Play interactive tour

Edit tour

Windows Analysis Report HSBc20210216B1.exe

Overview

General Information

Sample Name:	HSBc20210216B1.exe
Analysis ID:	452704
MD5:	bacc98ebdf2f1565f597959c6d8206b9
SHA1:	06305b159bbb94f2f2b6ce99f393c1ab1ebbd93d
SHA256:	1c8aaaf7bc3a1bc66019e9c9dfe13128368a7ea086a670fee41c9f28b1837fe4
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

.NET source code contains very large strings

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Modifies the hosts file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Writes to foreign memory regions

Antivirus or Machine Learning detection for unpacked file

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

HSBc20210216B1.exe (PID: 5836 cmdline: 'C:\Users\user\Desktop\HSBc20210216B1.exe' MD5: BACC98EBDF2F1565F597959C6D8206B9)

RegSvcs.exe (PID: 6508 cmdline: {path} MD5: 2867A3817C9245F7CF518524DFD18F28)

kprUEGC.exe (PID: 5000 cmdline: 'C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe' MD5: 2867A3817C9245F7CF518524DFD18F28)

conhost.exe (PID: 4964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

kprUEGC.exe (PID: 7048 cmdline: 'C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe' MD5: 2867A3817C9245F7CF518524DFD18F28)

conhost.exe (PID: 7056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "qamanager@saitools.com", "Password": "ecotanksystems$0912", "Host": "mail.saitools.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
0000000F.00000002.497470570.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.497470570.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000000F.00000002.500538463.0000000002C01000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.500538463.0000000002C01000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.329566911.0000000004338000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.329566911.0000000004338000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Process Memory Space: HSBc20210216B1.exe PID: 5836	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: HSBc20210216B1.exe PID: 5836	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegSvcs.exe PID: 6508	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 6508	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.HSBc20210216B1.exe.4426778.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.HSBc20210216B1.exe.4426778.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.HSBc20210216B1.exe.4426778.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.HSBc20210216B1.exe.4426778.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
15.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 15.2.RegSvcs.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "qamanager@saitools.com", "Password": "ecotanksystems$0912", "Host": "mail.saitools.com"}

Multi AV Scanner detection for submitted file

Show sources

Source: HSBc20210216B1.exe

ReversingLabs: Detection: 17%

Source: 15.2.RegSvcs.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: HSBc20210216B1.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: HSBc20210216B1.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: RegSvcs.pdb, source: RegSvcs.exe, 0000000F.00000002.504898784.0000000005D00000.00000004.00000001.sdmp, kprUEGC.exe, 00000018.00000000.425151424.0000000000FA2000.00000002.00020000.sdmp, kprUEGC.exe, 0000001B.00000000.442492712.00000000003B2000.00000002.00020000.sdmp, kprUEGC.exe.15.dr
Source:	Binary string: RegSvcs.pdb source: kprUEGC.exe, kprUEGC.exe.15.dr

Source: RegSvcs.exe, 0000000F.00000002.500538463.0000000002C01000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: RegSvcs.exe, 0000000F.00000002.500538463.0000000002C01000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: RegSvcs.exe, 0000000F.00000002.500538463.0000000002C01000.00000004.00000001.sdmp	String found in binary or memory: http://bjsETf.com
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: kprUEGC.exe, 00000018.00000002.428324188.00000000016D4000.00000004.00000020.sdmp	String found in binary or memory: http://go.micho7
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: RegSvcs.exe, 0000000F.00000002.500538463.0000000002C01000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: HSBc20210216B1.exe, 00000000.00000002.329566911.0000000004338000.00000004.00000001.sdmp, RegSvcs.exe, 0000000F.00000002.497470570.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: RegSvcs.exe, 0000000F.00000002.500538463.0000000002C01000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Spam, unwanted Advertisements and Ransom Demands:

Modifies the hosts file

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 15.2.RegSvcs.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b0D1B0018u002dF5E5u002d4E5Bu002d952Cu002dA16B35793438u007d/u0031CBB4754u002d774Au002d47F6u002d89B8u002d1E397837F9AC.cs

Large array initialization: .cctor: array initializer size 11966

.NET source code contains very large strings

Show sources

Source: HSBc20210216B1.exe, Utilities/UI.Controls/Design/YaTabControlDesigner.cs	Long String: Length: 32771
Source: 0.2.HSBc20210216B1.exe.ed0000.0.unpack, Utilities/UI.Controls/Design/YaTabControlDesigner.cs	Long String: Length: 32771
Source: 0.0.HSBc20210216B1.exe.ed0000.0.unpack, Utilities/UI.Controls/Design/YaTabControlDesigner.cs	Long String: Length: 32771

Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Code function: 0_2_018EC134	0_2_018EC134
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Code function: 0_2_018EE56A	0_2_018EE56A
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Code function: 0_2_018EE578	0_2_018EE578
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Code function: 0_2_031E1A58	0_2_031E1A58
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Code function: 0_2_031E13F0	0_2_031E13F0
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Code function: 0_2_031E1A4B	0_2_031E1A4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_029F47A0	15_2_029F47A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_029F4772	15_2_029F4772
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_029FD661	15_2_029FD661

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe 43026DCFF238F20CFF0419924486DEE45178119CFDD0D366B79D67D950A9BF50

Source: HSBc20210216B1.exe	Binary or memory string: OriginalFilename vs HSBc20210216B1.exe
Source: HSBc20210216B1.exe, 00000000.00000000.231285716.0000000000ED2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameUt2ZE.exe4 vs HSBc20210216B1.exe
Source: HSBc20210216B1.exe, 00000000.00000002.330243653.00000000044E2000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs HSBc20210216B1.exe
Source: HSBc20210216B1.exe, 00000000.00000002.325946549.0000000003331000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameREKyVMTeXfcJLMQrauXgcavCwUup.exe4 vs HSBc20210216B1.exe
Source: HSBc20210216B1.exe, 00000000.00000002.338859106.00000000099B0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs HSBc20210216B1.exe
Source: HSBc20210216B1.exe, 00000000.00000002.328065842.000000000360B000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameResource_Meter.dll> vs HSBc20210216B1.exe
Source: HSBc20210216B1.exe	Binary or memory string: OriginalFilenameUt2ZE.exe4 vs HSBc20210216B1.exe

Source: HSBc20210216B1.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: HSBc20210216B1.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 15.2.RegSvcs.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 15.2.RegSvcs.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.adwa.evad.winEXE@7/6@0/0

Source: C:\Users\user\Desktop\HSBc20210216B1.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HSBc20210216B1.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4964:120:WilError_01
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Mutant created: \Sessions\1\BaseNamedObjects\zXjbnUsyQuNmYiyuxK
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7056:120:WilError_01

Source: HSBc20210216B1.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\HSBc20210216B1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: HSBc20210216B1.exe

ReversingLabs: Detection: 17%

Source: unknown	Process created: C:\Users\user\Desktop\HSBc20210216B1.exe 'C:\Users\user\Desktop\HSBc20210216B1.exe'
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe {path}
Source: unknown	Process created: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe 'C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe'
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe 'C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe'
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe {path}	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\HSBc20210216B1.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: HSBc20210216B1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: HSBc20210216B1.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: RegSvcs.pdb, source: RegSvcs.exe, 0000000F.00000002.504898784.0000000005D00000.00000004.00000001.sdmp, kprUEGC.exe, 00000018.00000000.425151424.0000000000FA2000.00000002.00020000.sdmp, kprUEGC.exe, 0000001B.00000000.442492712.00000000003B2000.00000002.00020000.sdmp, kprUEGC.exe.15.dr
Source:	Binary string: RegSvcs.pdb source: kprUEGC.exe, kprUEGC.exe.15.dr

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: HSBc20210216B1.exe, Utilities/YatcForm.cs	.Net Code: EFEFEFEFEFEF System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.2.HSBc20210216B1.exe.ed0000.0.unpack, Utilities/YatcForm.cs	.Net Code: EFEFEFEFEFEF System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.HSBc20210216B1.exe.ed0000.0.unpack, Utilities/YatcForm.cs	.Net Code: EFEFEFEFEFEF System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Code function: 0_2_00ED7F11 push es; iretd		0_2_00ED815A
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Code function: 0_2_031E724D push FFFFFF8Bh; iretd		0_2_031E724F

Source: initial sample

Static PE information: section name: .text entropy: 7.48857726563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File created: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run kprUEGC			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run kprUEGC			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match

File source: Process Memory Space: HSBc20210216B1.exe PID: 5836, type: MEMORY

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: HSBc20210216B1.exe, 00000000.00000002.326159753.0000000003392000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: HSBc20210216B1.exe, 00000000.00000002.326159753.0000000003392000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Window / User API: threadDelayed 9607

Jump to behavior

Source: C:\Users\user\Desktop\HSBc20210216B1.exe TID: 1456	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe TID: 5660	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe TID: 7124	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: HSBc20210216B1.exe, 00000000.00000002.326159753.0000000003392000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: RegSvcs.exe, 0000000F.00000002.505285736.0000000005E00000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: HSBc20210216B1.exe, 00000000.00000002.326159753.0000000003392000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: HSBc20210216B1.exe, 00000000.00000002.326159753.0000000003392000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: HSBc20210216B1.exe, 00000000.00000002.326159753.0000000003392000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: HSBc20210216B1.exe, 00000000.00000002.326159753.0000000003392000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: HSBc20210216B1.exe, 00000000.00000002.326159753.0000000003392000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: RegSvcs.exe, 0000000F.00000002.505285736.0000000005E00000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: RegSvcs.exe, 0000000F.00000002.505285736.0000000005E00000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: HSBc20210216B1.exe, 00000000.00000002.326159753.0000000003392000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: HSBc20210216B1.exe, 00000000.00000002.326159753.0000000003392000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: HSBc20210216B1.exe, 00000000.00000002.326159753.0000000003392000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: RegSvcs.exe, 0000000F.00000002.505285736.0000000005E00000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\HSBc20210216B1.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\HSBc20210216B1.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\HSBc20210216B1.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\HSBc20210216B1.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Modifies the hosts file

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 438000	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 43A000	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 9AC008	Jump to behavior

Source: C:\Users\user\Desktop\HSBc20210216B1.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe {path}

Jump to behavior

Source: RegSvcs.exe, 0000000F.00000002.499449886.00000000014A0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: RegSvcs.exe, 0000000F.00000002.499449886.00000000014A0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: RegSvcs.exe, 0000000F.00000002.499449886.00000000014A0000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: RegSvcs.exe, 0000000F.00000002.499449886.00000000014A0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: RegSvcs.exe, 0000000F.00000002.499449886.00000000014A0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Users\user\Desktop\HSBc20210216B1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Design.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBc20210216B1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Queries volume information: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Queries volume information: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\HSBc20210216B1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Modifies the hosts file

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0.2.HSBc20210216B1.exe.4426778.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBc20210216B1.exe.4426778.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.497470570.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.329566911.0000000004338000.00000004.00000001.sdmp, type: MEMORY

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0.2.HSBc20210216B1.exe.4426778.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBc20210216B1.exe.4426778.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.497470570.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.500538463.0000000002C01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.329566911.0000000004338000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HSBc20210216B1.exe PID: 5836, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6508, type: MEMORY

Source: Yara match	File source: 0000000F.00000002.500538463.0000000002C01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6508, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0.2.HSBc20210216B1.exe.4426778.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBc20210216B1.exe.4426778.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.497470570.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.329566911.0000000004338000.00000004.00000001.sdmp, type: MEMORY

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0.2.HSBc20210216B1.exe.4426778.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBc20210216B1.exe.4426778.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.497470570.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.500538463.0000000002C01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.329566911.0000000004338000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HSBc20210216B1.exe PID: 5836, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6508, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Registry Run Keys / Startup Folder1	Process Injection212	Masquerading1	OS Credential Dumping	Query Registry1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Registry Run Keys / Startup Folder1	File and Directory Permissions Modification1	LSASS Memory	Security Software Discovery211	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools1	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Virtualization/Sandbox Evasion131	NTDS	Virtualization/Sandbox Evasion131	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection212	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Deobfuscate/Decode Files or Information1	Cached Domain Credentials	System Information Discovery113	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Hidden Files and Directories1	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Obfuscated Files or Information2	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Software Packing13	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
HSBc20210216B1.exe	17%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
15.2.RegSvcs.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://go.micho7	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://bjsETf.com	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	RegSvcs.exe, 0000000F.00000002.500538463.0000000002C01000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.apache.org/licenses/LICENSE-2.0	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false		high
http://DynDns.comDynDNS	RegSvcs.exe, 0000000F.00000002.500538463.0000000002C01000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	RegSvcs.exe, 0000000F.00000002.500538463.0000000002C01000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false		high
http://www.tiro.com	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coml	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false		high
http://go.micho7	kprUEGC.exe, 00000018.00000002.428324188.00000000016D4000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false		high
https://api.ipify.org%GETMozilla/5.0	RegSvcs.exe, 0000000F.00000002.500538463.0000000002C01000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://www.fonts.com	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.com	HSBc20210216B1.exe, 00000000.00000002.337055286.0000000007412000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://bjsETf.com	RegSvcs.exe, 0000000F.00000002.500538463.0000000002C01000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	HSBc20210216B1.exe, 00000000.00000002.329566911.0000000004338000.00000004.00000001.sdmp, RegSvcs.exe, 0000000F.00000002.497470570.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	452704
Start date:	22.07.2021
Start time:	18:24:52
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	HSBc20210216B1.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.adwa.evad.winEXE@7/6@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 0.1% (good quality ratio 0%) Quality average: 33.3% Quality standard deviation: 47.1%
HCA Information:	Successful, ratio: 98% Number of executed functions: 68 Number of non-executed functions: 4
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/452704/sample/HSBc20210216B1.exe

Simulations

Behavior and APIs

Time	Type	Description
18:26:54	API Interceptor	429x Sleep call for process: RegSvcs.exe modified
18:27:06	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run kprUEGC C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe
18:27:15	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run kprUEGC C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe	Released Order.exe	Get hash	malicious	Browse
	FATURAA No.072221.exe	Get hash	malicious	Browse
	mzyDSLb1u9.exe	Get hash	malicious	Browse
	Released Order.exe	Get hash	malicious	Browse
	Released Order.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.Win32.Save.a.21764.exe	Get hash	malicious	Browse
	Doc.202107028.exe	Get hash	malicious	Browse
	Swift copy of payment.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Scr.Malcodegdn30.14111.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Artemis1E37F288EA63.20801.exe	Get hash	malicious	Browse
	Shipping#docs.exe	Get hash	malicious	Browse
	TT COPY.exe	Get hash	malicious	Browse
	DOEN100000597.exe	Get hash	malicious	Browse
	HBG1504997.exe	Get hash	malicious	Browse
	fda.exe	Get hash	malicious	Browse
	Bank details.exe	Get hash	malicious	Browse
	PO#4500488718.exe	Get hash	malicious	Browse
	AL Naser General. Services.exe	Get hash	malicious	Browse
	AL Naser General Services.exe	Get hash	malicious	Browse
	Bank Details.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HSBc20210216B1.exe.log Download File
Process:	C:\Users\user\Desktop\HSBc20210216B1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	5.34763300334957
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4VE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzp
MD5:	17AB73C45E39AAD8F7C9A94F41D29977
SHA1:	17DE8F6B64A2E722B9695D219E22D169C32F3B3F
SHA-256:	8AAD593D9F1E9AEE7F3161EDC9E124C9AAD7721128E0F84FD7E8B27DE1A3685B
SHA-512:	F02D9DAE41AB2FDDC629BCD93062DC4EAAF359DDAAC15165F5283CEFF86295C6A65AFF77617CDEC948116FCD2BFB0C223E6BA4634BF9BB45054A5FA418F02C90
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kprUEGC.exe.log Download File
Process:	C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	142
Entropy (8bit):	5.090621108356562
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUC7WglAFXMWA2yTMGfsbNRLFS9Am12MFuAvOAsDeieVyn:Q3La/xwczlAFXMWTyAGCDLIP12MUAvvw
MD5:	8C0458BB9EA02D50565175E38D577E35
SHA1:	F0B50702CD6470F3C17D637908F83212FDBDB2F2
SHA-256:	C578E86DB701B9AFA3626E804CF434F9D32272FF59FB32FA9A51835E5A148B53
SHA-512:	804A47494D9A462FFA6F39759480700ECBE5A7F3A15EC3A6330176ED9C04695D2684BF6BF85AB86286D52E7B727436D0BB2E8DA96E20D47740B5CE3F856B5D0F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45152
Entropy (8bit):	6.149629800481177
Encrypted:	false
SSDEEP:	768:bBbSoy+SdIBf0k2dsYyV6Iq87PiU9FViaLmf:EoOIBf0ddsYy8LUjVBC
MD5:	2867A3817C9245F7CF518524DFD18F28
SHA1:	D7BA2A111CEDD5BF523224B3F1CFE58EEC7C2FDC
SHA-256:	43026DCFF238F20CFF0419924486DEE45178119CFDD0D366B79D67D950A9BF50
SHA-512:	7D3D3DBB42B7966644D716AA9CBC75327B2ACB02E43C61F1DAD4AFE5521F9FE248B33347DFE15B637FB33EB97CDB322BCAEAE08BAE3F2FD863A9AD9B3A4D6B42
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Released Order.exe, Detection: malicious, Browse Filename: FATURAA No.072221.exe, Detection: malicious, Browse Filename: mzyDSLb1u9.exe, Detection: malicious, Browse Filename: Released Order.exe, Detection: malicious, Browse Filename: Released Order.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Win32.Save.a.21764.exe, Detection: malicious, Browse Filename: Doc.202107028.exe, Detection: malicious, Browse Filename: Swift copy of payment.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Scr.Malcodegdn30.14111.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Artemis1E37F288EA63.20801.exe, Detection: malicious, Browse Filename: Shipping#docs.exe, Detection: malicious, Browse Filename: TT COPY.exe, Detection: malicious, Browse Filename: DOEN100000597.exe, Detection: malicious, Browse Filename: HBG1504997.exe, Detection: malicious, Browse Filename: fda.exe, Detection: malicious, Browse Filename: Bank details.exe, Detection: malicious, Browse Filename: PO#4500488718.exe, Detection: malicious, Browse Filename: AL Naser General. Services.exe, Detection: malicious, Browse Filename: AL Naser General Services.exe, Detection: malicious, Browse Filename: Bank Details.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...zX.Z..............0..d..........V.... ........@.. ..............................."....`.....................................O.......8............r..`>.......................................................... ............... ..H............text...\c... ...d.................. ..`.rsrc...8............f..............@..@.reloc...............p..............@..B................8.......H........+...S..........\|...P...........................................r...p(....2.(....(....z..r...p(....(....(......}......{.....s..........0..{...........Q.-.s.....+i~....o....(.....s.......o.....r!..p..(....Q.P,:.P.....(....o....o ........(....o!...o".....,..o#...t........0..(....... ....s$........o%....X..(....-...o&....0...........('......&.........................0...........(.......&.....*.................0............(.....(....~....,.(....~....o....9]...

C:\Windows\System32\drivers\etc\hosts Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	11
Entropy (8bit):	2.663532754804255
Encrypted:	false
SSDEEP:	3:iLE:iLE
MD5:	B24D295C1F84ECBFB566103374FB91C5
SHA1:	6A750D3F8B45C240637332071D34B403FA1FF55A
SHA-256:	4DC7B65075FBC5B5421551F0CB814CAFDC8CACA5957D393C222EE388B6F405F4
SHA-512:	9BE279BFA70A859608B50EF5D30BF2345F334E5F433C410EA6A188DCAB395BFF50C95B165177E59A29261464871C11F903A9ECE55B2D900FE49A9F3C49EB88FA
Malicious:	true
Preview:	..127.0.0.1

\Device\ConDrv Download File
Process:	C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	4.44831826838854
Encrypted:	false
SSDEEP:	24:zKLXkb4DObntKlglUEnfQtvNuNpKOK5aM9YJC:zKL0b4DQntKKH1MqJC
MD5:	1AEB3A784552CFD2AEDEDC1D43A97A4F
SHA1:	804286AB9F8B3DE053222826A69A7CDA3492411A
SHA-256:	0BC438F4B1208E1390C12D375B6CBB08BF47599D1F24BD07799BB1DF384AA293
SHA-512:	5305059BA86D5C2185E590EC036044B2A17ED9FD9863C2E3C7E7D8035EF0C79E53357AF5AE735F7D432BC70156D4BD3ACB42D100CFB05C2FB669EA22368F1415
Malicious:	false
Preview:	Microsoft (R) .NET Framework Services Installation Utility Version 4.7.3056.0..Copyright (C) Microsoft Corporation. All rights reserved.....USAGE: regsvcs.exe [options] AssemblyName..Options:.. /? or /help Display this usage message... /fc Find or create target application (default)... /c Create target application, error if it already exists... /exapp Expect an existing application... /tlb:<tlbfile> Filename for the exported type library... /appname:<name> Use the specified name for the target application... /parname:<name> Use the specified name or id for the target partition... /extlb Use an existing type library... /reconfig Reconfigure existing target application (default)... /noreconfig Don't reconfigure existing target application... /u Uninstall target application... /nologo Suppress logo output... /quiet Suppress logo output and success output... /c

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.381492251003276
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	HSBc20210216B1.exe
File size:	462848
MD5:	bacc98ebdf2f1565f597959c6d8206b9
SHA1:	06305b159bbb94f2f2b6ce99f393c1ab1ebbd93d
SHA256:	1c8aaaf7bc3a1bc66019e9c9dfe13128368a7ea086a670fee41c9f28b1837fe4
SHA512:	1f784205829b922404f55cb9a8e66d3f81f0db21b63c134ded498ee67628d2ad60631d3138421e9506379b4f368874a9e482d5dd66b649d789a254a1c97dbee4
SSDEEP:	6144:6OML53822w3Ha2aAzmau6GGnoRiSzmMQbL+Qt7wv4cH/hjW9LTbrJbzcoy9WL:sNz62aAyR6Ho/hQbSQt8v4cH8Zl/
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....t.`..............0...... ......V.... ........... .......................@............@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x1106f356
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x11000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x60F9742E [Thu Jul 22 13:35:42 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [11002000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6f304	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x70000	0x618	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x72000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x6d35c	0x6e000	False	0.801171875	data	7.48857726563	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x70000	0x618	0x1000	False	0.173583984375	data	2.01930615469	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x72000	0xc	0x1000	False	0.00927734375	data	0.0164084645156	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x70090	0x388	data
RT_MANIFEST	0x70428	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	2005-2013 by Gray Iris Software LC
Assembly Version	1.0.3.3
InternalName	Ut2ZE.exe
FileVersion	1.0.3.3
CompanyName	Gray Iris Software LC
Comments	A library of commonly-needed utility classes.
ProductVersion	1.0.3.3
FileDescription	Utilities from Gray Iris Software LC.
OriginalFilename	Ut2ZE.exe

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: HSBc20210216B1.exe PID: 5836 Parent PID: 5760

General

Start time:	18:25:44
Start date:	22/07/2021
Path:	C:\Users\user\Desktop\HSBc20210216B1.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\HSBc20210216B1.exe'
Imagebase:	0xed0000
File size:	462848 bytes
MD5 hash:	BACC98EBDF2F1565F597959C6D8206B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.329566911.0000000004338000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.329566911.0000000004338000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: RegSvcs.exe PID: 6508 Parent PID: 5836

General

Start time:	18:26:27
Start date:	22/07/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x6f0000
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.497470570.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000F.00000002.497470570.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.500538463.0000000002C01000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.500538463.0000000002C01000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: kprUEGC.exe PID: 5000 Parent PID: 3472

General

Start time:	18:27:15
Start date:	22/07/2021
Path:	C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe'
Imagebase:	0xfa0000
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4964 Parent PID: 5000

General

Start time:	18:27:15
Start date:	22/07/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: kprUEGC.exe PID: 7048 Parent PID: 3472

General

Start time:	18:27:23
Start date:	22/07/2021
Path:	C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe'
Imagebase:	0x3b0000
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 7056 Parent PID: 7048

General

Start time:	18:27:23
Start date:	22/07/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: HSBc20210216B1.exe PID: 5836 Parent PID: 5760 HSBc20210216B1.exeCOMMON

Executed Functions

Function 031E1A58, Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325510434.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9748e09a423857e2290ec650ad7e04040eb4699990f358ae839ad39df2ade761
Instruction ID: 142861e6f44514c866483a9459f660a500a94c8a999878c10d2af447b3a771bd
Opcode Fuzzy Hash: 9748e09a423857e2290ec650ad7e04040eb4699990f358ae839ad39df2ade761
Instruction Fuzzy Hash: A8815971E4562ADBDB28CF69CD44BEABBB6BF88300F1085F6D509A7254E7705AC18F40

Uniqueness

Uniqueness Score: -1.00%

Function 031E1A4B, Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325510434.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adda7979a421ed85cf662085ffb0295d87b896fd686cd8ab8a60965e819beaa9
Instruction ID: 344e0f14435274074b76a2876deca9fd1f36f47852099a8b23c2a3ab8a1bd1c5
Opcode Fuzzy Hash: adda7979a421ed85cf662085ffb0295d87b896fd686cd8ab8a60965e819beaa9
Instruction Fuzzy Hash: 97716A71E0162ADBDB28CF69CD447EABBB2BFC8300F1481B6D509A7654EB705AC58F40

Uniqueness

Uniqueness Score: -1.00%

Function 018EB680, Relevance: 6.1, APIs: 4, Instructions: 126threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 018EB6F0
GetCurrentThread.KERNEL32 ref: 018EB72D
GetCurrentProcess.KERNEL32 ref: 018EB76A
GetCurrentThreadId.KERNEL32 ref: 018EB7C3

Memory Dump Source

Source File: 00000000.00000002.325404621.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 24dfbb11d8134d0620f4b29147eb8637da0b66889f304bfd454917a56cd9d632
Instruction ID: 63e7aea13638993766f8a19d86885236e9e8796330b017d3c9fac5ffd32aadd0
Opcode Fuzzy Hash: 24dfbb11d8134d0620f4b29147eb8637da0b66889f304bfd454917a56cd9d632
Instruction Fuzzy Hash: 3F5165B09102498FDB14CFA9D988BEEBBF0FF49314F288469E519A7750D7349984CF61

Uniqueness

Uniqueness Score: -1.00%

Function 018EB690, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 018EB6F0
GetCurrentThread.KERNEL32 ref: 018EB72D
GetCurrentProcess.KERNEL32 ref: 018EB76A
GetCurrentThreadId.KERNEL32 ref: 018EB7C3

Memory Dump Source

Source File: 00000000.00000002.325404621.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4681c49ec1293bdaa1a7c15538dc55368bcbe28b75dfb3c7c7cdf1c088bc91d4
Instruction ID: c8c163d2ae8cf5c19623327d753079fccee26770565587758d2d745cdcdf4511
Opcode Fuzzy Hash: 4681c49ec1293bdaa1a7c15538dc55368bcbe28b75dfb3c7c7cdf1c088bc91d4
Instruction Fuzzy Hash: 4B5163B09102498FDB14CFA9D988BAEFBF0FF49314F248429E519A3760C734A984CF65

Uniqueness

Uniqueness Score: -1.00%

Function 018E9690, Relevance: 1.7, APIs: 1, Instructions: 203COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 018E98D6

Memory Dump Source

Source File: 00000000.00000002.325404621.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 256445ec81ffbc1179ff3c609f0287f7b8e38f1a85fb8bc91bbf23457c9a84ca
Instruction ID: 99dd95a801a68819b7b7822dd947834e765de5918598ae688c27ac1022a28896
Opcode Fuzzy Hash: 256445ec81ffbc1179ff3c609f0287f7b8e38f1a85fb8bc91bbf23457c9a84ca
Instruction Fuzzy Hash: 10816570A00B058FDB60DF29D44479ABBF1FF89308F00892ED55ADBA40E774EA09CB91

Uniqueness

Uniqueness Score: -1.00%

Function 031E310C, Relevance: 1.7, APIs: 1, Instructions: 157processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 031E3263

Memory Dump Source

Source File: 00000000.00000002.325510434.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 247e489b85f437ebd260ee19e259c7848366ee50586dc3c705b02b8189b835f6
Instruction ID: 2c9fd1d9e591d4d5286300675b828a74f7c0741a15d7fbdbb88ff616c7227874
Opcode Fuzzy Hash: 247e489b85f437ebd260ee19e259c7848366ee50586dc3c705b02b8189b835f6
Instruction Fuzzy Hash: E5514B75D04319DFDB24CF99C880BDEBBB5BF48314F15849AE818A7210DB359A89CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 031E3110, Relevance: 1.6, APIs: 1, Instructions: 143processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 031E3263

Memory Dump Source

Source File: 00000000.00000002.325510434.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b7ce6937b41c84aed66d39ef9e93f163700886fe41337b356637023aa33b9a18
Instruction ID: 06b4654a4bee229da21f908b88950a074cb25150a75a18f2a318b3b5219310b6
Opcode Fuzzy Hash: b7ce6937b41c84aed66d39ef9e93f163700886fe41337b356637023aa33b9a18
Instruction Fuzzy Hash: 1A513975904329DFDB24CF95C880BDEBBB6BF58314F15849AE908A7210DB319A89CF61

Uniqueness

Uniqueness Score: -1.00%

Function 018EFCEE, Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 018EFE0A

Memory Dump Source

Source File: 00000000.00000002.325404621.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 95f13828f1586a85f9c644dbd951b15a5a2870b58d535b9e06c4125c21e5aef0
Instruction ID: 989ead3b21e1fb6e1cc02eeec7e30c1c266b4f4ca2b1ca22898080acc1a8da86
Opcode Fuzzy Hash: 95f13828f1586a85f9c644dbd951b15a5a2870b58d535b9e06c4125c21e5aef0
Instruction Fuzzy Hash: A851BEB1D002099FDB14CF99C884ADEBBF1FF49314F24852AE919AB210D775A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 018EFCF8, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 018EFE0A

Memory Dump Source

Source File: 00000000.00000002.325404621.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 2f903a8b48a7678b7e1a7420a8c863e17c364b3d1fb6999e2e9f6b68475b6333
Instruction ID: e5752df99102c7acadab97ed7e523cc17dd958738da75499f5253afe67ebea51
Opcode Fuzzy Hash: 2f903a8b48a7678b7e1a7420a8c863e17c364b3d1fb6999e2e9f6b68475b6333
Instruction Fuzzy Hash: A941DEB1D003099FDB14CFAAC884ADEBFF5BF48314F24812AE919AB210D775A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 018E5364, Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 018E5421

Memory Dump Source

Source File: 00000000.00000002.325404621.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d483e745228c390127d210144d0a38b1b128db9c7ab578d7a1584fcaaedebb7f
Instruction ID: 947d93f31f05e75a6076c9116dbab04bfdb900b7af3484003936e29edb2fbf08
Opcode Fuzzy Hash: d483e745228c390127d210144d0a38b1b128db9c7ab578d7a1584fcaaedebb7f
Instruction Fuzzy Hash: 0541F2B5D04218CFDB24CFA9C884BDEBBB1BF49308F258069D508AB251D7756986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 018E3CAC, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 018E5421

Memory Dump Source

Source File: 00000000.00000002.325404621.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a583641f0d029f4b790fc7359c7e1ab1da805c385e535aa711ba2ddcf1100b07
Instruction ID: 2825b4539ff4f4a4e504c741f3f705e295497d149ae3350f8cb6bd3bf135d3c8
Opcode Fuzzy Hash: a583641f0d029f4b790fc7359c7e1ab1da805c385e535aa711ba2ddcf1100b07
Instruction Fuzzy Hash: 2241D1B4D0421CCFDB24DFA9C88879EBBF5BF49308F148069D508AB251D775A986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 018EB8B2, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 018EB93F

Memory Dump Source

Source File: 00000000.00000002.325404621.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5ef6bdbf452a86c2206462300c1d170489311b246532a98ce77c46055e0653cf
Instruction ID: 4547861f05cab5d5e0ba3a2ca22db88cfaafe9c078468942eff22649a1f12899
Opcode Fuzzy Hash: 5ef6bdbf452a86c2206462300c1d170489311b246532a98ce77c46055e0653cf
Instruction Fuzzy Hash: 2821E4B59012099FDB10CFA9D885BEEBFF4FB48324F14841AE914A3310D375A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 031E3D48, Relevance: 1.6, APIs: 1, Instructions: 65injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 031E3DD5

Memory Dump Source

Source File: 00000000.00000002.325510434.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 3463d9aa7417c2116af2229e057ae5e54418f16b4e56d159bd6f3fe5266efe7b
Instruction ID: 5a83b94183aff784ee884bba3524c4845dc8177c6cd9c26730220e06633f8ebd
Opcode Fuzzy Hash: 3463d9aa7417c2116af2229e057ae5e54418f16b4e56d159bd6f3fe5266efe7b
Instruction Fuzzy Hash: DA2114B59002499FCB10CF9AC884BDEBBF4FB48324F44842AE928A7240D375A954CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 018EB8B8, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 018EB93F

Memory Dump Source

Source File: 00000000.00000002.325404621.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e052fa4ce602016dab7f424bf1325e68445e6333fe9762cbfcda9ac181cf8618
Instruction ID: 846cacb53c89a55d28543f18c35e16e8706a26c99bb2518c13fad9c1c44799ca
Opcode Fuzzy Hash: e052fa4ce602016dab7f424bf1325e68445e6333fe9762cbfcda9ac181cf8618
Instruction Fuzzy Hash: AF21D5B59012099FDB10CFA9D484BDEBFF8FB49324F14841AE914A7310D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 018E9AF2, Relevance: 1.6, APIs: 1, Instructions: 61libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,018E9951,00000800,00000000,00000000), ref: 018E9B62

Memory Dump Source

Source File: 00000000.00000002.325404621.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 018282a1ea1cd9fc709878e1a381479e6e3d0670d06773238bff06f2e0ab94bd
Instruction ID: 25f368492a14323ed227da8c41fccd29e7cbd0c630eaacf68d607010fbdb38f5
Opcode Fuzzy Hash: 018282a1ea1cd9fc709878e1a381479e6e3d0670d06773238bff06f2e0ab94bd
Instruction Fuzzy Hash: 122168B2C002498FCF10CFA9C444BEEFBF4EB99314F14852AD919A7201C3B5A549CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 031E3BC8, Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 031E3C4F

Memory Dump Source

Source File: 00000000.00000002.325510434.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 2135685e58ff29c46dc27ee07b44d8b6bfa4c9bf9cfbe24a4e63b781ade094b8
Instruction ID: 2b71ceee8f61cd4790e500e527ba08bb8c816f75cb4af7c3f5e5e1c34705252c
Opcode Fuzzy Hash: 2135685e58ff29c46dc27ee07b44d8b6bfa4c9bf9cfbe24a4e63b781ade094b8
Instruction Fuzzy Hash: A821E4B59003599FCB10CF99C984BDEBBF4BB48310F14842AE928A7240D3349955DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 031E3B08, Relevance: 1.6, APIs: 1, Instructions: 59threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 031E3B87

Memory Dump Source

Source File: 00000000.00000002.325510434.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: a3bd6ad3da1bbc7e766546e3d7dc42f823a683dcfd1af3043df8e6875314e067
Instruction ID: aa84009a17abbc34a077d8657c62730ccf7d173b716e1152d72c306753511507
Opcode Fuzzy Hash: a3bd6ad3da1bbc7e766546e3d7dc42f823a683dcfd1af3043df8e6875314e067
Instruction Fuzzy Hash: 222136B5D1061A9FDB00CF9AC5857EEFBF4BF08224F14852AD829B7240D778A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 031E3BD0, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 031E3C4F

Memory Dump Source

Source File: 00000000.00000002.325510434.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b3aa0b36c0b235ba26a91c0c651a509c26f76976cd735ae55640465700e29c4a
Instruction ID: 463ddc9ccf103c92db5cc964ad74e2efe326f4e38cb3c656798f2060ce7713b3
Opcode Fuzzy Hash: b3aa0b36c0b235ba26a91c0c651a509c26f76976cd735ae55640465700e29c4a
Instruction Fuzzy Hash: 6021E3B59003599FCB10CF9AC984BDEFBF4FB48320F54842AE928A7250D375A554CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 031E3B10, Relevance: 1.6, APIs: 1, Instructions: 58threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 031E3B87

Memory Dump Source

Source File: 00000000.00000002.325510434.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 003e5e8ec236d271ce56bb39fb6aafa2c749a7cf215f83b202270606524250c6
Instruction ID: 75bcfeec1256b6fbcbdc729685f4b22746ce5eb262592ce4c438ab2042ae03a8
Opcode Fuzzy Hash: 003e5e8ec236d271ce56bb39fb6aafa2c749a7cf215f83b202270606524250c6
Instruction Fuzzy Hash: 4A213875D106199FCB00CF9AC4847EEFBF4BB48224F44812AD418B3240D774A9548FA1

Uniqueness

Uniqueness Score: -1.00%

Function 018E92A8, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,018E9951,00000800,00000000,00000000), ref: 018E9B62

Memory Dump Source

Source File: 00000000.00000002.325404621.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 63a965f2fa0a3d26bac31138cdca0178d5f266368c9271c7d631b0618c8835e7
Instruction ID: 33e85f64f187c2bef6ee3503b2bb8f5b6efa69a4831543b589c94800879bf4fc
Opcode Fuzzy Hash: 63a965f2fa0a3d26bac31138cdca0178d5f266368c9271c7d631b0618c8835e7
Instruction Fuzzy Hash: 101117B5D043099FDB10CF9AC448BDEFBF4EB99314F14852AD915A7200C3B5A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 031E3CA0, Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 031E3D0B

Memory Dump Source

Source File: 00000000.00000002.325510434.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 75116b63aac223852b2e48475dec1515f6d7a0004fcebe91b879e12123bd1a72
Instruction ID: 1060068a400e8e51dee4dc9e01a67b74e2617480c465b1a33479ba4f5ebb45d3
Opcode Fuzzy Hash: 75116b63aac223852b2e48475dec1515f6d7a0004fcebe91b879e12123bd1a72
Instruction Fuzzy Hash: 6C11F2B59006499FCB10CF9AD884BDEFFF4FB48324F148819E929A7210D375A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 018E9870, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 018E98D6

Memory Dump Source

Source File: 00000000.00000002.325404621.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c8cd50db14791bef3136c2da3ce4eeadb60314c2f34c52fffbe1b06b934268eb
Instruction ID: dacd507c63ce78b553c44f2a416c76cf08d2d5b21d1804b415ef8a65735e8240
Opcode Fuzzy Hash: c8cd50db14791bef3136c2da3ce4eeadb60314c2f34c52fffbe1b06b934268eb
Instruction Fuzzy Hash: 561110B5C002098FDB10CF9AC448BDEFBF8EB89324F14842AD829B7610D375A645CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 018EFF38, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 018EFF9D

Memory Dump Source

Source File: 00000000.00000002.325404621.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 4a046c714781171e73d2f2a9caf3e10410b17292f58e9baccc0193990dbf71bd
Instruction ID: c886e6add8ce122f605acdcbda277a3b2d97aef1ced498d8ed0de721968f1e78
Opcode Fuzzy Hash: 4a046c714781171e73d2f2a9caf3e10410b17292f58e9baccc0193990dbf71bd
Instruction Fuzzy Hash: E51103B5900209CFDB20CF99D488BEEBBF4FB89324F14841AD965A7740C374AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 018EFF40, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 018EFF9D

Memory Dump Source

Source File: 00000000.00000002.325404621.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 2e06e769d31b1396675d21ea2490c27cb1bc9f4275d22e75c2e999876f98ad7f
Instruction ID: de5be783d56da2f5f05a9a9041b2048c12c0806b6b37811263b001f2722a952f
Opcode Fuzzy Hash: 2e06e769d31b1396675d21ea2490c27cb1bc9f4275d22e75c2e999876f98ad7f
Instruction Fuzzy Hash: 0D11E2B59002099FDB10DF9AD588BDEFBF8EB49324F14841AE915A7340D375AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 031E47D8, Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 031E4835

Memory Dump Source

Source File: 00000000.00000002.325510434.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: f69e7652f9e1a48224642c4a01147bf2cad0ac128f5c4cd1cb447a1aad7271d2
Instruction ID: b1c6eaf51c53415a1801f32d8bf348682bbd573790524260483d289dcc20e0cd
Opcode Fuzzy Hash: f69e7652f9e1a48224642c4a01147bf2cad0ac128f5c4cd1cb447a1aad7271d2
Instruction Fuzzy Hash: 5511E2B58003499FDB10CF9AC884BDEFBF8FB48324F14841AE955A7600D375A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 031E3F00, Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 031E3F5F

Memory Dump Source

Source File: 00000000.00000002.325510434.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 373e88ef4d0345d54408cd285ca9b69083fa187a9073506257b723fddb47a197
Instruction ID: 7933c87a08dcec419c0d2fa01f5702b4ad0f12bc9b0a58a77d4c095246652c9a
Opcode Fuzzy Hash: 373e88ef4d0345d54408cd285ca9b69083fa187a9073506257b723fddb47a197
Instruction Fuzzy Hash: E61123B58002098FCB10CF9AC484BDEFBF4EB48324F14841AD529A7300D375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0180D4C4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325231937.000000000180D000.00000040.00000001.sdmp, Offset: 0180D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25085c04af327fd5e739c8eeca6df1a1999c18f947b21d400bef927f04031aa
Instruction ID: 6063e8c252f531cb4f4f1fad5123f674aa4db6ff796fd07189c98ddfd76ef636
Opcode Fuzzy Hash: d25085c04af327fd5e739c8eeca6df1a1999c18f947b21d400bef927f04031aa
Instruction Fuzzy Hash: 72213672504248DFDB42DF94D9C0B26BF61FB88318F24C669ED058B287C336D556C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 0181D1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325263365.000000000181D000.00000040.00000001.sdmp, Offset: 0181D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ddf992fba27e28b8e313b9d289e9603549b8094290eef1c14b4a14be08d6b9f
Instruction ID: ba806d37030eb7a985ce19893ac23659f5873531b0c5c2ae9695c84a4fe9d5c3
Opcode Fuzzy Hash: 4ddf992fba27e28b8e313b9d289e9603549b8094290eef1c14b4a14be08d6b9f
Instruction Fuzzy Hash: 39214972504244DFDB01CF94D5C4B66BBA9FB84328F24C7ADE9098B34AC336E946CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0181D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325263365.000000000181D000.00000040.00000001.sdmp, Offset: 0181D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efb580dbeb59a7738f0eb9e90f54f04a2e44e710226ba4cea88275d17074bc0e
Instruction ID: f6d0dcfe5085ca3a7c1ae6f1f0d2528d3f6213cd102f258ab02ed2291834aff9
Opcode Fuzzy Hash: efb580dbeb59a7738f0eb9e90f54f04a2e44e710226ba4cea88275d17074bc0e
Instruction Fuzzy Hash: A9216776508204DFCB10CF54D9C8B26BB69FB84358F20C6ADD8098B34AC33AD947CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0180D4BF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325231937.000000000180D000.00000040.00000001.sdmp, Offset: 0180D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f69d7024cdfcefd926ead02efcbb901b97aad1906707df055ccf3b322d20e9c3
Instruction ID: 1b11e474510fde7e834469eaf9722465091478b7665c77c7f1936c847bcf4ece
Opcode Fuzzy Hash: f69d7024cdfcefd926ead02efcbb901b97aad1906707df055ccf3b322d20e9c3
Instruction Fuzzy Hash: 1F11E172404284CFCB02CF54D9C0B16BF71FB88324F28C6A9EC054B656C336D55ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0181D017, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325263365.000000000181D000.00000040.00000001.sdmp, Offset: 0181D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e260aa7d4eec5616febf4142ed0a95566a9e8ae1fbabd20c8ce5c2b41f68a8cc
Instruction ID: 832e6912ee300dbc9809fdffcaf2e9c2c5c653172d43324d6f0260b879f4ce58
Opcode Fuzzy Hash: e260aa7d4eec5616febf4142ed0a95566a9e8ae1fbabd20c8ce5c2b41f68a8cc
Instruction Fuzzy Hash: 6811BE76504280CFCB12CF14D5C4B16BB61FB44314F28C6A9D8098B65AC33AD55BCB62

Uniqueness

Uniqueness Score: -1.00%

Function 0181D1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325263365.000000000181D000.00000040.00000001.sdmp, Offset: 0181D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e260aa7d4eec5616febf4142ed0a95566a9e8ae1fbabd20c8ce5c2b41f68a8cc
Instruction ID: 63db92976364cd31c13e810734522fecbf6ab72d4b4179f9dd61d49011f95e76
Opcode Fuzzy Hash: e260aa7d4eec5616febf4142ed0a95566a9e8ae1fbabd20c8ce5c2b41f68a8cc
Instruction Fuzzy Hash: C511BB76904280DFCB02CF54C5C4B55BBB1FB84324F28C6A9D8498B65AC33AE45ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 0180D745, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325231937.000000000180D000.00000040.00000001.sdmp, Offset: 0180D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038ae5db9ee6939c76e2e837e0fec6d7e76614f5540f4af6404b89efa853dff7
Instruction ID: 3798ee2438fb3010c48ae7f3182957224400c3525362999bb7a4e6183b7a4f75
Opcode Fuzzy Hash: 038ae5db9ee6939c76e2e837e0fec6d7e76614f5540f4af6404b89efa853dff7
Instruction Fuzzy Hash: AD01FC711093C89AE7528A95CDC4766BB98DF41378F08C619EE049B2C6D375D540C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 0180D6CF, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325231937.000000000180D000.00000040.00000001.sdmp, Offset: 0180D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5c6467640dbbe14df1f307d4092c7ef052af6118a91b4120ee3229fe835af45
Instruction ID: 5e4386a5910482b6dfd1901ba04fdbcbbd62b9035a536262085326a64d7fc65f
Opcode Fuzzy Hash: d5c6467640dbbe14df1f307d4092c7ef052af6118a91b4120ee3229fe835af45
Instruction Fuzzy Hash: A6F0F976200604AF93608F4ADC85C27FBADEBC5774755C59AE84A8B752C771EC42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0180D744, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325231937.000000000180D000.00000040.00000001.sdmp, Offset: 0180D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b4c3e85a46c485fb3facc6319108e3037d0f397bd2f5172f2b3446e3501c04e
Instruction ID: 1cad876f5359c2cb3e778d10ba5506f03e9236d7b9cab8f3596fd6d95b3875f8
Opcode Fuzzy Hash: 9b4c3e85a46c485fb3facc6319108e3037d0f397bd2f5172f2b3446e3501c04e
Instruction Fuzzy Hash: 58F062714083849AE7518E59CCC8B62FF98EB81774F18C55AED085B286C3799944CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0180D6C0, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325231937.000000000180D000.00000040.00000001.sdmp, Offset: 0180D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48f477eaa63e30d9da6f47b3b97fe82d932aa0cb44e78cdce321df9243a0c765
Instruction ID: ddb1aab164b8e2d8845e07790c8f3f4b6bda4acba9b278b1aeb9506a462304b1
Opcode Fuzzy Hash: 48f477eaa63e30d9da6f47b3b97fe82d932aa0cb44e78cdce321df9243a0c765
Instruction Fuzzy Hash: FEF03C75104680AFD3658F56CC84C22BFB9EF867607198589E8998B352C631FC42CBA0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 031E13F0, Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

Jb:|, xrefs: 031E165F
TBB`, xrefs: 031E1488

Memory Dump Source

Source File: 00000000.00000002.325510434.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: false

Similarity

API ID:
String ID: Jb:|$TBB`
API String ID: 0-3276081431
Opcode ID: b686c8cff4950f982529bee46daba484ccf1b3d7dcad880340f863074da1651b
Instruction ID: 37d4f33c92daf73749c86bcb606c721593a44118ec9b1f78b97200cbc30fb45e
Opcode Fuzzy Hash: b686c8cff4950f982529bee46daba484ccf1b3d7dcad880340f863074da1651b
Instruction Fuzzy Hash: 8E71F675E4461ADFCB08CFA9D4415AEBBF2FF89300F20942AD416EB314D7359A428FA5

Uniqueness

Uniqueness Score: -1.00%

Function 018EE578, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325404621.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0406247979256f8b173f581c535742355baa2b9d3e386f9af2e6ba7af8a7f637
Instruction ID: 312c58914dc466f3ba759ef9d2cc81d4b6073051aa404bfa7045cd801d29d693
Opcode Fuzzy Hash: 0406247979256f8b173f581c535742355baa2b9d3e386f9af2e6ba7af8a7f637
Instruction Fuzzy Hash: A112D8F14217468AD310EF67F99C1897BA1B756328FB0C308D2652BAD9D7B4B14ACF84

Uniqueness

Uniqueness Score: -1.00%

Function 018EC134, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325404621.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0179b8da9cbf2677de3d682c8a993e38a3f85bfa4490ae5f10c9ece37c6b47e4
Instruction ID: 69f05822fff91ce52c563ebd64a997278e9f60fe6f192ff605e42ed80dd30548
Opcode Fuzzy Hash: 0179b8da9cbf2677de3d682c8a993e38a3f85bfa4490ae5f10c9ece37c6b47e4
Instruction Fuzzy Hash: 1FA16F32E0061A8FCF05DFA9D8485DDBBF2FF86300B15856AE915EB261DB31EA45CB40

Uniqueness

Uniqueness Score: -1.00%

Function 018EE56A, Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325404621.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa36b7882f2f073a0ada6fcce9d6322a48a5c4b64cede9055cb317cdf03c205e
Instruction ID: 7ced15fb475b44296ceb28803b2eae945b6f527c1c71ebcddd332724d197a64e
Opcode Fuzzy Hash: aa36b7882f2f073a0ada6fcce9d6322a48a5c4b64cede9055cb317cdf03c205e
Instruction Fuzzy Hash: 98C128B18217458AD310EF67F98C1897BA1BB96328F70C318D1616BAD8D7B4B44ACF84

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegSvcs.exe PID: 6508 Parent PID: 5836 RegSvcs.exeCOMMON

Executed Functions

Function 029F6B1F, Relevance: 6.1, APIs: 4, Instructions: 140threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 029F6BB0
GetCurrentThread.KERNEL32 ref: 029F6BED
GetCurrentProcess.KERNEL32 ref: 029F6C2A
GetCurrentThreadId.KERNEL32 ref: 029F6C83

Memory Dump Source

Source File: 0000000F.00000002.500105309.00000000029F0000.00000040.00000001.sdmp, Offset: 029F0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 36fa64df893f83031f1b675a9e78324613ed8abf22139bbc56c478c48a058e0f
Instruction ID: fc2ab1f546dae90fd36f103a34efc400990943ac633bade4957272260d49161d
Opcode Fuzzy Hash: 36fa64df893f83031f1b675a9e78324613ed8abf22139bbc56c478c48a058e0f
Instruction Fuzzy Hash: 995156B09053888FDB50CFA9D5487DEBFF4EF49318F24849AE558A7251D7349844CF62

Uniqueness

Uniqueness Score: -1.00%

Function 029F6B50, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 029F6BB0
GetCurrentThread.KERNEL32 ref: 029F6BED
GetCurrentProcess.KERNEL32 ref: 029F6C2A
GetCurrentThreadId.KERNEL32 ref: 029F6C83

Memory Dump Source

Source File: 0000000F.00000002.500105309.00000000029F0000.00000040.00000001.sdmp, Offset: 029F0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b1188374b3b480197a7436c92ef87690d0f243e670a97efe275523a7bdda95ce
Instruction ID: af232269c4105e52ed284255b31e1e7d1c938442c0dab658e43e60d1cc2c4ad0
Opcode Fuzzy Hash: b1188374b3b480197a7436c92ef87690d0f243e670a97efe275523a7bdda95ce
Instruction Fuzzy Hash: C75134B0A003488FDB54CFA9D648BDEBBF4EF48318F248499E519A7350D774A844CF66

Uniqueness

Uniqueness Score: -1.00%

Function 029F5184, Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 029F52A2

Memory Dump Source

Source File: 0000000F.00000002.500105309.00000000029F0000.00000040.00000001.sdmp, Offset: 029F0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 0fb5e72cb7812b5a8887cee18e6009cc2fc08d357aed6ac72fc1616d972f7a37
Instruction ID: f8cb8522a0fa6e4a09f3efdb0976ae2a619bd6450d16a7b66d44da49b0323ca1
Opcode Fuzzy Hash: 0fb5e72cb7812b5a8887cee18e6009cc2fc08d357aed6ac72fc1616d972f7a37
Instruction Fuzzy Hash: B351D0B1D10309DFDB14CF99C984ADEBBB5BF48314F65822AE919AB210D770A885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 029F5190, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 029F52A2

Memory Dump Source

Source File: 0000000F.00000002.500105309.00000000029F0000.00000040.00000001.sdmp, Offset: 029F0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 4db7caca7675df99b5a080e7fb36b1fa115c81fe8b2ca3dff467423937e0f8ce
Instruction ID: 863888cefe4cc917cda024922620a5038842246e90a4a9c4307e10b19beb8f34
Opcode Fuzzy Hash: 4db7caca7675df99b5a080e7fb36b1fa115c81fe8b2ca3dff467423937e0f8ce
Instruction Fuzzy Hash: AA41D0B1D10309DFDF14CF99C984ADEBBB5BF88314F65822AE819AB210D774A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 029F6964, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 029F7D01

Memory Dump Source

Source File: 0000000F.00000002.500105309.00000000029F0000.00000040.00000001.sdmp, Offset: 029F0000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 59bf597d787aafc263e2b0ed87595ef03fa6cd31e74c883be683de0e1e1775a0
Instruction ID: ec3d242cd052a2026ac48ca7df6d3f2c82dee069a6d9e70e8b9d106edf298337
Opcode Fuzzy Hash: 59bf597d787aafc263e2b0ed87595ef03fa6cd31e74c883be683de0e1e1775a0
Instruction Fuzzy Hash: C54107B5A002058FDB54CF99C448BAAFBF5FF88314F258499D519AB361D774E841CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 029F6D72, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 029F6DFF

Memory Dump Source

Source File: 0000000F.00000002.500105309.00000000029F0000.00000040.00000001.sdmp, Offset: 029F0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2cb028b443555de9b238d9746ef5df3be5adca712e4d409e888a3806c3c57751
Instruction ID: d93816c00cee1662b7a4f9a243b42312eac3d3160447755e25d822df719fc17a
Opcode Fuzzy Hash: 2cb028b443555de9b238d9746ef5df3be5adca712e4d409e888a3806c3c57751
Instruction Fuzzy Hash: 9421E2B5D00249AFDB10CFA9D584AEEBBF8FB58324F14801AE914A7310D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 029F6D78, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 029F6DFF

Memory Dump Source

Source File: 0000000F.00000002.500105309.00000000029F0000.00000040.00000001.sdmp, Offset: 029F0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0fa170c491c1839c583affd7d36acfe5dde33067a35e1ad3c008607d2a31b2e2
Instruction ID: 7b08e3cd7fdced10fa748d8f8ccaa4e487ca3f945822faf1f9748f3d759e4025
Opcode Fuzzy Hash: 0fa170c491c1839c583affd7d36acfe5dde33067a35e1ad3c008607d2a31b2e2
Instruction Fuzzy Hash: 7121D3B5900349AFDB10CFAAD984ADEBBF8FB48324F14841AE914A7310D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 029FBDE9, Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 029FBE72

Memory Dump Source

Source File: 0000000F.00000002.500105309.00000000029F0000.00000040.00000001.sdmp, Offset: 029F0000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 1c6b696a9b07449d132883c35032b10e8fd559d27ba92bc5f9314e104c5fb23f
Instruction ID: b4b354d1ff715f43e6caad53d70daeab1b99dbd27944f08fdfdc70ef1aa3434d
Opcode Fuzzy Hash: 1c6b696a9b07449d132883c35032b10e8fd559d27ba92bc5f9314e104c5fb23f
Instruction Fuzzy Hash: 7A2189B2905309CFDBA0DFA9D6187DABFF4EB08318F24856AD519B3601E3389544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 029FBDF8, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 029FBE72

Memory Dump Source

Source File: 0000000F.00000002.500105309.00000000029F0000.00000040.00000001.sdmp, Offset: 029F0000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 12a339129c21b79b30a02c6b45dbca36711569da6e160a9d0d70a8e7b6e415fb
Instruction ID: a7c5eff48f2e0b7318166783f54e2ec1aceb90be53f17d4153385cc90ec9c66c
Opcode Fuzzy Hash: 12a339129c21b79b30a02c6b45dbca36711569da6e160a9d0d70a8e7b6e415fb
Instruction Fuzzy Hash: 4F1189B19013098FDBA0DFA9D5187DABFF4EB08318F24846AC508B3600E738A444CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 028BD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.499846699.00000000028BD000.00000040.00000001.sdmp, Offset: 028BD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8afc35870c5f2fab0c8e1d9385004b76be1533ef391dd55b8b11e7251efd779a
Instruction ID: fe94e3024daeff20dc8398361ee76f65ecc1116ca0613a324e906f7a693bb948
Opcode Fuzzy Hash: 8afc35870c5f2fab0c8e1d9385004b76be1533ef391dd55b8b11e7251efd779a
Instruction Fuzzy Hash: 3821D37D508244EFDB15DF14D5C0B66BB65FF84218F24C5ADD90A8B346C33AD847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 028BD006, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.499846699.00000000028BD000.00000040.00000001.sdmp, Offset: 028BD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74ea2f690e4ab6fcec58b1e157852d8f644cadb3fa73be8e50435417706db88a
Instruction ID: 8f8618a883a69e29c9c9b6d64c2c7cf734385a7429826c771a165c3fe13240fe
Opcode Fuzzy Hash: 74ea2f690e4ab6fcec58b1e157852d8f644cadb3fa73be8e50435417706db88a
Instruction Fuzzy Hash: FB2150795083809FCB12CF14D994B11BF71EF46214F28C5EAD8498B297C33AD85BCB62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: kprUEGC.exe PID: 5000 Parent PID: 3472 kprUEGC.exeCOMMON

Executed Functions

Function 01800F38, Relevance: .6, Instructions: 576COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.428424011.0000000001800000.00000040.00000001.sdmp, Offset: 01800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d8740148796e902be54dff0ed829b793fc809ed8b6139e28150ca6e5654a95
Instruction ID: 4bc81a3e229726f0083fa3468269782c604e67beec192a35c0086d8f0d532bc7
Opcode Fuzzy Hash: 61d8740148796e902be54dff0ed829b793fc809ed8b6139e28150ca6e5654a95
Instruction Fuzzy Hash: 1B327B30701705CFD769DF68ED9866A73A2EBC8319B208978C502CB399DB35ED46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01800728, Relevance: .4, Instructions: 413COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.428424011.0000000001800000.00000040.00000001.sdmp, Offset: 01800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b98a7316e90e3c00dd269490317ef12a92a628e710a59047e6fa1614d83d879b
Instruction ID: 5f24a8440d97b4c989e76c0bac29aa0188a86dde6625c335ee98264fbe3dc6bc
Opcode Fuzzy Hash: b98a7316e90e3c00dd269490317ef12a92a628e710a59047e6fa1614d83d879b
Instruction Fuzzy Hash: 6681D231A003488FDB2ADF64D8187AABBB2EF88314F05C569D542977A4DF35ED95CB80

Uniqueness

Uniqueness Score: -1.00%

Function 01800E31, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.428424011.0000000001800000.00000040.00000001.sdmp, Offset: 01800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5ddbd4db9324b58b9e90948650b17b4ec7391e94af1c865449f7a13a9b2d6b
Instruction ID: 75085fd58aeae65ac6dbfe2b887414296f1700ce8cc481edd50fa201406dc60c
Opcode Fuzzy Hash: 5a5ddbd4db9324b58b9e90948650b17b4ec7391e94af1c865449f7a13a9b2d6b
Instruction Fuzzy Hash: 31312A747112108FC759EB38D46896D37E2AFAA21931209BDE502CF7B1DB36DC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01800E40, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.428424011.0000000001800000.00000040.00000001.sdmp, Offset: 01800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d181c34e7e37bf32c302e3628d00ed78acd98d0e1eb8fb30bd79ee592b86fca
Instruction ID: a9ca6d80c3e5053c0d03261cb8a54cb7dc5b9a415b89c2368856a6668bc3bc63
Opcode Fuzzy Hash: 2d181c34e7e37bf32c302e3628d00ed78acd98d0e1eb8fb30bd79ee592b86fca
Instruction Fuzzy Hash: 292105747112108FC759EB78D46892D33E2AF9961931209BCE506CF7B1DB36EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 018017F8, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.428424011.0000000001800000.00000040.00000001.sdmp, Offset: 01800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b28bbb5c4339c62a04a1d253fb33d2f1052a782f8cf64a1ea69f995f843c761
Instruction ID: 8620f8c8b3bea05122b4f7f4b4f4e2bb6f8463cda3d0fdb3bdf91f0368dd9928
Opcode Fuzzy Hash: 6b28bbb5c4339c62a04a1d253fb33d2f1052a782f8cf64a1ea69f995f843c761
Instruction Fuzzy Hash: CD118E75E003099FCB45DFB8E8489EEFBB5FF89310B10866AD5199B221E734A945CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 01801808, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.428424011.0000000001800000.00000040.00000001.sdmp, Offset: 01800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c592995f708086c660d1aa8d0ebccc5d7522bc2141cf08a55e59a3891f05c93f
Instruction ID: 04edf495b62cf4deeff935830c9f99977e46a1b7eb9a9b81d8580e4ad5e27694
Opcode Fuzzy Hash: c592995f708086c660d1aa8d0ebccc5d7522bc2141cf08a55e59a3891f05c93f
Instruction Fuzzy Hash: B8014075E00209DFCB40DFA8D8488DAFBB5FF893107108666E5159B221E734A915CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01800480, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.428424011.0000000001800000.00000040.00000001.sdmp, Offset: 01800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 197f07d1190d0774101293c782321e0a88ae9aeef5523c6c81ea6541152e0f26
Instruction ID: 44c8b945c9119d30bd522f6fafe9aa62cc5253b216b2483736a4c9c9340d4447
Opcode Fuzzy Hash: 197f07d1190d0774101293c782321e0a88ae9aeef5523c6c81ea6541152e0f26
Instruction Fuzzy Hash: A1F0677580E3D89FCB538BB46D942D97FF09E07660B0901EBC885DB157E6284A0DC7A2

Uniqueness

Uniqueness Score: -1.00%

Function 01800B9C, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.428424011.0000000001800000.00000040.00000001.sdmp, Offset: 01800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70cf5edf0e7a38012b517af8274287673b234483a402f798f7f5cbb67d069eba
Instruction ID: fa2bb237123b67d1d44f00d3d979bd4c0e298e1ccced269198c789ba3836477d
Opcode Fuzzy Hash: 70cf5edf0e7a38012b517af8274287673b234483a402f798f7f5cbb67d069eba
Instruction Fuzzy Hash: DDF08C30904209CFEB15DF64C85C7AD7BB0AB18358F100959E402E7795CF74AA84CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 018016D8, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.428424011.0000000001800000.00000040.00000001.sdmp, Offset: 01800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a9bc00305c9ed88e767c3125d202da483b78619baf6133649631badb0df725b
Instruction ID: 777f054015f9dd369df30966d15917d486a8ccd4021de8fbc865e4ce9a11eaa6
Opcode Fuzzy Hash: 3a9bc00305c9ed88e767c3125d202da483b78619baf6133649631badb0df725b
Instruction Fuzzy Hash: 40D012317002149FD714EA79ED09A457BA8EB09B61F114055EA04DB294DA71DD14CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 018004A8, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.428424011.0000000001800000.00000040.00000001.sdmp, Offset: 01800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e707be6389470e2de46b4bab3eff5c5ae4b0fad48eb3d98aed4986e5fa424cb
Instruction ID: 6a236e98d1189274b628025af36b85258910db9127de06196b995aad6a48cd47
Opcode Fuzzy Hash: 0e707be6389470e2de46b4bab3eff5c5ae4b0fad48eb3d98aed4986e5fa424cb
Instruction Fuzzy Hash: 71D067B1D0422DAF8B90EFB99D091DEBBF8EA08254B1145A6D919E3204E6705B108BD1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: kprUEGC.exe PID: 7048 Parent PID: 3472 kprUEGC.exeCOMMON

Executed Functions

Function 00C00F38, Relevance: .5, Instructions: 510COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.445884566.0000000000C00000.00000040.00000001.sdmp, Offset: 00C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad653fafca11b220c218f47b41aa4585aeb8a0dfc8ae487912b34d459325f45e
Instruction ID: 4f0c3b154690d16e50ebf17c63c3053110f8e6354f920b8e23d7592286dcf6ae
Opcode Fuzzy Hash: ad653fafca11b220c218f47b41aa4585aeb8a0dfc8ae487912b34d459325f45e
Instruction Fuzzy Hash: AB227074701601CFD714EF64E9A066AB3A2FBC9305B289938D9128B79CDB35ED46CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00C00728, Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.445884566.0000000000C00000.00000040.00000001.sdmp, Offset: 00C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da1ff48b44503f0cf37f788285033cd5e74a81169c7c16421aef66f45ff8e154
Instruction ID: 517e09d0b827df16411271795cea5a0da561ba316866d5e98451b23e295cf8bb
Opcode Fuzzy Hash: da1ff48b44503f0cf37f788285033cd5e74a81169c7c16421aef66f45ff8e154
Instruction Fuzzy Hash: 82311831905384DFEB16DF64D8187D97FB2FF86310F1684A5C442A76A1CB749D84CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C008F0, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.445884566.0000000000C00000.00000040.00000001.sdmp, Offset: 00C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15519e1d9516bd9b4057b7d611a6346b189824704d27e2db82d8267099b6aac5
Instruction ID: aea1e0ddbfd955d3b45f8bcdb091f3274df6410f719ae71fdefade322ce33d31
Opcode Fuzzy Hash: 15519e1d9516bd9b4057b7d611a6346b189824704d27e2db82d8267099b6aac5
Instruction Fuzzy Hash: 7E71DF34A002448FDB15DBA4C4187AEBBB3FF88304F258929D50267BA9DF75ED80CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00C00E31, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.445884566.0000000000C00000.00000040.00000001.sdmp, Offset: 00C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18eab01e1f31e9a0ea9fef12929155897e7e2ed22c74c6b4e6fe6706f2792aaf
Instruction ID: faaf7e4f03986b0a186895d2c65bbbf2a7ef39c6ad9dba941fec116f017e3467
Opcode Fuzzy Hash: 18eab01e1f31e9a0ea9fef12929155897e7e2ed22c74c6b4e6fe6706f2792aaf
Instruction Fuzzy Hash: D3314B747152108FC719EB78C46896D37E2AF9A61931208BDE506CF7B1DB36DC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C00E40, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.445884566.0000000000C00000.00000040.00000001.sdmp, Offset: 00C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9187cde1c08d03c6cc7034045bf9c4ff74ebe002373c51b006a41e7aa5b4e85
Instruction ID: ceac0260793c657561c789adfa6c70967c652e3e9b03e3f79d9abf80f866cab3
Opcode Fuzzy Hash: b9187cde1c08d03c6cc7034045bf9c4ff74ebe002373c51b006a41e7aa5b4e85
Instruction Fuzzy Hash: 3A2116747112108FC768EB78C46892D33E2AF9961932209B8E506CF7B5DF36EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C016D8, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.445884566.0000000000C00000.00000040.00000001.sdmp, Offset: 00C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3010cf82415fe105d5e3279c6cd2c36e7c216968a08905f59eb3dcab9fb331ac
Instruction ID: 23c516d08a220623caa4e4a116442162bd25619a51e57824b85d0ce1ebd80248
Opcode Fuzzy Hash: 3010cf82415fe105d5e3279c6cd2c36e7c216968a08905f59eb3dcab9fb331ac
Instruction Fuzzy Hash: 7D11E130B08604AFCB55EBB8D42466D7BBAEF86604F1144B4D605DB795DF309D0ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C017F8, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.445884566.0000000000C00000.00000040.00000001.sdmp, Offset: 00C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dee05cde5a9b3e9a0c05e6f436001d02fe3a91835a6ac4ac36bee2d0b4079c51
Instruction ID: fac72fab7aa24c4aacd79ec9b1dafd5bb01fc8d8d6975b3c0913dc2dd2bef47c
Opcode Fuzzy Hash: dee05cde5a9b3e9a0c05e6f436001d02fe3a91835a6ac4ac36bee2d0b4079c51
Instruction Fuzzy Hash: ED11A576D042499FCB00DFB8D8549EEFBB5FF89300B108666E51497225D7319505CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C01808, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.445884566.0000000000C00000.00000040.00000001.sdmp, Offset: 00C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89e391e5f497a288748b55ddae4e2e16e9473dafad93381333e2949f9bcac591
Instruction ID: 7f79f0a6ca32f35127fad79ff6f98ebef46c330ac1ef101c4945ebcc10f8342c
Opcode Fuzzy Hash: 89e391e5f497a288748b55ddae4e2e16e9473dafad93381333e2949f9bcac591
Instruction Fuzzy Hash: 61014C7AE102099FCB40EFA8D8548EAFBB5FF893107118666E51997225EB31A915CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00C00498, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.445884566.0000000000C00000.00000040.00000001.sdmp, Offset: 00C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0964795df86f58dd16b608a8995ef0aee00e03245113d3db269381f060681ee4
Instruction ID: 25cbd296a7400ee7f5e9ab013d46b53fb3f4861b5cdb08a973231a016908b1f8
Opcode Fuzzy Hash: 0964795df86f58dd16b608a8995ef0aee00e03245113d3db269381f060681ee4
Instruction Fuzzy Hash: C2E06D74C052189F8B00AFB995041997FF4EE46650B5105B6C94AE7201E3705A18CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C00B9C, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.445884566.0000000000C00000.00000040.00000001.sdmp, Offset: 00C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8526234e2312d0a482794eac3ccc23247113ed4cf114f05cb629ecb5b710f0e2
Instruction ID: 5ab2e7ae10c1507750e97107971671223351cea3cfbc795574ee57990ba387fe
Opcode Fuzzy Hash: 8526234e2312d0a482794eac3ccc23247113ed4cf114f05cb629ecb5b710f0e2
Instruction Fuzzy Hash: FAF01C70904345CFDF14DFA4C0597AD7BB0BB58318F260869D452A7BA1CBB4AD84CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C004A8, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.445884566.0000000000C00000.00000040.00000001.sdmp, Offset: 00C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc547f0bfed8b444d31a284c4c33d66efaf4f4643b71412eb798b94e5e022b7f
Instruction ID: bc328f1e253710e9fdf90c595aaad07132af75324351f086bbc60a1aeca7ee4e
Opcode Fuzzy Hash: cc547f0bfed8b444d31a284c4c33d66efaf4f4643b71412eb798b94e5e022b7f
Instruction Fuzzy Hash: 08D067B1D00229AF8F40EFF999051DEBBF8FA49250F2145A6DA19E3201E6745A10CBD1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report HSBc20210216B1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior