masquerading1	OS Credential Dumping2	Query Registry1	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	Input Capture111	Security Software Discovery211	Remote Desktop Protocol	Input Capture111	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion131	Credentials in Registry1	Process Discovery2	SMB/Windows Admin Shares	Archive Collected Data11	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Virtualization/Sandbox Evasion131	Distributed Component Object Model	Data from Local System2	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Application Window Discovery1	SSH	Clipboard Data1	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information3	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing3	DCSync	System Information Discovery114	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
6Rn5G1VWPB.exe	27%	Virustotal		Browse
6Rn5G1VWPB.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
2.2.6Rn5G1VWPB.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	Virustotal		Browse
http://checkip.dyndns.org/	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://EPtbzE.com	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/hits/hit_index.php?k=1	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/E	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/index_ru.html	0%	Avira URL Cloud	safe
http://mail.garciadelacruz.com	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/report/reporter_index.php?name=	0%	Avira URL Cloud	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
http://servermanager.miixit.org/	0%	Avira URL Cloud	safe
http://ThqqlGVRjff9puHH.com	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/index_ru.htmlk	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://servermanager.miixit.org/downloads/	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/hits/hit_index.php?k=	0%	Avira URL Cloud	safe
https://api.ipify.org%$	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.garciadelacruz.com	86.109.178.195	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	6Rn5G1VWPB.exe, 00000002.00000002.915088523.0000000002CF1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://DynDns.comDynDNS	6Rn5G1VWPB.exe, 00000002.00000002.915088523.0000000002CF1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://checkip.dyndns.org/	6Rn5G1VWPB.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	6Rn5G1VWPB.exe, 00000002.00000002.915088523.0000000002CF1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://EPtbzE.com	6Rn5G1VWPB.exe, 00000002.00000002.915088523.0000000002CF1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://servermanager.miixit.org/hits/hit_index.php?k=1	6Rn5G1VWPB.exe	false	Avira URL Cloud: safe	unknown
https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=CJU3DBQXBUQPC	6Rn5G1VWPB.exe	false		high
http://servermanager.miixit.org/E	6Rn5G1VWPB.exe	false	Avira URL Cloud: safe	unknown
http://servermanager.miixit.org/index_ru.html	6Rn5G1VWPB.exe	false	Avira URL Cloud: safe	unknown
http://mail.garciadelacruz.com	6Rn5G1VWPB.exe, 00000002.00000002.915860392.000000000305E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://servermanager.miixit.org/report/reporter_index.php?name=	6Rn5G1VWPB.exe	false	Avira URL Cloud: safe	unknown
https://api.ipify.org%GETMozilla/5.0	6Rn5G1VWPB.exe, 00000002.00000002.915088523.0000000002CF1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://servermanager.miixit.org/	6Rn5G1VWPB.exe	false	Avira URL Cloud: safe	unknown
http://ThqqlGVRjff9puHH.com	6Rn5G1VWPB.exe, 00000002.00000002.915088523.0000000002CF1000.00000004.00000001.sdmp, 6Rn5G1VWPB.exe, 00000002.00000002.915918195.000000000306D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	6Rn5G1VWPB.exe, 00000000.00000002.657132516.0000000002A71000.00000004.00000001.sdmp	false		high
http://servermanager.miixit.org/index_ru.htmlk	6Rn5G1VWPB.exe	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	6Rn5G1VWPB.exe, 00000000.00000002.657613935.0000000003A71000.00000004.00000001.sdmp, 6Rn5G1VWPB.exe, 00000002.00000002.912960268.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	6Rn5G1VWPB.exe, 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp	false		high
http://servermanager.miixit.org/downloads/	6Rn5G1VWPB.exe	false	Avira URL Cloud: safe	unknown
http://servermanager.miixit.org/hits/hit_index.php?k=	6Rn5G1VWPB.exe	false	Avira URL Cloud: safe	unknown
https://api.ipify.org%$	6Rn5G1VWPB.exe, 00000002.00000002.915088523.0000000002CF1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
86.109.178.195	mail.garciadelacruz.com	Spain		196713	ABANSYS_AND_HOSTYTEC-ASCCharlesRobertDarwin11ES	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	412365
Start date:	12.05.2021
Start time:	16:39:38
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	6Rn5G1VWPB (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@2/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 97% Number of executed functions: 82 Number of non-executed functions: 7
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Excluded IPs from analysis (whitelisted): 104.42.151.234, 52.147.198.201, 20.50.102.62, 52.155.217.156, 20.54.26.129, 2.20.143.16, 2.20.142.209, 92.122.213.194, 92.122.213.247 Excluded domains from analysis (whitelisted): displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, au.download.windowsupdate.com.edgesuite.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, skypedataprdcoleus16.cloudapp.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, skypedataprdcolwus16.cloudapp.net, au-bg-shim.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:40:28	API Interceptor	709x Sleep call for process: 6Rn5G1VWPB.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
86.109.178.195	Facturas_DHL.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
mail.garciadelacruz.com	Facturas_DHL.exe	Get hash	malicious	Browse	86.109.178.195

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ABANSYS_AND_HOSTYTEC-ASCCharlesRobertDarwin11ES	Facturas_DHL.exe	Get hash	malicious	Browse	86.109.178.195
	Documentation__UC8G8HI9.doc	Get hash	malicious	Browse	86.109.178.160
	Documentation__UC8G8HI9.doc	Get hash	malicious	Browse	86.109.178.160
	rzx0Vt5BFs.doc	Get hash	malicious	Browse	86.109.178.160
	764829483582_2019_04_12.doc	Get hash	malicious	Browse	86.109.170.198
	764829483582_2019_04_12.doc	Get hash	malicious	Browse	86.109.170.198
	http://mavitec.es/TlNxe-Od_FYMO-c5/ZS91/invoicing/En_us/Companies-Invoice-1220317	Get hash	malicious	Browse	86.109.167.210
	fee-docs.doc	Get hash	malicious	Browse	86.109.170.194
	fee-docs.doc	Get hash	malicious	Browse	86.109.170.194
	fee-docs.doc	Get hash	malicious	Browse	86.109.170.194
	fee-docs.doc	Get hash	malicious	Browse	86.109.170.194
	FILE-679339.pdf	Get hash	malicious	Browse	86.109.167.76
	DHL number - Mittwoch, 15_00-18_00 Uhr.doc	Get hash	malicious	Browse	86.109.170.57
	DHL number - Mittwoch, 15_00-18_00 Uhr.doc	Get hash	malicious	Browse	86.109.170.57
	emotet_36.doc	Get hash	malicious	Browse	86.109.170.12
	emotet_36.doc	Get hash	malicious	Browse	86.109.170.12
	http://l.e.lastlap.com/rts/go2.aspx?h=700033&tp=i-H43-Q4x-J7o-GuCmL-5V-A14-1c-GuWPV-FWem8	Get hash	malicious	Browse	86.109.162.135
	http://l.e.lastlap.com/rts/go2.aspx?h=700033&tp=i-H43-Q4x-J7o-GuJdM-5V-Vn2-1c-GuWPV-3WGdU	Get hash	malicious	Browse	86.109.162.135
	Scan1782384.doc	Get hash	malicious	Browse	86.109.161.249
	Scan1782384.doc	Get hash	malicious	Browse	86.109.161.249

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6Rn5G1VWPB.exe.log Download File
Process:	C:\Users\user\Desktop\6Rn5G1VWPB.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Roaming\ikffln5u.f20\Chrome\Default\Cookies Download File
Process:	C:\Users\user\Desktop\6Rn5G1VWPB.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.7006690334145785
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBoe9H6pf1H1oNQ:T5LLOpEO5J/Kn7U1uBobfvoNQ
MD5:	A7FE10DA330AD03BF22DC9AC76BBB3E4
SHA1:	1805CB7A2208BAEFF71DCB3FE32DB0CC935CF803
SHA-256:	8D6B84A96429B5C672838BF431A47EC59655E561EBFBB4E63B46351D10A7AAD8
SHA-512:	1DBE27AED6E1E98E9F82AC1F5B774ACB6F3A773BEB17B66C2FB7B89D12AC87A6D5B716EF844678A5417F30EE8855224A8686A135876AB4C0561B3C6059E635C7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.694119021117804
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	6Rn5G1VWPB.exe
File size:	1162752
MD5:	c12fea2da39e5173fa674ab5e22a928f
SHA1:	ef3754b85ecd9f789bc9bbf8a8c6b36be41cc996
SHA256:	19f2d4a6fe01ce9e0bc8362933e41f0d707df28bf9ab662db7dc7504aef3845a
SHA512:	26bd4ff8262c9b5bb684889ab89b373a10f33b9fe61b88ee0ec7bea69390e1c461b62c17280f3e2e68ef48cce67be523559647552d6fdae1fd9b166e82f9ff0e
SSDEEP:	24576:N6bI6jw9IkyU4BbYDW/X/4W7TPds2fSc8SfhJAwIdvLe6:0ESkkEkl7DdsDc5+VdvL
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w..`..............P..0...........N... ...`....@.. ....................... ............@................................

File Icon


Icon Hash:	d28ab3b0e0ab96c4

Static PE Info

General
Entrypoint:	0x4f4eb2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x609BC077 [Wed May 12 11:48:07 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf4e60	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf6000	0x288f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x120000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xf4d28	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xf2eb8	0xf3000	False	0.913331082819	data	7.89681221538	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xf6000	0x288f8	0x28a00	False	0.348028846154	data	5.39732699522	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x120000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xf62b0	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0
RT_ICON	0x106ad8	0x94a8	data
RT_ICON	0x10ff80	0x5488	data
RT_ICON	0x115408	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 4294967295, next used block 4294967295
RT_ICON	0x119630	0x25a8	data
RT_ICON	0x11bbd8	0x10a8	data
RT_ICON	0x11cc80	0x988	data
RT_ICON	0x11d608	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x11da70	0x76	data
RT_GROUP_ICON	0x11dae8	0x14	data
RT_VERSION	0x11dafc	0x394	data
RT_MANIFEST	0x11de90	0xa65	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Macroeconomist
Assembly Version	4.1.2.1
InternalName	NullableMarshaler.exe
FileVersion	4.1.2.1
CompanyName	Macroeconomist 2021
LegalTrademarks
Comments
ProductName	GlobalizationExtensions
ProductVersion	4.1.2.1
FileDescription	GlobalizationExtensions
OriginalFilename	NullableMarshaler.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/12/21-16:42:13.863185	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49765	587	192.168.2.4	86.109.178.195
05/12/21-16:42:16.929135	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49766	587	192.168.2.4	86.109.178.195

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2021 16:42:13.134754896 CEST	49765	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:13.211566925 CEST	587	49765	86.109.178.195	192.168.2.4
May 12, 2021 16:42:13.211824894 CEST	49765	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:13.377419949 CEST	587	49765	86.109.178.195	192.168.2.4
May 12, 2021 16:42:13.378144026 CEST	49765	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:13.454828024 CEST	587	49765	86.109.178.195	192.168.2.4
May 12, 2021 16:42:13.455018044 CEST	587	49765	86.109.178.195	192.168.2.4
May 12, 2021 16:42:13.456748009 CEST	49765	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:13.535165071 CEST	587	49765	86.109.178.195	192.168.2.4
May 12, 2021 16:42:13.535989046 CEST	49765	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:13.617292881 CEST	587	49765	86.109.178.195	192.168.2.4
May 12, 2021 16:42:13.619561911 CEST	49765	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:13.697374105 CEST	587	49765	86.109.178.195	192.168.2.4
May 12, 2021 16:42:13.697834969 CEST	49765	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:13.781431913 CEST	587	49765	86.109.178.195	192.168.2.4
May 12, 2021 16:42:13.781960964 CEST	49765	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:13.860829115 CEST	587	49765	86.109.178.195	192.168.2.4
May 12, 2021 16:42:13.863184929 CEST	49765	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:13.863420963 CEST	49765	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:13.864106894 CEST	49765	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:13.864223957 CEST	49765	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:13.940037012 CEST	587	49765	86.109.178.195	192.168.2.4
May 12, 2021 16:42:13.940723896 CEST	587	49765	86.109.178.195	192.168.2.4
May 12, 2021 16:42:14.269522905 CEST	587	49765	86.109.178.195	192.168.2.4
May 12, 2021 16:42:14.318522930 CEST	49765	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:15.774117947 CEST	49765	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:15.851397991 CEST	587	49765	86.109.178.195	192.168.2.4
May 12, 2021 16:42:15.852571011 CEST	49765	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:15.853324890 CEST	587	49765	86.109.178.195	192.168.2.4
May 12, 2021 16:42:15.853451967 CEST	49765	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:15.933919907 CEST	587	49765	86.109.178.195	192.168.2.4
May 12, 2021 16:42:16.297874928 CEST	49766	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:16.374768019 CEST	587	49766	86.109.178.195	192.168.2.4
May 12, 2021 16:42:16.374926090 CEST	49766	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:16.454835892 CEST	587	49766	86.109.178.195	192.168.2.4
May 12, 2021 16:42:16.455365896 CEST	49766	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:16.532181978 CEST	587	49766	86.109.178.195	192.168.2.4
May 12, 2021 16:42:16.532442093 CEST	587	49766	86.109.178.195	192.168.2.4
May 12, 2021 16:42:16.535346985 CEST	49766	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:16.612245083 CEST	587	49766	86.109.178.195	192.168.2.4
May 12, 2021 16:42:16.612946033 CEST	49766	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:16.690330029 CEST	587	49766	86.109.178.195	192.168.2.4
May 12, 2021 16:42:16.690743923 CEST	49766	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:16.767704010 CEST	587	49766	86.109.178.195	192.168.2.4
May 12, 2021 16:42:16.768399000 CEST	49766	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:16.846424103 CEST	587	49766	86.109.178.195	192.168.2.4
May 12, 2021 16:42:16.846874952 CEST	49766	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:16.926548004 CEST	587	49766	86.109.178.195	192.168.2.4
May 12, 2021 16:42:16.928909063 CEST	49766	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:16.929135084 CEST	49766	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:16.929260969 CEST	49766	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:16.929411888 CEST	49766	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:16.929640055 CEST	49766	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:16.929826021 CEST	49766	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:16.929915905 CEST	49766	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:16.930042982 CEST	49766	587	192.168.2.4	86.109.178.195
May 12, 2021 16:42:17.007592916 CEST	587	49766	86.109.178.195	192.168.2.4
May 12, 2021 16:42:17.008039951 CEST	587	49766	86.109.178.195	192.168.2.4
May 12, 2021 16:42:17.008965969 CEST	587	49766	86.109.178.195	192.168.2.4
May 12, 2021 16:42:17.008979082 CEST	587	49766	86.109.178.195	192.168.2.4
May 12, 2021 16:42:17.420620918 CEST	587	49766	86.109.178.195	192.168.2.4
May 12, 2021 16:42:17.475102901 CEST	49766	587	192.168.2.4	86.109.178.195

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2021 16:40:18.445195913 CEST	58028	53	192.168.2.4	8.8.8.8
May 12, 2021 16:40:18.495414019 CEST	53	58028	8.8.8.8	192.168.2.4
May 12, 2021 16:40:19.896186113 CEST	53097	53	192.168.2.4	8.8.8.8
May 12, 2021 16:40:19.944896936 CEST	53	53097	8.8.8.8	192.168.2.4
May 12, 2021 16:40:20.977637053 CEST	49257	53	192.168.2.4	8.8.8.8
May 12, 2021 16:40:21.030966997 CEST	53	49257	8.8.8.8	192.168.2.4
May 12, 2021 16:40:22.337939978 CEST	62389	53	192.168.2.4	8.8.8.8
May 12, 2021 16:40:22.389678001 CEST	53	62389	8.8.8.8	192.168.2.4
May 12, 2021 16:40:23.664412022 CEST	49910	53	192.168.2.4	8.8.8.8
May 12, 2021 16:40:23.717228889 CEST	53	49910	8.8.8.8	192.168.2.4
May 12, 2021 16:40:24.927752018 CEST	55854	53	192.168.2.4	8.8.8.8
May 12, 2021 16:40:24.980926037 CEST	53	55854	8.8.8.8	192.168.2.4
May 12, 2021 16:40:26.547545910 CEST	64549	53	192.168.2.4	8.8.8.8
May 12, 2021 16:40:26.599379063 CEST	53	64549	8.8.8.8	192.168.2.4
May 12, 2021 16:40:27.727233887 CEST	63153	53	192.168.2.4	8.8.8.8
May 12, 2021 16:40:27.775940895 CEST	53	63153	8.8.8.8	192.168.2.4
May 12, 2021 16:40:30.397442102 CEST	52991	53	192.168.2.4	8.8.8.8
May 12, 2021 16:40:30.446260929 CEST	53	52991	8.8.8.8	192.168.2.4
May 12, 2021 16:40:31.586272001 CEST	53700	53	192.168.2.4	8.8.8.8
May 12, 2021 16:40:31.635117054 CEST	53	53700	8.8.8.8	192.168.2.4
May 12, 2021 16:40:32.475155115 CEST	51726	53	192.168.2.4	8.8.8.8
May 12, 2021 16:40:32.532696962 CEST	53	51726	8.8.8.8	192.168.2.4
May 12, 2021 16:40:33.587733984 CEST	56794	53	192.168.2.4	8.8.8.8
May 12, 2021 16:40:33.647283077 CEST	53	56794	8.8.8.8	192.168.2.4
May 12, 2021 16:40:34.448817015 CEST	56534	53	192.168.2.4	8.8.8.8
May 12, 2021 16:40:34.500467062 CEST	53	56534	8.8.8.8	192.168.2.4
May 12, 2021 16:40:35.432074070 CEST	56627	53	192.168.2.4	8.8.8.8
May 12, 2021 16:40:35.480787992 CEST	53	56627	8.8.8.8	192.168.2.4
May 12, 2021 16:40:37.240926027 CEST	56621	53	192.168.2.4	8.8.8.8
May 12, 2021 16:40:37.289674044 CEST	53	56621	8.8.8.8	192.168.2.4
May 12, 2021 16:40:38.215845108 CEST	63116	53	192.168.2.4	8.8.8.8
May 12, 2021 16:40:38.276186943 CEST	53	63116	8.8.8.8	192.168.2.4
May 12, 2021 16:40:39.350717068 CEST	64078	53	192.168.2.4	8.8.8.8
May 12, 2021 16:40:39.400345087 CEST	53	64078	8.8.8.8	192.168.2.4
May 12, 2021 16:40:42.640199900 CEST	64801	53	192.168.2.4	8.8.8.8
May 12, 2021 16:40:42.689085960 CEST	53	64801	8.8.8.8	192.168.2.4
May 12, 2021 16:40:47.615437031 CEST	61721	53	192.168.2.4	8.8.8.8
May 12, 2021 16:40:47.675681114 CEST	53	61721	8.8.8.8	192.168.2.4
May 12, 2021 16:41:03.036144018 CEST	51255	53	192.168.2.4	8.8.8.8
May 12, 2021 16:41:03.250905037 CEST	53	51255	8.8.8.8	192.168.2.4
May 12, 2021 16:41:03.817640066 CEST	61522	53	192.168.2.4	8.8.8.8
May 12, 2021 16:41:03.877968073 CEST	53	61522	8.8.8.8	192.168.2.4
May 12, 2021 16:41:04.456588984 CEST	52337	53	192.168.2.4	8.8.8.8
May 12, 2021 16:41:04.546590090 CEST	53	52337	8.8.8.8	192.168.2.4
May 12, 2021 16:41:04.760132074 CEST	55046	53	192.168.2.4	8.8.8.8
May 12, 2021 16:41:04.817827940 CEST	53	55046	8.8.8.8	192.168.2.4
May 12, 2021 16:41:04.977973938 CEST	49612	53	192.168.2.4	8.8.8.8
May 12, 2021 16:41:05.036331892 CEST	53	49612	8.8.8.8	192.168.2.4
May 12, 2021 16:41:05.634725094 CEST	49285	53	192.168.2.4	8.8.8.8
May 12, 2021 16:41:05.683474064 CEST	53	49285	8.8.8.8	192.168.2.4
May 12, 2021 16:41:06.247292995 CEST	50601	53	192.168.2.4	8.8.8.8
May 12, 2021 16:41:06.304621935 CEST	53	50601	8.8.8.8	192.168.2.4
May 12, 2021 16:41:06.758164883 CEST	60875	53	192.168.2.4	8.8.8.8
May 12, 2021 16:41:06.820440054 CEST	53	60875	8.8.8.8	192.168.2.4
May 12, 2021 16:41:07.621284008 CEST	56448	53	192.168.2.4	8.8.8.8
May 12, 2021 16:41:07.680427074 CEST	53	56448	8.8.8.8	192.168.2.4
May 12, 2021 16:41:08.857274055 CEST	59172	53	192.168.2.4	8.8.8.8
May 12, 2021 16:41:08.914813042 CEST	53	59172	8.8.8.8	192.168.2.4
May 12, 2021 16:41:09.355947018 CEST	62420	53	192.168.2.4	8.8.8.8
May 12, 2021 16:41:09.413249016 CEST	53	62420	8.8.8.8	192.168.2.4
May 12, 2021 16:41:12.174837112 CEST	60579	53	192.168.2.4	8.8.8.8
May 12, 2021 16:41:12.236542940 CEST	53	60579	8.8.8.8	192.168.2.4
May 12, 2021 16:41:22.057522058 CEST	50183	53	192.168.2.4	8.8.8.8
May 12, 2021 16:41:22.117943048 CEST	53	50183	8.8.8.8	192.168.2.4
May 12, 2021 16:41:22.240628958 CEST	61531	53	192.168.2.4	8.8.8.8
May 12, 2021 16:41:22.299323082 CEST	53	61531	8.8.8.8	192.168.2.4
May 12, 2021 16:41:24.312402964 CEST	49228	53	192.168.2.4	8.8.8.8
May 12, 2021 16:41:24.371192932 CEST	53	49228	8.8.8.8	192.168.2.4
May 12, 2021 16:41:58.178168058 CEST	59794	53	192.168.2.4	8.8.8.8
May 12, 2021 16:41:58.235702991 CEST	53	59794	8.8.8.8	192.168.2.4
May 12, 2021 16:42:00.238121033 CEST	55916	53	192.168.2.4	8.8.8.8
May 12, 2021 16:42:00.304614067 CEST	53	55916	8.8.8.8	192.168.2.4
May 12, 2021 16:42:12.913924932 CEST	52752	53	192.168.2.4	8.8.8.8
May 12, 2021 16:42:13.008151054 CEST	53	52752	8.8.8.8	192.168.2.4
May 12, 2021 16:42:16.233340979 CEST	60542	53	192.168.2.4	8.8.8.8
May 12, 2021 16:42:16.293699980 CEST	53	60542	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 12, 2021 16:42:12.913924932 CEST	192.168.2.4	8.8.8.8	0xf629	Standard query (0)	mail.garciadelacruz.com	A (IP address)	IN (0x0001)
May 12, 2021 16:42:16.233340979 CEST	192.168.2.4	8.8.8.8	0xe06	Standard query (0)	mail.garciadelacruz.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 12, 2021 16:42:13.008151054 CEST	8.8.8.8	192.168.2.4	0xf629	No error (0)	mail.garciadelacruz.com		86.109.178.195	A (IP address)	IN (0x0001)
May 12, 2021 16:42:16.293699980 CEST	8.8.8.8	192.168.2.4	0xe06	No error (0)	mail.garciadelacruz.com		86.109.178.195	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 12, 2021 16:42:13.377419949 CEST	587	49765	86.109.178.195	192.168.2.4	220 h0226.hostytec.com ESMTP Postfix
May 12, 2021 16:42:13.378144026 CEST	49765	587	192.168.2.4	86.109.178.195	EHLO 813848
May 12, 2021 16:42:13.455018044 CEST	587	49765	86.109.178.195	192.168.2.4	250-h0226.hostytec.com 250-PIPELINING 250-SIZE 20480000 250-ETRN 250-STARTTLS 250-AUTH DIGEST-MD5 CRAM-MD5 PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 CHUNKING
May 12, 2021 16:42:13.456748009 CEST	49765	587	192.168.2.4	86.109.178.195	AUTH login aW5mb0BnYXJjaWFkZWxhY3J1ei5jb20=
May 12, 2021 16:42:13.535165071 CEST	587	49765	86.109.178.195	192.168.2.4	334 UGFzc3dvcmQ6
May 12, 2021 16:42:13.617292881 CEST	587	49765	86.109.178.195	192.168.2.4	235 2.7.0 Authentication successful
May 12, 2021 16:42:13.619561911 CEST	49765	587	192.168.2.4	86.109.178.195	MAIL FROM:<info@garciadelacruz.com>
May 12, 2021 16:42:13.697374105 CEST	587	49765	86.109.178.195	192.168.2.4	250 2.1.0 Ok
May 12, 2021 16:42:13.697834969 CEST	49765	587	192.168.2.4	86.109.178.195	RCPT TO:<williamslucy570@gmail.com>
May 12, 2021 16:42:13.781431913 CEST	587	49765	86.109.178.195	192.168.2.4	250 2.1.5 Ok
May 12, 2021 16:42:13.781960964 CEST	49765	587	192.168.2.4	86.109.178.195	DATA
May 12, 2021 16:42:13.860829115 CEST	587	49765	86.109.178.195	192.168.2.4	354 End data with <CR><LF>.<CR><LF>
May 12, 2021 16:42:13.864223957 CEST	49765	587	192.168.2.4	86.109.178.195	.
May 12, 2021 16:42:14.269522905 CEST	587	49765	86.109.178.195	192.168.2.4	250 2.0.0 Ok: queued as B83851082C54E
May 12, 2021 16:42:15.774117947 CEST	49765	587	192.168.2.4	86.109.178.195	QUIT
May 12, 2021 16:42:15.851397991 CEST	587	49765	86.109.178.195	192.168.2.4	221 2.0.0 Bye
May 12, 2021 16:42:16.454835892 CEST	587	49766	86.109.178.195	192.168.2.4	220 h0226.hostytec.com ESMTP Postfix
May 12, 2021 16:42:16.455365896 CEST	49766	587	192.168.2.4	86.109.178.195	EHLO 813848
May 12, 2021 16:42:16.532442093 CEST	587	49766	86.109.178.195	192.168.2.4	250-h0226.hostytec.com 250-PIPELINING 250-SIZE 20480000 250-ETRN 250-STARTTLS 250-AUTH DIGEST-MD5 CRAM-MD5 PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 CHUNKING
May 12, 2021 16:42:16.535346985 CEST	49766	587	192.168.2.4	86.109.178.195	AUTH login aW5mb0BnYXJjaWFkZWxhY3J1ei5jb20=
May 12, 2021 16:42:16.612245083 CEST	587	49766	86.109.178.195	192.168.2.4	334 UGFzc3dvcmQ6
May 12, 2021 16:42:16.690330029 CEST	587	49766	86.109.178.195	192.168.2.4	235 2.7.0 Authentication successful
May 12, 2021 16:42:16.690743923 CEST	49766	587	192.168.2.4	86.109.178.195	MAIL FROM:<info@garciadelacruz.com>
May 12, 2021 16:42:16.767704010 CEST	587	49766	86.109.178.195	192.168.2.4	250 2.1.0 Ok
May 12, 2021 16:42:16.768399000 CEST	49766	587	192.168.2.4	86.109.178.195	RCPT TO:<williamslucy570@gmail.com>
May 12, 2021 16:42:16.846424103 CEST	587	49766	86.109.178.195	192.168.2.4	250 2.1.5 Ok
May 12, 2021 16:42:16.846874952 CEST	49766	587	192.168.2.4	86.109.178.195	DATA
May 12, 2021 16:42:16.926548004 CEST	587	49766	86.109.178.195	192.168.2.4	354 End data with <CR><LF>.<CR><LF>
May 12, 2021 16:42:16.930042982 CEST	49766	587	192.168.2.4	86.109.178.195	.
May 12, 2021 16:42:17.420620918 CEST	587	49766	86.109.178.195	192.168.2.4	250 2.0.0 Ok: queued as C80EF108681F7

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 6Rn5G1VWPB.exe PID: 6004 Parent PID: 5956

General

Start time:	16:40:26
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\6Rn5G1VWPB.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\6Rn5G1VWPB.exe'
Imagebase:	0x620000
File size:	1162752 bytes
MD5 hash:	C12FEA2DA39E5173FA674AB5E22A928F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.657613935.0000000003A71000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.657613935.0000000003A71000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.657207704.0000000002ABF000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 6Rn5G1VWPB.exe PID: 6488 Parent PID: 6004

General

Start time:	16:40:30
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\6Rn5G1VWPB.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\6Rn5G1VWPB.exe
Imagebase:	0x7d0000
File size:	1162752 bytes
MD5 hash:	C12FEA2DA39E5173FA674AB5E22A928F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.912960268.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000002.00000002.912960268.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.915088523.0000000002CF1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.915088523.0000000002CF1000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 6Rn5G1VWPB.exe PID: 6004 Parent PID: 5956 6Rn5G1VWPB.exeCOMMON

Execution Graph

Execution Coverage:	10.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	114
Total number of Limit Nodes:	9

Executed Functions

Function 0B3CA958, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.660987864.000000000B3C0000.00000040.00000001.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3c0000_6Rn5G1VWPB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5c0364d55e86f4a3661d3b19453297145d456e3bd367c61c369c6db7a5c5a7
Instruction ID: 7b6422d45c2bf67e9800fa414927179a253c302e642b3bcddd8af7af18d3af14
Opcode Fuzzy Hash: 0a5c0364d55e86f4a3661d3b19453297145d456e3bd367c61c369c6db7a5c5a7
Instruction Fuzzy Hash: 6A112771D0425C8FDB24CFA6C419BEEBBF1AB4E311F25906AD545B3294CB788984CB68

Uniqueness

Uniqueness Score: -1.00%

Function 01076B90, Relevance: 6.1, APIs: 4, Instructions: 127
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 01076C00
GetCurrentThread.KERNEL32 ref: 01076C3D
GetCurrentProcess.KERNEL32 ref: 01076C7A
GetCurrentThreadId.KERNEL32 ref: 01076CD3

Memory Dump Source

Source File: 00000000.00000002.656963430.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_6Rn5G1VWPB.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 2e24d3b52d75527be077c69a630bf5d02cb3caf5273c9adc1c98b3f0037196e6
Instruction ID: 4d719042e26bfff5182bc9d5e2a80111b92000c16700e97b9fcc3d126c3a2efd
Opcode Fuzzy Hash: 2e24d3b52d75527be077c69a630bf5d02cb3caf5273c9adc1c98b3f0037196e6
Instruction Fuzzy Hash: B35175B0D007498FEB14CFA9C5887EEBBF0FF49314F208459E449A7250D7759885CB65

Uniqueness

Uniqueness Score: -1.00%

Function 01076BA0, Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 01076C00
GetCurrentThread.KERNEL32 ref: 01076C3D
GetCurrentProcess.KERNEL32 ref: 01076C7A
GetCurrentThreadId.KERNEL32 ref: 01076CD3

Memory Dump Source

Source File: 00000000.00000002.656963430.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_6Rn5G1VWPB.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ab5a97e20ed741491fb58e6497b8be968de43823e1603144780099470f49eb4e
Instruction ID: e87e94cd34a080ef92fcce6dc5d915ef1a30073b6604b06f05201beb1b12b5e0
Opcode Fuzzy Hash: ab5a97e20ed741491fb58e6497b8be968de43823e1603144780099470f49eb4e
Instruction Fuzzy Hash: 015173B0D007488FEB14CFAAC588BAEBBF0FB49314F208459E459A3250DB75A884CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0B3C7078, Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0B3C72AE

Memory Dump Source

Source File: 00000000.00000002.660987864.000000000B3C0000.00000040.00000001.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3c0000_6Rn5G1VWPB.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 00e65fbbb4b54418eaeba8791c51b0befb45ab554bb69c65f51c27cf1dac9d40
Instruction ID: 00c70066f2e8fd22320d9969f4b50cb045c49d1f8bce6e5937930967ee668bc7
Opcode Fuzzy Hash: 00e65fbbb4b54418eaeba8791c51b0befb45ab554bb69c65f51c27cf1dac9d40
Instruction Fuzzy Hash: 06916971E00219DFDF24CFA4C881BEEBBB2BB48314F1481A9E859A7240DB749D85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0107BBB8, Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0107BE0E

Memory Dump Source

Source File: 00000000.00000002.656963430.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_6Rn5G1VWPB.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ec23bae836eac19343f82fe012c1a123539cb256a2e7a36954a19dd044aca3e6
Instruction ID: c7f5e6aee81cffe2352372b74c2586330aa4a91c8d7a460cf2aaeab456f64080
Opcode Fuzzy Hash: ec23bae836eac19343f82fe012c1a123539cb256a2e7a36954a19dd044aca3e6
Instruction Fuzzy Hash: FE815670A00B098FD764DF2AC45479ABBF1FF88204F00896DE586DBA40DB75E806CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0107DC6D, Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0107DD8A

Memory Dump Source

Source File: 00000000.00000002.656963430.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_6Rn5G1VWPB.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: dbf68b862fa387e61221a77ace93a094e8b4983c02078a28dfbd881083b01477
Instruction ID: 99399750f7be8603462a0d9faa00447a26a924f78aae377ec7d69d606247f67a
Opcode Fuzzy Hash: dbf68b862fa387e61221a77ace93a094e8b4983c02078a28dfbd881083b01477
Instruction Fuzzy Hash: 2C51BEB1D003599FDB14CFAAC884ADEBBF1FF48310F24812AE919AB210D7759985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0107DC78, Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0107DD8A

Memory Dump Source

Source File: 00000000.00000002.656963430.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_6Rn5G1VWPB.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 7e7f8f8f4aad98844d86d33db3af8f3ed6a78862fc1a8c975271aa99b2b92f40
Instruction ID: 9148cc0f0d2f08a733d539c5192d19cedba73f268fe75b0cc7def7998e195765
Opcode Fuzzy Hash: 7e7f8f8f4aad98844d86d33db3af8f3ed6a78862fc1a8c975271aa99b2b92f40
Instruction Fuzzy Hash: B941CEB1D00309DFDB14CFAAC884ADEBBF5BF88310F24812AE819AB210D7759845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01076D51, Relevance: 1.6, APIs: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01076E4F

Memory Dump Source

Source File: 00000000.00000002.656963430.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_6Rn5G1VWPB.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1247c427e8d10af487ed0ce53bd243ebd4ced47722a02592a6038fde276acb7e
Instruction ID: 1016fc0c058ab2356e84a9fd35779ea677e43a8d70b15687c5ed5c718af6e13a
Opcode Fuzzy Hash: 1247c427e8d10af487ed0ce53bd243ebd4ced47722a02592a6038fde276acb7e
Instruction Fuzzy Hash: D0418876A00249AFDB01CFA9D884AEEBFF5FB49320F14806AE954A7310D3759955CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0B3C6DF0, Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0B3C6E80

Memory Dump Source

Source File: 00000000.00000002.660987864.000000000B3C0000.00000040.00000001.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3c0000_6Rn5G1VWPB.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: fa98dbd0d6a83781abc0f99462e9232c5c6217b331be62afbef5dc91bcc16b49
Instruction ID: 518f18ce1393268cad4580b6634799c09162806e48c0080161ef1d88eef4e98b
Opcode Fuzzy Hash: fa98dbd0d6a83781abc0f99462e9232c5c6217b331be62afbef5dc91bcc16b49
Instruction Fuzzy Hash: 7C2136719003599FCF10CFAAC885BEEBBF5FF48314F10842AE959A7240C778A955CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01076DC0, Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01076E4F

Memory Dump Source

Source File: 00000000.00000002.656963430.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_6Rn5G1VWPB.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 813548249afa2d95b69ddfe0fc151c302714c9c64ec79f6fe292cf7018bf96d2
Instruction ID: 3b88ba266d402f2295d2c3e5b73922de14587dc12485a6686538b929a75f954e
Opcode Fuzzy Hash: 813548249afa2d95b69ddfe0fc151c302714c9c64ec79f6fe292cf7018bf96d2
Instruction Fuzzy Hash: 8D21D2B5D002489FDB10CFA9D888AEEBBF4FF48324F14845AE955A7310D375A955CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0B3C6618, Relevance: 1.6, APIs: 1, Instructions: 63
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 0B3C6696

Memory Dump Source

Source File: 00000000.00000002.660987864.000000000B3C0000.00000040.00000001.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3c0000_6Rn5G1VWPB.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 810e7754b0ff1c425275aa7002c54d4bc5cd2eb7a41764422dd5c96df0c63ae9
Instruction ID: 20ace3ef8fdbd69884654bf9eb4ec396967fa97172acc4afc47e9cbe0706cd34
Opcode Fuzzy Hash: 810e7754b0ff1c425275aa7002c54d4bc5cd2eb7a41764422dd5c96df0c63ae9
Instruction Fuzzy Hash: 222115719003099FCB10DFAAC4857EFBBF4EF49264F14842EE959A7241CB78A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B3C6EE0, Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0B3C6F60

Memory Dump Source

Source File: 00000000.00000002.660987864.000000000B3C0000.00000040.00000001.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3c0000_6Rn5G1VWPB.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b7c1623ac380178e4e548ce3520a94f6368cf0105a507a5aae1920c226efd4b2
Instruction ID: b30d5788006f87b1b28247a9c36d1a6a2f26a215062574332b7fbbce5f5452ea
Opcode Fuzzy Hash: b7c1623ac380178e4e548ce3520a94f6368cf0105a507a5aae1920c226efd4b2
Instruction Fuzzy Hash: DA2128719003599FCB10CFAAC8847DEBBF5FF48314F10842AE959A7240C7789945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01076DC8, Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01076E4F

Memory Dump Source

Source File: 00000000.00000002.656963430.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_6Rn5G1VWPB.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 552e2039bfb2a5fc8ddb657a076c1da9ed901bf60ac0675c4fc268dbd5b2e7c6
Instruction ID: 7ecbc0c4a8cb6361718a0fbef89f1f59f5541392f400da14caf0adbd32ec044b
Opcode Fuzzy Hash: 552e2039bfb2a5fc8ddb657a076c1da9ed901bf60ac0675c4fc268dbd5b2e7c6
Instruction Fuzzy Hash: 1B21D3B5D002589FDB10CFAAD884ADEFBF8FB48324F14841AE955A3310D375A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0107B0B0, Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0107BE89,00000800,00000000,00000000), ref: 0107C09A

Memory Dump Source

Source File: 00000000.00000002.656963430.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_6Rn5G1VWPB.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1431c51c3d2d2e807a31da1cefed210ef8478b5bd81607a6f88f4af3c84d6f84
Instruction ID: c4b197f112a0734044f873620780521ba7eb1ad9ba4cfa8d605795cf11dbba2e
Opcode Fuzzy Hash: 1431c51c3d2d2e807a31da1cefed210ef8478b5bd81607a6f88f4af3c84d6f84
Instruction Fuzzy Hash: 8A1103B6D002098FDB14CF9AD448B9EFBF4EB49324F04842EE955A7600C3B5A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0B3C2778, Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0B3C27EB

Memory Dump Source

Source File: 00000000.00000002.660987864.000000000B3C0000.00000040.00000001.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3c0000_6Rn5G1VWPB.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: caeb71f78723ad8996148011ee1a54369282efdb18bf7ebff46692af2fad05ee
Instruction ID: 5d7213200ea3e0c7a0383fbfca5ca44699ce5ace5f72cc5d6f4a0638d732316f
Opcode Fuzzy Hash: caeb71f78723ad8996148011ee1a54369282efdb18bf7ebff46692af2fad05ee
Instruction Fuzzy Hash: CA21E7B59002499FCB10CF9AD884BDFFBF4FB48320F108429E958A7240D378A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0107C028, Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0107BE89,00000800,00000000,00000000), ref: 0107C09A

Memory Dump Source

Source File: 00000000.00000002.656963430.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_6Rn5G1VWPB.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c39b7ae983e9bd30fd75b9e6e609b4d863c95ecf107567c9a542ae85a3b33784
Instruction ID: a1f4ca454874d602570b83ae19f06c4ab0e959ef3742fe07aa6595c2b9d87490
Opcode Fuzzy Hash: c39b7ae983e9bd30fd75b9e6e609b4d863c95ecf107567c9a542ae85a3b33784
Instruction Fuzzy Hash: 4A1136B2D002098FDB10CFAAD484BDEFBF4AB49314F14852EE955A7200C375A546CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0B3C6568, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0B3C65CA

Memory Dump Source

Source File: 00000000.00000002.660987864.000000000B3C0000.00000040.00000001.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3c0000_6Rn5G1VWPB.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: b42317588e9e805d1f7a77c6072f873b82626f1f25d5f7b867f03210b61c44a4
Instruction ID: 3a7246e2a93f113e65e9efd2544a85f7091ecae7e094a9aa13d5c34db86e2f1a
Opcode Fuzzy Hash: b42317588e9e805d1f7a77c6072f873b82626f1f25d5f7b867f03210b61c44a4
Instruction Fuzzy Hash: 9B1136B19003488FCB10DFAAC4497DFFBF4AB88224F24842AD519A7240C779A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0107BDA8, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0107BE0E

Memory Dump Source

Source File: 00000000.00000002.656963430.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_6Rn5G1VWPB.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 09b8067f9ecc1b6e4428c5ddb1577645802e9bb0287c8ba0528ab388078179d1
Instruction ID: 59687dfc492f316e8698cc8495d9f6fe9918b064f00b253bffc8213e4bfc3123
Opcode Fuzzy Hash: 09b8067f9ecc1b6e4428c5ddb1577645802e9bb0287c8ba0528ab388078179d1
Instruction Fuzzy Hash: 031110B2C002498FDB10CF9AC448BDEFBF4EB88324F10846AD969A7700C374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B3CC280, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0B3CC2D8

Memory Dump Source

Source File: 00000000.00000002.660987864.000000000B3C0000.00000040.00000001.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3c0000_6Rn5G1VWPB.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 73cc54f1d31b29bc5089db203ce39b8af6a7ad677f47429a4be2d7d1f484c037
Instruction ID: 781e3fcf18ff20abcd9026e4666e3024f5eaeae48640ea5dcaabe5bc4b91a46c
Opcode Fuzzy Hash: 73cc54f1d31b29bc5089db203ce39b8af6a7ad677f47429a4be2d7d1f484c037
Instruction Fuzzy Hash: 5E1115B5800349CFCB10CF9AD488BDEBBF4EB48324F14846AE959A7740D778A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0107DEB9, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0107DF1D

Memory Dump Source

Source File: 00000000.00000002.656963430.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_6Rn5G1VWPB.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 7930cd1cb40e49a07e579fd8fe5ae97cbfa35e0c64a2f7558f3bb281b7802d59
Instruction ID: d3adedd5b9b6820d60b65682d8530580b8acfce3e235e5f02a46bcc4599b8ce6
Opcode Fuzzy Hash: 7930cd1cb40e49a07e579fd8fe5ae97cbfa35e0c64a2f7558f3bb281b7802d59
Instruction Fuzzy Hash: 061103B59002488FDB20CF99D489BDEBBF4FB48320F10845AE959A7700C374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0107DEC0, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0107DF1D

Memory Dump Source

Source File: 00000000.00000002.656963430.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_6Rn5G1VWPB.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 607463eeb1eb0c33b57f88ed0c98eac4b133195aebc85defb4b772184da5503a
Instruction ID: 254805399994496aeb8bc06b8a8e6776bba8ebcc2c26d51a84cef0b29bf546f3
Opcode Fuzzy Hash: 607463eeb1eb0c33b57f88ed0c98eac4b133195aebc85defb4b772184da5503a
Instruction Fuzzy Hash: 7411D0B59002499FDB10CF9AD488BDEBBF8EB48324F10845AE955A7700C3B5A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0B3CA060, Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0B3CA0BD

Memory Dump Source

Source File: 00000000.00000002.660987864.000000000B3C0000.00000040.00000001.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3c0000_6Rn5G1VWPB.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e0074c10ff0e80efdf67a0c3e5fd107f5bc2f208c1624649a6f2510573030e6d
Instruction ID: 177d6364a2961227f05c93750727ea4e851a591a71aa3a0717c8385bd1ba59de
Opcode Fuzzy Hash: e0074c10ff0e80efdf67a0c3e5fd107f5bc2f208c1624649a6f2510573030e6d
Instruction Fuzzy Hash: 2D11D3B58003599FDB10CF9AD888BDFBBF8FB48324F10845AE554A7600C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B3C6D5E, Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0B3C6D9E

Memory Dump Source

Source File: 00000000.00000002.660987864.000000000B3C0000.00000040.00000001.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3c0000_6Rn5G1VWPB.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6d19f8560d9d5af23fcb335ae8b465a875c0fa8346be577e6a3249048d2d0806
Instruction ID: 994c651417faac4b7b6e7145254317450bd3e4244d22baa00c5d66700e5747c4
Opcode Fuzzy Hash: 6d19f8560d9d5af23fcb335ae8b465a875c0fa8346be577e6a3249048d2d0806
Instruction Fuzzy Hash: A5014C759042098FCF10CFA9D8447DFBBF1BF88314F14C429E555A7250C7759554DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0100D4D8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.656871841.000000000100D000.00000040.00000001.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100d000_6Rn5G1VWPB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f5cd1362beacc973b946b3ff38fa8e4d7a20de309a05ef18813a10be2e4ef13
Instruction ID: 658014416a8e970105fca4c62e0ba85832d56449917933b76311e144dace5f95
Opcode Fuzzy Hash: 6f5cd1362beacc973b946b3ff38fa8e4d7a20de309a05ef18813a10be2e4ef13
Instruction Fuzzy Hash: DD212BB1504200DFEB06CF94D9C0B16BFA5FB88329F2485A9ED454B286C337D846C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 0101D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.656892024.000000000101D000.00000040.00000001.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_101d000_6Rn5G1VWPB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba3b051830634da3b9392592b0b462b3fc045631cdf9d813312111fdfb64dfc3
Instruction ID: b2c94af934246662300f60e422ce33b9dac64b921507e485abaf34ace7b7b13b
Opcode Fuzzy Hash: ba3b051830634da3b9392592b0b462b3fc045631cdf9d813312111fdfb64dfc3
Instruction Fuzzy Hash: 7C2137B5504200DFCB16CF54D8C8B16BBA1FB84354F24C9ADE9894B24AC37AD847CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0100D4D3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.656871841.000000000100D000.00000040.00000001.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100d000_6Rn5G1VWPB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abf9d05837f20679d6678064280a21b40d007861ebc24b3ccb10da70a24719c3
Instruction ID: 93aadc86b161e80a20f688a27d98c1a2c553c41e3ebf3098e5bd3893467deba5
Opcode Fuzzy Hash: abf9d05837f20679d6678064280a21b40d007861ebc24b3ccb10da70a24719c3
Instruction Fuzzy Hash: DF11B176504280CFDB12CF54D5C4B16BFB1FB88324F2886AADC450B656C33AD456CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0101D017, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.656892024.000000000101D000.00000040.00000001.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_101d000_6Rn5G1VWPB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21dbda9fffde9beb189af7165341122266bd3c9337f42a4093e234a02c9dbdce
Instruction ID: e6c7a6b85ab98896adbcd86bfad86c2e11b55df5683a466089c1df286e7218c7
Opcode Fuzzy Hash: 21dbda9fffde9beb189af7165341122266bd3c9337f42a4093e234a02c9dbdce
Instruction Fuzzy Hash: AB11D075504280CFCB12CF54D5C8B15FFB1FB44314F28C6AAE8494B65AC33AD44ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0100D7FD, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.656871841.000000000100D000.00000040.00000001.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100d000_6Rn5G1VWPB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecb5bf181f6e689b12fc0329063d090ecbfce95b284e54b094ac4424964bdaa8
Instruction ID: b05e0f988bbdcdd8c0828baee35d9229fe2fe00dbaa05f28c3ab5f38382f58cc
Opcode Fuzzy Hash: ecb5bf181f6e689b12fc0329063d090ecbfce95b284e54b094ac4424964bdaa8
Instruction Fuzzy Hash: 5E01A7715083549AF7124AE6DC84766BBD8EF45634F08C09AEE495B286C3789A44C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 0100D7FC, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.656871841.000000000100D000.00000040.00000001.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100d000_6Rn5G1VWPB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1ad44567de1729d3f6219d41ae8b214d8003883ce2c59cfbce807bd6e1f2c49
Instruction ID: f403c59c31c396a3289571728c0520440c3cec916b1fc7eaacb018e4504727a6
Opcode Fuzzy Hash: a1ad44567de1729d3f6219d41ae8b214d8003883ce2c59cfbce807bd6e1f2c49
Instruction Fuzzy Hash: 27F062714042949EEB518A5ADCC4B62FFD8EB55634F18C49AED485B286C3789844CBB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0B3C8340, Relevance: 4.0, Strings: 3, Instructions: 228COMMON

Download Yara Rule

Strings

rEb, xrefs: 0B3C8499
8s8, xrefs: 0B3C8472
3Lbk, xrefs: 0B3C855E

Memory Dump Source

Source File: 00000000.00000002.660987864.000000000B3C0000.00000040.00000001.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3c0000_6Rn5G1VWPB.jbxd

Similarity

API ID:
String ID: 3Lbk$8s8$rEb
API String ID: 0-1209182574
Opcode ID: a363645b3f18ec3bc6ec784e752fdd8cc2ef5145ff1522fecd34d593346d3a0b
Instruction ID: 50e1f228e9be239fe8d35f98facbfb324e4b60da754793e127547dafc871ff5f
Opcode Fuzzy Hash: a363645b3f18ec3bc6ec784e752fdd8cc2ef5145ff1522fecd34d593346d3a0b
Instruction Fuzzy Hash: C991B0B4E49209DF8B58CFE9D5815EEBBF6EB89300F20902AD515BB254D730AE02CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0B3C8330, Relevance: 2.7, Strings: 2, Instructions: 223COMMON

Download Yara Rule

Strings

rEb, xrefs: 0B3C8499
3Lbk, xrefs: 0B3C855E

Memory Dump Source

Source File: 00000000.00000002.660987864.000000000B3C0000.00000040.00000001.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3c0000_6Rn5G1VWPB.jbxd

Similarity

API ID:
String ID: 3Lbk$rEb
API String ID: 0-2844450111
Opcode ID: 142c0341489aa611638f08ed1f292bbede3381ab2086407961f284cddd6938f4
Instruction ID: 9eb1e4c4f4067dba90e4e26188c343f352b241f8328c1aa853576e8f4099c2fb
Opcode Fuzzy Hash: 142c0341489aa611638f08ed1f292bbede3381ab2086407961f284cddd6938f4
Instruction Fuzzy Hash: 9C91CFB5E59209DFCB58CFE9D5815EEBBF2EB89300F20912AD415BB254E730AE01CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0B3C4100, Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

nW9&, xrefs: 0B3C41BB

Memory Dump Source

Source File: 00000000.00000002.660987864.000000000B3C0000.00000040.00000001.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3c0000_6Rn5G1VWPB.jbxd

Similarity

API ID:
String ID: nW9&
API String ID: 0-1338470238
Opcode ID: a34dcd57446acd2e74330720a69453e9c1de464eb55c4dadff336ca940113fc0
Instruction ID: 0b8bbd23b6bb088dec1768cf58ab47645cbd2ce10efd2eac5dda01d2b8e006b4
Opcode Fuzzy Hash: a34dcd57446acd2e74330720a69453e9c1de464eb55c4dadff336ca940113fc0
Instruction Fuzzy Hash: BDB11374E052598BDB08CFEAC9915DEFBF2BB98300F24D12AD414EB358E7349D428B65

Uniqueness

Uniqueness Score: -1.00%

Function 0B3C3160, Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

5:`, xrefs: 0B3C323F

Memory Dump Source

Source File: 00000000.00000002.660987864.000000000B3C0000.00000040.00000001.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3c0000_6Rn5G1VWPB.jbxd

Similarity

API ID:
String ID: 5:`
API String ID: 0-1378078324
Opcode ID: 44a36f1d4b49f0373300f350339430d755f36a0bd974c02d7c46325a1c49cd51
Instruction ID: 52d7653b0fddf43c331ed3f0a265b6f937e59ce4d4e65899469d7aae1fd40944
Opcode Fuzzy Hash: 44a36f1d4b49f0373300f350339430d755f36a0bd974c02d7c46325a1c49cd51
Instruction Fuzzy Hash: BE319171D116188FDB18CFBAD98469ABBF3AFC9300F55C06AC448AB259DB301982CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0107C2B0, Relevance: .5, Instructions: 522COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.656963430.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_6Rn5G1VWPB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e581211f8b080566eb17a7d09402c11c2d5aeb3d65e9e6bceacc922a17674ce
Instruction ID: 185995bb4b8d59289ea2bd7862531deafcda6966159425c94517cdbfd4bcd559
Opcode Fuzzy Hash: 3e581211f8b080566eb17a7d09402c11c2d5aeb3d65e9e6bceacc922a17674ce
Instruction Fuzzy Hash: 305239B9D807068FD710CF1CEDC85997BA1FB44328BD24A08D2616BAD1D7B8657ACF44

Uniqueness

Uniqueness Score: -1.00%

Function 01079968, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.656963430.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_6Rn5G1VWPB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd382ea9c7d1fc8254c6d472a8447c983c47ec61ff10c0132eb40108d7730a8c
Instruction ID: 3a270f065c57ca692486285969f142b464c5657b0df0890e44a296601d232470
Opcode Fuzzy Hash: fd382ea9c7d1fc8254c6d472a8447c983c47ec61ff10c0132eb40108d7730a8c
Instruction Fuzzy Hash: 71A16D36E0021ACFCF05DFA9C8445DEBBF2FF89304B15856AE905AB261EB35E955CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00627DA2, Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.656198943.0000000000622000.00000002.00020000.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.656193474.0000000000620000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.656361773.0000000000716000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.656374839.0000000000726000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_6Rn5G1VWPB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba827c84f821d5d6d7ed769fcfcf44a638718b49557519cecf6f1cc0aa9cff9
Instruction ID: cb888c95f2fe2bc4b2f4b07e715ad9306d6ad650b7cea5f34990ee00113b5418
Opcode Fuzzy Hash: bba827c84f821d5d6d7ed769fcfcf44a638718b49557519cecf6f1cc0aa9cff9
Instruction Fuzzy Hash: 2581CEA644E3C15FC7538B748CA96827FB19E23120B1E45EBD4C1CE4A3E15C4A5ACB73

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 6Rn5G1VWPB.exe PID: 6488 Parent PID: 6004 6Rn5G1VWPB.exeCOMMON

Execution Graph

Execution Coverage:	13.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	48
Total number of Limit Nodes:	6

Executed Functions

Function 010EE210, Relevance: 2.3, APIs: 1, Instructions: 760libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 010EE998

Memory Dump Source

Source File: 00000002.00000002.914379656.00000000010E0000.00000040.00000001.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10e0000_6Rn5G1VWPB.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 981517bb437fcb74ecd089a6947ed9bfcbc0db709a82644a1e0dce1543f9b961
Instruction ID: eace6ac819185f0e0f8a619e83b987d67fd1146ed555c6d0bc4bd80a7958dc6d
Opcode Fuzzy Hash: 981517bb437fcb74ecd089a6947ed9bfcbc0db709a82644a1e0dce1543f9b961
Instruction Fuzzy Hash: B5621B31E046198FDB24EF79C95469EB7F2AF89300F1086A9D549AB750EF30AE85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 010CF08C, Relevance: 1.7, APIs: 1, Instructions: 177libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 010CF0C9

Memory Dump Source

Source File: 00000002.00000002.914313245.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10c0000_6Rn5G1VWPB.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8cb195d3dbface1ecdc3a8986ecba2770074b116d9c59cb6ccc2b667a1bb17ee
Instruction ID: b1ff22a5e297d1bfabb844048d7059460d22273d0d6692244f8b18fc1067d26c
Opcode Fuzzy Hash: 8cb195d3dbface1ecdc3a8986ecba2770074b116d9c59cb6ccc2b667a1bb17ee
Instruction Fuzzy Hash: 87614B30A012069FDB14EBB9D458BAE77F7AF84704F10852CD442AB354DF74994ACF51

Uniqueness

Uniqueness Score: -1.00%

Function 010D0A70, Relevance: 9.7, APIs: 4, Strings: 1, Instructions: 984libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D0E69
KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Strings

x l, xrefs: 010D230A

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID: x l
API String ID: 2638914809-2770355295
Opcode ID: db40fc143cd2cffae603ae3e384517fdc3b0a06b4c4e95d38a51b3a90688e021
Instruction ID: 15743bfb0ee04be2fce7a36e1772264cbe93d29a82cdcaf9bdcb5aa8a0d1a4e4
Opcode Fuzzy Hash: db40fc143cd2cffae603ae3e384517fdc3b0a06b4c4e95d38a51b3a90688e021
Instruction Fuzzy Hash: 1EA203B4A04228CFCB64EB24D89879DB7B6BF88305F1085E9E949A3754CF349E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010D0A91, Relevance: 6.6, APIs: 4, Instructions: 637libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D0E69
KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 2edf367f3a5861f1ae640fccd90739daf7a6791a68bda4364fc60fbd559f8bce
Instruction ID: c713249a4f9ce14a073492b340fbc79f68fb6e8d40d298c96f55616ba1c6ec98
Opcode Fuzzy Hash: 2edf367f3a5861f1ae640fccd90739daf7a6791a68bda4364fc60fbd559f8bce
Instruction Fuzzy Hash: A662F774A04228CFCB64EF64D89879DB7B6BF88206F5085E9E509A3744CF349E85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 010D0AD6, Relevance: 6.6, APIs: 4, Instructions: 630libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D0E69
KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: cf66bb869b2bff985803ddba2f13eface1f098a03449a7a225aaef22d7802f91
Instruction ID: 30bdfc516ed3a8bdf0448f9681ad27962eb4c743d90b31085539e0b96ad5ed07
Opcode Fuzzy Hash: cf66bb869b2bff985803ddba2f13eface1f098a03449a7a225aaef22d7802f91
Instruction Fuzzy Hash: 90520674A04228CFCB64EF64D89879DB7B6BF88206F5085E9E509A3744CF349E85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 010D0B1B, Relevance: 6.6, APIs: 4, Instructions: 623libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D0E69
KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: e30265a5b66a4cc20d442280e2c23597e0604bac0b892840ab666a2b8729db57
Instruction ID: aa2ed94583d1c5b52520c84889ea85564a3f23b830c0943929602c2cb869780b
Opcode Fuzzy Hash: e30265a5b66a4cc20d442280e2c23597e0604bac0b892840ab666a2b8729db57
Instruction Fuzzy Hash: F152F7B4A04228CFCB64EF64D89879DB7B6BF88206F5085E9E509A3744CF349E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 010D0B60, Relevance: 6.6, APIs: 4, Instructions: 616libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D0E69
KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 994b41654fab6abfa3e84a3df7d6c87010e2caf22b41f1cbf1a77d4196fc72d2
Instruction ID: fbd51c8348d737f55ee05c3fe6e6574165a019e5be23e228b3b53119cce3a843
Opcode Fuzzy Hash: 994b41654fab6abfa3e84a3df7d6c87010e2caf22b41f1cbf1a77d4196fc72d2
Instruction Fuzzy Hash: 8352F774A04228CFCB64EF64D89879DB7B6BF88206F5085E9E509A3744CF349E85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 010D0BA5, Relevance: 6.6, APIs: 4, Instructions: 607libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D0E69
KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 7faaa26a1c566d0eea4b60af157018391e70d6cce72472070db88736816a18d8
Instruction ID: 1d420a7f256f9baf7f4b1eafc65e72d203875681aadb7c4a4f7ae38850191a84
Opcode Fuzzy Hash: 7faaa26a1c566d0eea4b60af157018391e70d6cce72472070db88736816a18d8
Instruction Fuzzy Hash: 37520774A04228CFCB64EF64D89879DB7B6BF88206F5085E9E509A3744CF349E85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 010D0BE1, Relevance: 6.6, APIs: 4, Instructions: 602libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D0E69
KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 15bd98c36387be3c1d8023affa9bb399f647268bf6379950a5515ce39de57a04
Instruction ID: 1c903aaa1166b4e9ff7d550d4b412c02921398436df62266806edf4c1d69c39b
Opcode Fuzzy Hash: 15bd98c36387be3c1d8023affa9bb399f647268bf6379950a5515ce39de57a04
Instruction Fuzzy Hash: 965206B4A04228CFCB64EF64D89879DB7B6BF88206F5085E9E509A3744CF349E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 010D0C26, Relevance: 6.6, APIs: 4, Instructions: 595libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D0E69
KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: ba635a70e3f6c21516b3bc69f694c83d48a5c1094e757a4fc5ccefbbebe4456a
Instruction ID: 412d5b0c129ad258cafaabf97cae8ba7767d1645f08aaaa0f2dfa2c29b084d8f
Opcode Fuzzy Hash: ba635a70e3f6c21516b3bc69f694c83d48a5c1094e757a4fc5ccefbbebe4456a
Instruction Fuzzy Hash: 4B5207B4A04228CFCB64EF64D89879DB7B6BF88206F5085E9E509A3744CF349E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 010D0C6B, Relevance: 6.6, APIs: 4, Instructions: 588libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D0E69
KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: a63e2811349b68b9ca16c37c5d6a7a8757bf4641f0e635da607bd9a6bd9f568c
Instruction ID: 48fcfb724197c60a3a3ec3f548c0bcd45cc07a9c3e88131b998728163dc65208
Opcode Fuzzy Hash: a63e2811349b68b9ca16c37c5d6a7a8757bf4641f0e635da607bd9a6bd9f568c
Instruction Fuzzy Hash: A55206B4A04228CFCB64EF64D89879DB7B6BF88206F5085E9E509A3744CF349E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 010D0CB0, Relevance: 6.6, APIs: 4, Instructions: 581libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D0E69
KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: bac308755d01f5cd09b30ad52ac4682ac10dcae97141f69e6c315d49c0b185ab
Instruction ID: f9222d233101f16a4dc4799f7ab6444ddf117a62b4dd4c49ef9356dd3d379627
Opcode Fuzzy Hash: bac308755d01f5cd09b30ad52ac4682ac10dcae97141f69e6c315d49c0b185ab
Instruction Fuzzy Hash: B14207B4A04228CFCB64EF64D89879DB7B6BF88206F5085E9E509A3744CF349E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 010D0CF5, Relevance: 6.6, APIs: 4, Instructions: 572libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D0E69
KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 297dfa1db61d13bacfcd812f44cfd4c9922ae21358c9b63b32f9965b8e1e34d9
Instruction ID: 6051eaf669927b51200d460cd032cb56369925e13a0b0910b364a74c6dc851fc
Opcode Fuzzy Hash: 297dfa1db61d13bacfcd812f44cfd4c9922ae21358c9b63b32f9965b8e1e34d9
Instruction Fuzzy Hash: DE4206B4A04228CFCB64EF64D89879DB7B6BF88206F5085E9E549A3740CF349E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 010D0D31, Relevance: 6.6, APIs: 4, Instructions: 567libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D0E69
KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 8444d59d030c7da59630cc83c166aaaa6c518a74367abd465191070fdf852698
Instruction ID: 5b685ae9994bcbc16c7d2d7644464c4523f30f4879d0cf178b6bda1003ef6ea2
Opcode Fuzzy Hash: 8444d59d030c7da59630cc83c166aaaa6c518a74367abd465191070fdf852698
Instruction Fuzzy Hash: 504206B4A04228CFCB64EF64D89879DB7B6BF88206F5085E9E509A3740CF349E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 010D0D76, Relevance: 6.6, APIs: 4, Instructions: 560libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D0E69
KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: cd867255989d01dabd3864339f1aafbb09b358e031e136e3715386e696805988
Instruction ID: a1bc96a0ff8d7d5f1f9dd6ae620e5ea6fc111111f1092d3ced3e5af6bf035482
Opcode Fuzzy Hash: cd867255989d01dabd3864339f1aafbb09b358e031e136e3715386e696805988
Instruction Fuzzy Hash: 794206B4A04228CFCB64EF64D89879DB7B6BF88206F5085E9E509A3740CF349E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010D0DBB, Relevance: 6.6, APIs: 4, Instructions: 553libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D0E69
KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: cb497f5a337db19dca1f236bf0a560d99a263ec94a509ad70bb2569a7783918c
Instruction ID: 42f957c0a30d364b3a668f89c012a523f4a3b7f3e67117e9089357fd553dda04
Opcode Fuzzy Hash: cb497f5a337db19dca1f236bf0a560d99a263ec94a509ad70bb2569a7783918c
Instruction Fuzzy Hash: F44207B4A04228CFCB64EF64D85879DB7B6BF88206F5085E9E909A3754CF349E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010D0E00, Relevance: 6.5, APIs: 4, Instructions: 546libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D0E69
KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 2d6e4f2030ac2b4f1ae6c5557b3e23b89d21e9bc523ca7f755e0d33f4e7cf284
Instruction ID: 4c3447f400000b1bd170504c727736fd43fe4f0dfadddd30e0140d96aabee90f
Opcode Fuzzy Hash: 2d6e4f2030ac2b4f1ae6c5557b3e23b89d21e9bc523ca7f755e0d33f4e7cf284
Instruction Fuzzy Hash: 954207B4A04228CFCB64EF64D89879DB7B6BF88206F5085E9E509A3754CF349E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010D0E45, Relevance: 6.5, APIs: 4, Instructions: 539libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D0E69
KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: e5913c0da839ed7674fd98a218edee6921707fdf309165a083ae576b8156d15c
Instruction ID: 79a45b73d8bb52c282c45c3d3d2930e2b343ee2bf8d03154f1d4637bcf85f859
Opcode Fuzzy Hash: e5913c0da839ed7674fd98a218edee6921707fdf309165a083ae576b8156d15c
Instruction Fuzzy Hash: 714207B4A04228CFCB64EF64D85879DB7B6BF88206F5085E9E909A3750CF349E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 010D0E8A, Relevance: 5.0, APIs: 3, Instructions: 532libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 295f92c6b95d051f66517c7f149d21dd9a256dfba7d95f0a57bb49d55fad298b
Instruction ID: c697a7406a81d1ed7dc0b4f8fee9c4b3de8df50e2c3351fe10bb25996de70a88
Opcode Fuzzy Hash: 295f92c6b95d051f66517c7f149d21dd9a256dfba7d95f0a57bb49d55fad298b
Instruction Fuzzy Hash: CD3208B4A04228CFCB64EF64D89879DB7B6BF88205F5085E9E909A3750CF349E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010D0ECF, Relevance: 5.0, APIs: 3, Instructions: 525libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 439863250b2a1d1c7d2e80036e8f3e76c9f987cfd04c4e43e384d6bfeeedf7b7
Instruction ID: 0e4d77113d5e64034539aa83596888b2db13c9d744431a2b07704f0582b5f3ce
Opcode Fuzzy Hash: 439863250b2a1d1c7d2e80036e8f3e76c9f987cfd04c4e43e384d6bfeeedf7b7
Instruction Fuzzy Hash: 6F3207B4A04228CFCB64EF64D85879DB7B6BF88205F5085E9E909A3750CF349E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010D0F14, Relevance: 5.0, APIs: 3, Instructions: 518libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 1752d9966c928ca3032889a5c67d1f942698e98a4df22c35af68a67d303ab479
Instruction ID: 2a1d0f3b39efb410976351360b1d654c659ef1099636d787ccade7f7d96ac92d
Opcode Fuzzy Hash: 1752d9966c928ca3032889a5c67d1f942698e98a4df22c35af68a67d303ab479
Instruction Fuzzy Hash: B13207B4A04228CFCB64EF64D89879DB7B6BF88205F5085E9E909A3750CF349E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010D0F59, Relevance: 5.0, APIs: 3, Instructions: 511libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: d20cead69770fe506bc9a0dcb018bbec7ff27cecc0f7fd3e0dc3118ddf35df05
Instruction ID: a11cf352b38e0598a5c3c51bd09009d4ee0891647b275932131b0d946afb54b7
Opcode Fuzzy Hash: d20cead69770fe506bc9a0dcb018bbec7ff27cecc0f7fd3e0dc3118ddf35df05
Instruction Fuzzy Hash: B33207B4A04228CFCB64EF64D89879DB7B6BF88205F5085E9E909A3750CF349E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 010D0F9E, Relevance: 5.0, APIs: 3, Instructions: 502libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 5928a38b49657a44be4354be27a77e39731fae53a4ca64ec15eba7d585237840
Instruction ID: f0eb5f4d6e8e32d83766646e309204fb787061445a32840adfdf7c47b94f5fcf
Opcode Fuzzy Hash: 5928a38b49657a44be4354be27a77e39731fae53a4ca64ec15eba7d585237840
Instruction Fuzzy Hash: BD3207B4A04228CFCB64EF64D89879DB7B6BF88205F5085E9E909A3750CF349E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 010D0FDA, Relevance: 5.0, APIs: 3, Instructions: 497libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 9e85d9cc3a4a2494185f00fa9bb4b07c1f1459804f469691ef905c2285a0aabb
Instruction ID: ccc1837dbe2a91d37f737b03475f6be2817720a7153feed0ecf308ebee3cdafc
Opcode Fuzzy Hash: 9e85d9cc3a4a2494185f00fa9bb4b07c1f1459804f469691ef905c2285a0aabb
Instruction Fuzzy Hash: A13216B4A04228CFCB64EF64D89879DB7B6BF88205F5085E9E909A3750CF349E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 010D101F, Relevance: 5.0, APIs: 3, Instructions: 490libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 43938bfd5e8ac1f23b76c576bc6da2a6a0bfede5a600bc715832a649d8c52fef
Instruction ID: b7182369b9c39e9b1505dec2ba010935b25a9635f0c8d976c6ec5a8e1e5fa54b
Opcode Fuzzy Hash: 43938bfd5e8ac1f23b76c576bc6da2a6a0bfede5a600bc715832a649d8c52fef
Instruction Fuzzy Hash: DA2216B4A04228CFCB64EF64D89879DB7B6BF88205F5085E9E909A3750CF349E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 010D1064, Relevance: 5.0, APIs: 3, Instructions: 483libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 9ddb6c130d653b74368c19f40858f87d823822ec4eb0c24663d58dcae9d61504
Instruction ID: 3edb99e706cd84a54b1e9839d9534cb90cc9ddedac8afafa1e037689b4d6c9f3
Opcode Fuzzy Hash: 9ddb6c130d653b74368c19f40858f87d823822ec4eb0c24663d58dcae9d61504
Instruction Fuzzy Hash: 6B2216B4A04228CFCB64EF64D89879DB7B6BF88205F5085E9E909A3750CF349E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 010D10A9, Relevance: 5.0, APIs: 3, Instructions: 474libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 46cb3f2b053b5820e7a4dc17498dcc76dfe226156f0cbd271026437f27207c62
Instruction ID: 55a15a1e948c89434627858567831a4f8fed18c297d5baed3ec62976e48ed989
Opcode Fuzzy Hash: 46cb3f2b053b5820e7a4dc17498dcc76dfe226156f0cbd271026437f27207c62
Instruction Fuzzy Hash: 292217B4A04228CFCB64EF64D89879DB7B6BF88205F5085E9E909A3750CF349E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 010D10E5, Relevance: 5.0, APIs: 3, Instructions: 469
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D1109
LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: ec318c0dac501eb487d4684f28266c91d92aec055a163379760180c4cd290537
Instruction ID: 136def411e2dcdb4071ded980b41c68b0b7e4e6f169b2e6542d046173f033586
Opcode Fuzzy Hash: ec318c0dac501eb487d4684f28266c91d92aec055a163379760180c4cd290537
Instruction Fuzzy Hash: 972216B4A04228CFCB64EF64D89879DB7B6AF88205F5085E9E909A3750CF349E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 010D1140, Relevance: 3.5, APIs: 2, Instructions: 458libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 50d9575d3bb6008c9aea5e824b8ab652bef20c3a5c329f5b8c060351199367c7
Instruction ID: 65d5d8ef6244177a4d1627e0b0e37dd6aa96c0471d4ec7313743580a7cb0337b
Opcode Fuzzy Hash: 50d9575d3bb6008c9aea5e824b8ab652bef20c3a5c329f5b8c060351199367c7
Instruction Fuzzy Hash: 3E2216B4A04228CFCB64EF64C89879DB7B6BF88205F5085E9E909A3750DF349E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 010D1185, Relevance: 3.5, APIs: 2, Instructions: 451libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 97fb8d5e75575405fda22c6a33fddb850ed316db446087bc0a55f43dd52bdf9f
Instruction ID: f854427b133ac5f34f93265145678e24979070da7e2dcf922e36fbd16c094705
Opcode Fuzzy Hash: 97fb8d5e75575405fda22c6a33fddb850ed316db446087bc0a55f43dd52bdf9f
Instruction Fuzzy Hash: 871215B4A04228CFCB64EF64C85879DB7F6AF88205F5085E9E909A3750DF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 010D11CD, Relevance: 3.4, APIs: 2, Instructions: 444libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: b99a88e4ffaf9cb05eaf1fe689b6921a4d5eae2bee969f307caefc3ab100eb73
Instruction ID: 7f356d83a90279b05b18cbbc91c420c75404573fcdfd4e3134bee6934c7b5ee3
Opcode Fuzzy Hash: b99a88e4ffaf9cb05eaf1fe689b6921a4d5eae2bee969f307caefc3ab100eb73
Instruction Fuzzy Hash: 251215B4A04228CFCB64EF64C85879DB7B6AF88205F5085E9E909A3750DF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 010D1215, Relevance: 3.4, APIs: 2, Instructions: 437libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: fada91a38a8f2f2e043d6d63b62676dfeee73123a39a644fa606400cff5f8570
Instruction ID: de8702e9e204c8a90820e6b5b4753c7555cf70ca23b63633eb7a59acbcc2041d
Opcode Fuzzy Hash: fada91a38a8f2f2e043d6d63b62676dfeee73123a39a644fa606400cff5f8570
Instruction Fuzzy Hash: 521205B4A04228CFCB64EF64C85879DB7F6AF88205F5085E9E909A3750DF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 010D125D, Relevance: 3.4, APIs: 2, Instructions: 428libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 3c6f4bf43db8dcd84b7c817bc531072236050439238350c76987d6f488b67dc1
Instruction ID: ba4c2c7e7929f513ea9973ee004a939adc4228cbdb857c2bea1ef8a1713671f3
Opcode Fuzzy Hash: 3c6f4bf43db8dcd84b7c817bc531072236050439238350c76987d6f488b67dc1
Instruction Fuzzy Hash: 071205B4A04228CFCB64EF64C85879DB7F6AF88205F5085E9E909A3750DF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 010D1299, Relevance: 3.4, APIs: 2, Instructions: 423
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 323ed7db9825a9dcb29c99fa8cc593d492e2262df7cc3121db4e5494c6f22237
Instruction ID: 3c102c897ff364c8350aafbed001eab1bb95856894b2511717956b9cfad9f490
Opcode Fuzzy Hash: 323ed7db9825a9dcb29c99fa8cc593d492e2262df7cc3121db4e5494c6f22237
Instruction Fuzzy Hash: E21205B4A04228CFCB64EB74C85879DB7F6AF88205F5085E9E909A3750DF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 010D12E1, Relevance: 3.4, APIs: 2, Instructions: 416
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: ebbb76bb8b19a7770702a4dbdc2dc884f4ea844093ec970232aae89a45db5fc4
Instruction ID: 5f3a19112da54110f14fb0f9d7f998d55d5731c9a1af183e448d42b35bc9e979
Opcode Fuzzy Hash: ebbb76bb8b19a7770702a4dbdc2dc884f4ea844093ec970232aae89a45db5fc4
Instruction Fuzzy Hash: 980206B4A04228CFCB64EB74C85879DB7F6AF88205F5085E9E909A3750DF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 010D1329, Relevance: 3.4, APIs: 2, Instructions: 409
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: b34ec62411c9bea3cd4bf81f5ad94d2efc7ae0ff94f4cb109a85becef84f0f2c
Instruction ID: 83fe3a26a33b112013e6bbf2cbd8ed8a92da02676dd9e745701b85840dd5011b
Opcode Fuzzy Hash: b34ec62411c9bea3cd4bf81f5ad94d2efc7ae0ff94f4cb109a85becef84f0f2c
Instruction Fuzzy Hash: F10217B4A04228CFCB64EB74C85879DB7F6AF88205F5085E9E909A3750DF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 010D1387, Relevance: 3.4, APIs: 2, Instructions: 398
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 339cd90f346d82355ecf6b9ee1d53ba7621d1184203185f18f37813a1500df09
Instruction ID: 888ef5c87d335afdd465013bb732c327c44901d25e79270acbab3315f1685263
Opcode Fuzzy Hash: 339cd90f346d82355ecf6b9ee1d53ba7621d1184203185f18f37813a1500df09
Instruction Fuzzy Hash: 510217B4A04228CFCB64EB74C85879DB7F6AF88205F5085E9E909A3790DF349E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 010D13CF, Relevance: 3.4, APIs: 2, Instructions: 391
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 8dc94568d77f5482cc1ce0b3cd5fa738f5121c2929c5b2e9b8e052b01ba7516f
Instruction ID: c311e9bcf049530c026a90a8b0b9551f42ea044a6203430327de5158c35de8eb
Opcode Fuzzy Hash: 8dc94568d77f5482cc1ce0b3cd5fa738f5121c2929c5b2e9b8e052b01ba7516f
Instruction Fuzzy Hash: AA0216B4A042288FCB64EB74C85879DB7F6AF88305F5085E9E909A3790DF349E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 010D1417, Relevance: 3.4, APIs: 2, Instructions: 384
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: a7906c0e30046288bf578e91a18204193e31cad91f5156a0a5ee58b5a42ed88d
Instruction ID: 8656e07deb64310c28aef5e9a73a0cc279d487b54e3af30d5f0c13ec92e2bb93
Opcode Fuzzy Hash: a7906c0e30046288bf578e91a18204193e31cad91f5156a0a5ee58b5a42ed88d
Instruction Fuzzy Hash: 2BF117B4A042288FCB64EB74C85879DB7F6AF88305F5085E9E909A3790DF349E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 010D145F, Relevance: 3.4, APIs: 2, Instructions: 377
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: f507a0cf39b86264f74df1120d1dd7471f4388eabdbf9552b5eba637869e05fa
Instruction ID: de40819ee6cbc47bd6cdbfa6e03393e62e010184342ee52a419379378b9dc280
Opcode Fuzzy Hash: f507a0cf39b86264f74df1120d1dd7471f4388eabdbf9552b5eba637869e05fa
Instruction Fuzzy Hash: ECF127B4A042288FCB64EB74C85879DB7F6AF88305F5085E9E909A3790DF349E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 010D14A7, Relevance: 3.4, APIs: 2, Instructions: 370
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: cd5d345e7ebbb3f7d20aa215c9754060e922ad3c1b3395654945ba1e44429eb0
Instruction ID: 6b8d1b048032d69abce23c2b21e43134d9df40f8e2482cadbfc3808adfb3c2ad
Opcode Fuzzy Hash: cd5d345e7ebbb3f7d20aa215c9754060e922ad3c1b3395654945ba1e44429eb0
Instruction Fuzzy Hash: 9BF128B4A042288FCB64EB74C85879DB7F6AF88305F5085E9E949A3790DF349E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010D14EF, Relevance: 3.4, APIs: 2, Instructions: 363
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 0948cd090c19c9c6147c0bd358fd64249e430b70cd7c190bceefc3594c41d6be
Instruction ID: 07904845a806fa261f810a0c53a9a9312abebca14eaba732ec362a94ec5a46fd
Opcode Fuzzy Hash: 0948cd090c19c9c6147c0bd358fd64249e430b70cd7c190bceefc3594c41d6be
Instruction Fuzzy Hash: 3CF128B4A042288FCB64EB74C85879DB7F6AF88305F5085E9E949A3790DF349E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010D1537, Relevance: 3.4, APIs: 2, Instructions: 356
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 40ba9497d990e491506c08a6a754083c3af28cd1bb5d563170137ba7c8a3d8f0
Instruction ID: 0b08ec682dcba6c580fc861579dab642428fcd5b918562f029c451c533bc04db
Opcode Fuzzy Hash: 40ba9497d990e491506c08a6a754083c3af28cd1bb5d563170137ba7c8a3d8f0
Instruction Fuzzy Hash: 9AE128B4A042288FCB64EB74C85879DB7F6AF88305F1085E9E949A3790DF349E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010D157F, Relevance: 3.3, APIs: 2, Instructions: 349
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 8d66828270f052ef2da871fde448ebec5289b92147016739db81495ca2176772
Instruction ID: 058aabc78024c6ed87f66e94ef052bac178374c1f5341f2c8d8f45c68288af78
Opcode Fuzzy Hash: 8d66828270f052ef2da871fde448ebec5289b92147016739db81495ca2176772
Instruction Fuzzy Hash: 83E128B4A042288FCB64EB74C85879DB7F6AF88305F1085E9E949A3790DF349E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010D15C7, Relevance: 3.3, APIs: 2, Instructions: 340
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 010D170D
KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 516cb026aea599f55472fc81c85528ba04bd6fb8ecf544908056771f1151b466
Instruction ID: b79a1c7e3827972f502736b998d8d3a500d542d13b7302ffb3608438a7dcc927
Opcode Fuzzy Hash: 516cb026aea599f55472fc81c85528ba04bd6fb8ecf544908056771f1151b466
Instruction Fuzzy Hash: 61E117B4A042288FDB64EB74C85879DB7F6AF88305F1085E9E949A3790DF349E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010D1A66, Relevance: 1.7, APIs: 1, Instructions: 170COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 686a3ce683499133b9e7413a9bcef07cf74f22fd15bd808793f68665ba637e49
Instruction ID: df2f6297b4383b5c6c6f863c0e537c7691e9914c2309d6952f41c5a5d94bf7e4
Opcode Fuzzy Hash: 686a3ce683499133b9e7413a9bcef07cf74f22fd15bd808793f68665ba637e49
Instruction Fuzzy Hash: 5C619E70A04228CFCB64EB74C8587ADB7F6AF88205F0084E9D909A7780DF389D85CF65

Uniqueness

Uniqueness Score: -1.00%

Function 010D1AAE, Relevance: 1.7, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: f963103316b3aadb441a0ca4c922d5ae728bf8b05e7e566772fe3fe2ee28d7b7
Instruction ID: 4d67250884e494c44fbc735f1dc988930fd0a0df6e3e2a788520fcdf6a060e0c
Opcode Fuzzy Hash: f963103316b3aadb441a0ca4c922d5ae728bf8b05e7e566772fe3fe2ee28d7b7
Instruction Fuzzy Hash: 8A518E70A00228CBCB64EB74C8587ADB7F6AF88205F1084E9D909A7780DF389DC5CF61

Uniqueness

Uniqueness Score: -1.00%

Function 010D1AF6, Relevance: 1.7, APIs: 1, Instructions: 156COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 346f06698c06155c5bdd189c0d6ad07f847ba82af1058b6f375169452ad86ce7
Instruction ID: 3b379f16bb41ca4fb35b548bef88a79298deb74f8a8587ec2b41f94ffa162b58
Opcode Fuzzy Hash: 346f06698c06155c5bdd189c0d6ad07f847ba82af1058b6f375169452ad86ce7
Instruction Fuzzy Hash: 3F518F74A04228CFCB64EB74C8587ADB7F6AF88205F5084E9D909A7784DF389D85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 010C7E20, Relevance: 1.6, APIs: 1, Instructions: 148libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 010C7E7F

Memory Dump Source

Source File: 00000002.00000002.914313245.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10c0000_6Rn5G1VWPB.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: df562c11f7b9b5636e2f948cf46d3e109bc52a2e772fc29045aee2a4168ee099
Instruction ID: 0ed37062529fd020f08aae1002699ad7833d408083929ce683b97e9a321a7c1c
Opcode Fuzzy Hash: df562c11f7b9b5636e2f948cf46d3e109bc52a2e772fc29045aee2a4168ee099
Instruction Fuzzy Hash: 5951A630A002059FCB04EBB4C884AAEB7F6AF89304F048569E556AB795DF70ED05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 010D1B3E, Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 010D1B59

Memory Dump Source

Source File: 00000002.00000002.914340463.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_6Rn5G1VWPB.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: f54b68bd1c45f52a3b18b5cc4cae260b4bb72d61d8e147579b20a643c2d01f1d
Instruction ID: 5db1447f130061d65ec37adf2467a0c69ae8a992f46e836b4cb9b9149b90928e
Opcode Fuzzy Hash: f54b68bd1c45f52a3b18b5cc4cae260b4bb72d61d8e147579b20a643c2d01f1d
Instruction Fuzzy Hash: BA518074B042298FCB64EB74C8587ADB7E6AF88205F1084E8D949E7784DF389D85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 010C7E1E, Relevance: 1.6, APIs: 1, Instructions: 137libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 010C7E7F

Memory Dump Source

Source File: 00000002.00000002.914313245.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10c0000_6Rn5G1VWPB.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 268f590afe7f8d852eb935d92dd5d9e74be8227d6e6c39c6f0a7bc934092c95d
Instruction ID: df9e75af1128b64ac3c2b0f8a9c086abffb45dbaf0e29b17adc31e6a11e93b98
Opcode Fuzzy Hash: 268f590afe7f8d852eb935d92dd5d9e74be8227d6e6c39c6f0a7bc934092c95d
Instruction Fuzzy Hash: 8B41A730A002059FCB04EFB4C884BEEB7F6BF89204F148569E556EB755DF70E9058B61

Uniqueness

Uniqueness Score: -1.00%

Function 010CA4B0, Relevance: 1.6, APIs: 1, Instructions: 114registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,00000000,?), ref: 010CA5B9

Memory Dump Source

Source File: 00000002.00000002.914313245.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10c0000_6Rn5G1VWPB.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: d57f19821c0fd7a69728764c3fba30c8feb96941b511f4d99ea5f1ef7416f991
Instruction ID: b31a4c810c8f0de67a297695775315dfc09f9d2c9ee6eab0c240bfdd984c4884
Opcode Fuzzy Hash: d57f19821c0fd7a69728764c3fba30c8feb96941b511f4d99ea5f1ef7416f991
Instruction Fuzzy Hash: 654124B5E00258DFDB10CFA9C884ADEBFF1BB48704F15806AE859AB350D7749845CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 010CA1F8, Relevance: 1.6, APIs: 1, Instructions: 112registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000000,?,00000001,?), ref: 010CA2FC

Memory Dump Source

Source File: 00000002.00000002.914313245.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10c0000_6Rn5G1VWPB.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 399a9746e09add8f69d46176f0d55de3b0d67d919766c10bfa9e4cece0181cc5
Instruction ID: b87f5e67feaa2e016c16717c05d74b71b86dadc0673eb23b49c2546ee3b93fa8
Opcode Fuzzy Hash: 399a9746e09add8f69d46176f0d55de3b0d67d919766c10bfa9e4cece0181cc5
Instruction Fuzzy Hash: AD412470A05249CFDB00CFA9C548A9EBFF1BB49304F25C1AEE809AB345D7B59849CF91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 6Rn5G1VWPB

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Function 01076B90, Relevance: 6.1, APIs: 4, Instructions: 127
threadCOMMON

Function 01076BA0, Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Function 0B3C7078, Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 0107BBB8, Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Function 0107DC6D, Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Function 0107DC78, Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 01076D51, Relevance: 1.6, APIs: 1, Instructions: 102
COMMON

Function 0B3C6DF0, Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 01076DC0, Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Function 0B3C6618, Relevance: 1.6, APIs: 1, Instructions: 63
threadinjectionCOMMON

Function 0B3C6EE0, Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 01076DC8, Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 0107B0B0, Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 0B3C2778, Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Function 0107C028, Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre