Edit tour

Windows Analysis Report
692BB93169319EBA2F556174D781A8636D610A67E6838.exe

Overview

General Information

Sample Name:	692BB93169319EBA2F556174D781A8636D610A67E6838.exe
Analysis ID:	629870
MD5:	a93162e62b49a591e0d481e030ffc9ea
SHA1:	b0c48a0fc418977051bea837c16aa7928f654da7
SHA256:	692bb93169319eba2f556174d781a8636d610a67e6838e19300a8a2454cd8b2b
Tags:	exeNanoCoreRAT
Infos:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Malicious sample detected (through community Yara rule)

Sigma detected: NanoCore

Detected Nanocore Rat

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Sigma detected: Drops script at startup location

Multi AV Scanner detection for dropped file

Yara detected Nanocore RAT

Maps a DLL or memory area into another process

Writes to foreign memory regions

Machine Learning detection for sample

.NET source code contains potential unpacker

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Drops VBS files to the startup folder

Uses dynamic DNS services

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

Process Tree

System is w10x64

692BB93169319EBA2F556174D781A8636D610A67E6838.exe (PID: 5844 cmdline: "C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe" MD5: A93162E62B49A591E0D481E030FFC9EA)

conhost.exe (PID: 6076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

RegAsm.exe (PID: 5596 cmdline: "C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe" MD5: 6FD7592411112729BF6B1F2F6C34899F)

wscript.exe (PID: 2208 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ople.exe.vbs" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

ople.exe.exe (PID: 1796 cmdline: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe MD5: CA51A0A9E3EF192B26D9818DC4EC5FF0)

conhost.exe (PID: 1720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

RegAsm.exe (PID: 1428 cmdline: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe MD5: 6FD7592411112729BF6B1F2F6C34899F)

cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "3b5167aa-3858-4f80-81dc-688e9982", "Group": "AtikuVSDino", "Domain1": "dinolachy.duckdns.org", "Domain2": "127.0.0.1", "Port": 5626, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Disable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Disable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000000.296930304.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000000.296930304.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000000.296930304.0000000000402000.00000040.80000000.00040000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000003.00000002.513573670.00000000056A0000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
00000003.00000002.513573670.00000000056A0000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
00000003.00000002.513573670.00000000056A0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000003.00000002.513573670.00000000056A0000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xf778:$x2: NanoCore.ClientPlugin 0xf7ad:$x3: NanoCore.ClientPluginHost 0xf76c:$i2: IClientData 0xf78e:$i3: IClientNetwork 0xf79d:$i5: IClientDataHost 0xf7c7:$i6: IClientLoggingHost 0xf7da:$i7: IClientNetworkHost 0xf7ed:$i8: IClientUIHost 0xf7fb:$i9: IClientNameObjectCollection 0xf817:$i10: IClientReadOnlyNameObjectCollection 0xf56a:$s1: ClientPlugin 0xf781:$s1: ClientPlugin 0x147a2:$s6: get_ClientSettings
00000003.00000002.509119262.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000003.00000002.509119262.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000003.00000002.509119262.0000000000402000.00000040.80000000.00040000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000000.00000002.269192497.0000000000D80000.00000004.00001000.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.269192497.0000000000D80000.00000004.00001000.00020000.00000000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
00000000.00000002.269192497.0000000000D80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.269192497.0000000000D80000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
00000000.00000002.269192497.0000000000D80000.00000004.00001000.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
00000003.00000000.266056234.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000003.00000000.266056234.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000003.00000000.266056234.0000000000402000.00000040.80000000.00040000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000003.00000002.510200651.0000000002D91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.319192237.0000000003F99000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.319192237.0000000003F99000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x42f25:$a: NanoCore 0x42f7e:$a: NanoCore 0x42fbb:$a: NanoCore 0x43034:$a: NanoCore 0x566df:$a: NanoCore 0x566f4:$a: NanoCore 0x56729:$a: NanoCore 0x6f1ab:$a: NanoCore 0x6f1c0:$a: NanoCore 0x6f1f5:$a: NanoCore 0x42f87:$b: ClientPlugin 0x42fc4:$b: ClientPlugin 0x438c2:$b: ClientPlugin 0x438cf:$b: ClientPlugin 0x5649b:$b: ClientPlugin 0x564b6:$b: ClientPlugin 0x564e6:$b: ClientPlugin 0x566fd:$b: ClientPlugin 0x56732:$b: ClientPlugin 0x6ef67:$b: ClientPlugin 0x6ef82:$b: ClientPlugin
00000003.00000002.513552281.0000000005650000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
00000003.00000002.513552281.0000000005650000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
00000003.00000002.513552281.0000000005650000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
0000000C.00000002.318213068.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000002.318213068.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.318213068.0000000000402000.00000040.80000000.00040000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000003.00000002.511424469.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000003.00000002.511424469.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2f25:$a: NanoCore 0x2f7e:$a: NanoCore 0x2fbb:$a: NanoCore 0x3034:$a: NanoCore 0x166df:$a: NanoCore 0x166f4:$a: NanoCore 0x16729:$a: NanoCore 0x2f1ab:$a: NanoCore 0x2f1c0:$a: NanoCore 0x2f1f5:$a: NanoCore 0x2f87:$b: ClientPlugin 0x2fc4:$b: ClientPlugin 0x38c2:$b: ClientPlugin 0x38cf:$b: ClientPlugin 0x1649b:$b: ClientPlugin 0x164b6:$b: ClientPlugin 0x164e6:$b: ClientPlugin 0x166fd:$b: ClientPlugin 0x16732:$b: ClientPlugin 0x2ef67:$b: ClientPlugin 0x2ef82:$b: ClientPlugin
0000000C.00000002.318967216.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.318967216.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x6b44f:$a: NanoCore 0x6b4a8:$a: NanoCore 0x6b4e5:$a: NanoCore 0x6b55e:$a: NanoCore 0x6b4b1:$b: ClientPlugin 0x6b4ee:$b: ClientPlugin 0x6bdec:$b: ClientPlugin 0x6bdf9:$b: ClientPlugin 0x610ac:$e: KeepAlive 0x6b939:$g: LogClientMessage 0x6b8b9:$i: get_Connected 0x5b885:$j: #=q 0x5b8b5:$j: #=q 0x5b8f1:$j: #=q 0x5b919:$j: #=q 0x5b949:$j: #=q 0x5b979:$j: #=q 0x5b9a9:$j: #=q 0x5b9d9:$j: #=q 0x5b9f5:$j: #=q 0x5ba25:$j: #=q
00000007.00000002.301093367.0000000002A00000.00000004.00001000.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000007.00000002.301093367.0000000002A00000.00000004.00001000.00020000.00000000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
00000007.00000002.301093367.0000000002A00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000007.00000002.301093367.0000000002A00000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
00000007.00000002.301093367.0000000002A00000.00000004.00001000.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
Process Memory Space: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe PID: 5844	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb871c:$x1: NanoCore.ClientPluginHost 0xb8759:$x2: IClientNetworkHost 0xbc24a:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xc72d0:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe PID: 5844	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe PID: 5844	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xb83e9:$a: NanoCore 0xb83f9:$a: NanoCore 0xb84b8:$a: NanoCore 0xb84c7:$a: NanoCore 0xb86c8:$a: NanoCore 0xb86dc:$a: NanoCore 0xb871c:$a: NanoCore 0xc393a:$a: NanoCore 0xc394c:$a: NanoCore 0xc3988:$a: NanoCore 0xb8448:$b: ClientPlugin 0xb8511:$b: ClientPlugin 0xb86e5:$b: ClientPlugin 0xb8725:$b: ClientPlugin 0xc3955:$b: ClientPlugin 0xc3991:$b: ClientPlugin 0xb860a:$c: ProjectData 0xc3887:$c: ProjectData 0xb8fde:$d: DESCrypto 0xc41e5:$d: DESCrypto 0xc099b:$e: KeepAlive
Process Memory Space: RegAsm.exe PID: 5596	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2fb90:$x1: NanoCore.ClientPluginHost 0x77457:$x1: NanoCore.ClientPluginHost 0xa6471:$x1: NanoCore.ClientPluginHost 0x2fbcd:$x2: IClientNetworkHost 0x77471:$x2: IClientNetworkHost 0xa648b:$x2: IClientNetworkHost 0x336be:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x3e744:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: RegAsm.exe PID: 5596	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: RegAsm.exe PID: 5596	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2b218:$a: NanoCore 0x2f85d:$a: NanoCore 0x2f86d:$a: NanoCore 0x2f92c:$a: NanoCore 0x2f93b:$a: NanoCore 0x2fb3c:$a: NanoCore 0x2fb50:$a: NanoCore 0x2fb90:$a: NanoCore 0x3adae:$a: NanoCore 0x3adc0:$a: NanoCore 0x3adfc:$a: NanoCore 0x6cac6:$a: NanoCore 0x6cb22:$a: NanoCore 0x6cba4:$a: NanoCore 0x773c1:$a: NanoCore 0x7741a:$a: NanoCore 0x77457:$a: NanoCore 0x774d0:$a: NanoCore 0x77d6d:$a: NanoCore 0x77dc0:$a: NanoCore 0x77df9:$a: NanoCore
Process Memory Space: ople.exe.exe PID: 1796	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xdc383:$x1: NanoCore.ClientPluginHost 0xdc3c0:$x2: IClientNetworkHost 0xdfeb1:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xeaf37:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: ople.exe.exe PID: 1796	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: ople.exe.exe PID: 1796	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xdc050:$a: NanoCore 0xdc060:$a: NanoCore 0xdc11f:$a: NanoCore 0xdc12e:$a: NanoCore 0xdc32f:$a: NanoCore 0xdc343:$a: NanoCore 0xdc383:$a: NanoCore 0xe75a1:$a: NanoCore 0xe75b3:$a: NanoCore 0xe75ef:$a: NanoCore 0xdc0af:$b: ClientPlugin 0xdc178:$b: ClientPlugin 0xdc34c:$b: ClientPlugin 0xdc38c:$b: ClientPlugin 0xe75bc:$b: ClientPlugin 0xe75f8:$b: ClientPlugin 0xdc271:$c: ProjectData 0xe74ee:$c: ProjectData 0xdcc45:$d: DESCrypto 0xe7e4c:$d: DESCrypto 0xe4602:$e: KeepAlive
Process Memory Space: RegAsm.exe PID: 1428	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1bb4:$x1: NanoCore.ClientPluginHost 0x1a154:$x1: NanoCore.ClientPluginHost 0x43b84:$x1: NanoCore.ClientPluginHost 0x1bf1:$x2: IClientNetworkHost 0x1a16e:$x2: IClientNetworkHost 0x43b9e:$x2: IClientNetworkHost 0x56e2:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x10768:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: RegAsm.exe PID: 1428	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: RegAsm.exe PID: 1428	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1881:$a: NanoCore 0x1891:$a: NanoCore 0x1950:$a: NanoCore 0x195f:$a: NanoCore 0x1b60:$a: NanoCore 0x1b74:$a: NanoCore 0x1bb4:$a: NanoCore 0xcdd2:$a: NanoCore 0xcde4:$a: NanoCore 0xce20:$a: NanoCore 0x1a0be:$a: NanoCore 0x1a117:$a: NanoCore 0x1a154:$a: NanoCore 0x1a1cd:$a: NanoCore 0x1aa86:$a: NanoCore 0x1aad9:$a: NanoCore 0x1ab12:$a: NanoCore 0x1ab85:$a: NanoCore 0x22157:$a: NanoCore 0x2216a:$a: NanoCore 0x2219c:$a: NanoCore
Click to see the 43 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.RegAsm.exe.56a4629.7.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost
3.2.RegAsm.exe.56a4629.7.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost
3.2.RegAsm.exe.56a4629.7.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.2.RegAsm.exe.56a4629.7.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xb14f:$x2: NanoCore.ClientPlugin 0xb184:$x3: NanoCore.ClientPluginHost 0xb143:$i2: IClientData 0xb165:$i3: IClientNetwork 0xb174:$i5: IClientDataHost 0xb19e:$i6: IClientLoggingHost 0xb1b1:$i7: IClientNetworkHost 0xb1c4:$i8: IClientUIHost 0xb1d2:$i9: IClientNameObjectCollection 0xb1ee:$i10: IClientReadOnlyNameObjectCollection 0xaf41:$s1: ClientPlugin 0xb158:$s1: ClientPlugin 0x10179:$s6: get_ClientSettings
12.2.RegAsm.exe.2ffb670.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
12.2.RegAsm.exe.2ffb670.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
12.2.RegAsm.exe.2ffb670.1.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
3.2.RegAsm.exe.56a0000.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
3.2.RegAsm.exe.56a0000.6.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
3.2.RegAsm.exe.56a0000.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.2.RegAsm.exe.56a0000.6.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xf778:$x2: NanoCore.ClientPlugin 0xf7ad:$x3: NanoCore.ClientPluginHost 0xf76c:$i2: IClientData 0xf78e:$i3: IClientNetwork 0xf79d:$i5: IClientDataHost 0xf7c7:$i6: IClientLoggingHost 0xf7da:$i7: IClientNetworkHost 0xf7ed:$i8: IClientUIHost 0xf7fb:$i9: IClientNameObjectCollection 0xf817:$i10: IClientReadOnlyNameObjectCollection 0xf56a:$s1: ClientPlugin 0xf781:$s1: ClientPlugin 0x147a2:$s6: get_ClientSettings
3.2.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
3.2.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.2.RegAsm.exe.400000.0.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
3.2.RegAsm.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
3.0.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
3.0.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
3.0.RegAsm.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.0.RegAsm.exe.400000.0.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
3.0.RegAsm.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.2.RegAsm.exe.3fdff7c.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
12.2.RegAsm.exe.3fdff7c.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
12.2.RegAsm.exe.3fdff7c.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.3fdff7c.2.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xd978:$x2: NanoCore.ClientPlugin 0xd9ad:$x3: NanoCore.ClientPluginHost 0xd96c:$i2: IClientData 0xd98e:$i3: IClientNetwork 0xd99d:$i5: IClientDataHost 0xd9c7:$i6: IClientLoggingHost 0xd9da:$i7: IClientNetworkHost 0xd9ed:$i8: IClientUIHost 0xd9fb:$i9: IClientNameObjectCollection 0xda17:$i10: IClientReadOnlyNameObjectCollection 0xd76a:$s1: ClientPlugin 0xd981:$s1: ClientPlugin 0x129a2:$s6: get_ClientSettings
3.2.RegAsm.exe.2dc5cb4.1.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
12.2.RegAsm.exe.3fdb146.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d0af:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d0dc:$x2: IClientNetworkHost
12.2.RegAsm.exe.3fdb146.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d0af:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e18a:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d0c9:$s5: IClientLoggingHost
12.2.RegAsm.exe.3fdb146.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.3fdb146.4.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0x145ae:$x2: NanoCore.ClientPlugin 0x2d07a:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0x145e3:$x3: NanoCore.ClientPluginHost 0x2d0af:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0x145a2:$i2: IClientData 0x2d06e:$i2: IClientData 0xe29:$i3: IClientNetwork 0x145c4:$i3: IClientNetwork 0x2d090:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0x145d3:$i5: IClientDataHost 0x2d09f:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0x145fd:$i6: IClientLoggingHost 0x2d0c9:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost
12.2.RegAsm.exe.3fdb146.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d065:$a: NanoCore 0x2d07a:$a: NanoCore 0x2d0af:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2ce21:$b: ClientPlugin 0x2ce3c:$b: ClientPlugin
3.2.RegAsm.exe.56a0000.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
3.2.RegAsm.exe.56a0000.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
3.2.RegAsm.exe.56a0000.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.2.RegAsm.exe.56a0000.6.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xd978:$x2: NanoCore.ClientPlugin 0xd9ad:$x3: NanoCore.ClientPluginHost 0xd96c:$i2: IClientData 0xd98e:$i3: IClientNetwork 0xd99d:$i5: IClientDataHost 0xd9c7:$i6: IClientLoggingHost 0xd9da:$i7: IClientNetworkHost 0xd9ed:$i8: IClientUIHost 0xd9fb:$i9: IClientNameObjectCollection 0xda17:$i10: IClientReadOnlyNameObjectCollection 0xd76a:$s1: ClientPlugin 0xd981:$s1: ClientPlugin 0x129a2:$s6: get_ClientSettings
0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.2.RegAsm.exe.3fe45a5.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x23c50:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x23c7d:$x2: IClientNetworkHost
12.2.RegAsm.exe.3fe45a5.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x23c50:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x24d2b:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x23c6a:$s5: IClientLoggingHost
12.2.RegAsm.exe.3fe45a5.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.3fe45a5.3.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xb14f:$x2: NanoCore.ClientPlugin 0x23c1b:$x2: NanoCore.ClientPlugin 0xb184:$x3: NanoCore.ClientPluginHost 0x23c50:$x3: NanoCore.ClientPluginHost 0xb143:$i2: IClientData 0x23c0f:$i2: IClientData 0xb165:$i3: IClientNetwork 0x23c31:$i3: IClientNetwork 0xb174:$i5: IClientDataHost 0x23c40:$i5: IClientDataHost 0xb19e:$i6: IClientLoggingHost 0x23c6a:$i6: IClientLoggingHost 0xb1b1:$i7: IClientNetworkHost 0x23c7d:$i7: IClientNetworkHost 0xb1c4:$i8: IClientUIHost 0x23c90:$i8: IClientUIHost 0xb1d2:$i9: IClientNameObjectCollection 0x23c9e:$i9: IClientNameObjectCollection 0xb1ee:$i10: IClientReadOnlyNameObjectCollection 0x23cba:$i10: IClientReadOnlyNameObjectCollection 0xaf41:$s1: ClientPlugin
7.2.ople.exe.exe.2a00000.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
7.2.ople.exe.exe.2a00000.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
7.2.ople.exe.exe.2a00000.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
7.2.ople.exe.exe.2a00000.2.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe0f5:$x1: NanoCore Client 0xe105:$x1: NanoCore Client 0xe34d:$x2: NanoCore.ClientPlugin 0xe38d:$x3: NanoCore.ClientPluginHost 0xe342:$i1: IClientApp 0xe363:$i2: IClientData 0xe36f:$i3: IClientNetwork 0xe37e:$i4: IClientAppHost 0xe3a7:$i5: IClientDataHost 0xe3b7:$i6: IClientLoggingHost 0xe3ca:$i7: IClientNetworkHost 0xe3dd:$i8: IClientUIHost 0xe3eb:$i9: IClientNameObjectCollection 0xe407:$i10: IClientReadOnlyNameObjectCollection 0xe154:$s1: ClientPlugin 0xe356:$s1: ClientPlugin 0xe84a:$s2: EndPoint 0xe853:$s3: IPAddress 0xe85d:$s4: IPEndPoint 0x10293:$s6: get_ClientSettings 0x10837:$s7: get_Connected
7.2.ople.exe.exe.2a00000.2.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
3.2.RegAsm.exe.3ddff7c.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x28279:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x282a6:$x2: IClientNetworkHost
3.2.RegAsm.exe.3ddff7c.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x28279:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x29354:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x28293:$s5: IClientLoggingHost
3.2.RegAsm.exe.3ddff7c.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.2.RegAsm.exe.3ddff7c.3.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xf778:$x2: NanoCore.ClientPlugin 0x28244:$x2: NanoCore.ClientPlugin 0xf7ad:$x3: NanoCore.ClientPluginHost 0x28279:$x3: NanoCore.ClientPluginHost 0xf76c:$i2: IClientData 0x28238:$i2: IClientData 0xf78e:$i3: IClientNetwork 0x2825a:$i3: IClientNetwork 0xf79d:$i5: IClientDataHost 0x28269:$i5: IClientDataHost 0xf7c7:$i6: IClientLoggingHost 0x28293:$i6: IClientLoggingHost 0xf7da:$i7: IClientNetworkHost 0x282a6:$i7: IClientNetworkHost 0xf7ed:$i8: IClientUIHost 0x282b9:$i8: IClientUIHost 0xf7fb:$i9: IClientNameObjectCollection 0x282c7:$i9: IClientNameObjectCollection 0xf817:$i10: IClientReadOnlyNameObjectCollection 0x282e3:$i10: IClientReadOnlyNameObjectCollection 0xf56a:$s1: ClientPlugin
3.2.RegAsm.exe.3ddff7c.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
3.2.RegAsm.exe.3ddff7c.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
3.2.RegAsm.exe.3ddff7c.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.2.RegAsm.exe.3ddff7c.3.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xd978:$x2: NanoCore.ClientPlugin 0xd9ad:$x3: NanoCore.ClientPluginHost 0xd96c:$i2: IClientData 0xd98e:$i3: IClientNetwork 0xd99d:$i5: IClientDataHost 0xd9c7:$i6: IClientLoggingHost 0xd9da:$i7: IClientNetworkHost 0xd9ed:$i8: IClientUIHost 0xd9fb:$i9: IClientNameObjectCollection 0xda17:$i10: IClientReadOnlyNameObjectCollection 0xd76a:$s1: ClientPlugin 0xd981:$s1: ClientPlugin 0x129a2:$s6: get_ClientSettings
3.2.RegAsm.exe.3de45a5.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x23c50:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x23c7d:$x2: IClientNetworkHost
3.2.RegAsm.exe.3de45a5.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x23c50:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x24d2b:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x23c6a:$s5: IClientLoggingHost
3.2.RegAsm.exe.3de45a5.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.2.RegAsm.exe.3de45a5.4.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xb14f:$x2: NanoCore.ClientPlugin 0x23c1b:$x2: NanoCore.ClientPlugin 0xb184:$x3: NanoCore.ClientPluginHost 0x23c50:$x3: NanoCore.ClientPluginHost 0xb143:$i2: IClientData 0x23c0f:$i2: IClientData 0xb165:$i3: IClientNetwork 0x23c31:$i3: IClientNetwork 0xb174:$i5: IClientDataHost 0x23c40:$i5: IClientDataHost 0xb19e:$i6: IClientLoggingHost 0x23c6a:$i6: IClientLoggingHost 0xb1b1:$i7: IClientNetworkHost 0x23c7d:$i7: IClientNetworkHost 0xb1c4:$i8: IClientUIHost 0x23c90:$i8: IClientUIHost 0xb1d2:$i9: IClientNameObjectCollection 0x23c9e:$i9: IClientNameObjectCollection 0xb1ee:$i10: IClientReadOnlyNameObjectCollection 0x23cba:$i10: IClientReadOnlyNameObjectCollection 0xaf41:$s1: ClientPlugin
3.2.RegAsm.exe.3ddb146.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d0af:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d0dc:$x2: IClientNetworkHost
3.2.RegAsm.exe.3ddb146.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d0af:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e18a:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d0c9:$s5: IClientLoggingHost
3.2.RegAsm.exe.3ddb146.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.2.RegAsm.exe.3ddb146.2.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0x145ae:$x2: NanoCore.ClientPlugin 0x2d07a:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0x145e3:$x3: NanoCore.ClientPluginHost 0x2d0af:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0x145a2:$i2: IClientData 0x2d06e:$i2: IClientData 0xe29:$i3: IClientNetwork 0x145c4:$i3: IClientNetwork 0x2d090:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0x145d3:$i5: IClientDataHost 0x2d09f:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0x145fd:$i6: IClientLoggingHost 0x2d0c9:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost
3.2.RegAsm.exe.3ddb146.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d065:$a: NanoCore 0x2d07a:$a: NanoCore 0x2d0af:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2ce21:$b: ClientPlugin 0x2ce3c:$b: ClientPlugin
12.2.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.2.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.400000.0.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
12.2.RegAsm.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
3.2.RegAsm.exe.5650000.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
3.2.RegAsm.exe.5650000.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
3.2.RegAsm.exe.5650000.5.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe0f5:$x1: NanoCore Client 0xe105:$x1: NanoCore Client 0xe34d:$x2: NanoCore.ClientPlugin 0xe38d:$x3: NanoCore.ClientPluginHost 0xe342:$i1: IClientApp 0xe363:$i2: IClientData 0xe36f:$i3: IClientNetwork 0xe37e:$i4: IClientAppHost 0xe3a7:$i5: IClientDataHost 0xe3b7:$i6: IClientLoggingHost 0xe3ca:$i7: IClientNetworkHost 0xe3dd:$i8: IClientUIHost 0xe3eb:$i9: IClientNameObjectCollection 0xe407:$i10: IClientReadOnlyNameObjectCollection 0xe154:$s1: ClientPlugin 0xe356:$s1: ClientPlugin 0xe84a:$s2: EndPoint 0xe853:$s3: IPAddress 0xe85d:$s4: IPEndPoint 0x10293:$s6: get_ClientSettings 0x10837:$s7: get_Connected
0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
7.2.ople.exe.exe.2a00000.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
7.2.ople.exe.exe.2a00000.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
7.2.ople.exe.exe.2a00000.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
7.2.ople.exe.exe.2a00000.2.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
7.2.ople.exe.exe.2a00000.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.0.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.0.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.0.RegAsm.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.0.RegAsm.exe.400000.0.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
12.0.RegAsm.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.2.RegAsm.exe.3fdff7c.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x28279:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x282a6:$x2: IClientNetworkHost
12.2.RegAsm.exe.3fdff7c.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x28279:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x29354:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x28293:$s5: IClientLoggingHost
12.2.RegAsm.exe.3fdff7c.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.3fdff7c.2.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xf778:$x2: NanoCore.ClientPlugin 0x28244:$x2: NanoCore.ClientPlugin 0xf7ad:$x3: NanoCore.ClientPluginHost 0x28279:$x3: NanoCore.ClientPluginHost 0xf76c:$i2: IClientData 0x28238:$i2: IClientData 0xf78e:$i3: IClientNetwork 0x2825a:$i3: IClientNetwork 0xf79d:$i5: IClientDataHost 0x28269:$i5: IClientDataHost 0xf7c7:$i6: IClientLoggingHost 0x28293:$i6: IClientLoggingHost 0xf7da:$i7: IClientNetworkHost 0x282a6:$i7: IClientNetworkHost 0xf7ed:$i8: IClientUIHost 0x282b9:$i8: IClientUIHost 0xf7fb:$i9: IClientNameObjectCollection 0x282c7:$i9: IClientNameObjectCollection 0xf817:$i10: IClientReadOnlyNameObjectCollection 0x282e3:$i10: IClientReadOnlyNameObjectCollection 0xf56a:$s1: ClientPlugin
Click to see the 88 entries

Sigma Signatures

AV Detection

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ProcessId: 5596, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

E-Banking Fraud

Sigma detected: NanoCore

Source: File created

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe, ProcessId: 5844, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ople.exe.vbs

Stealing of Sensitive Information

Sigma detected: NanoCore

Source: File created

Remote Access Functionality

Sigma detected: NanoCore

Source: File created

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000C.00000002.319192237.0000000003F99000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "3b5167aa-3858-4f80-81dc-688e9982", "Group": "AtikuVSDino", "Domain1": "dinolachy.duckdns.org", "Domain2": "127.0.0.1", "Port": 5626, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Disable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Disable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Multi AV Scanner detection for submitted file

Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Virustotal: Detection: 72%	Perma Link
Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Metadefender: Detection: 41%	Perma Link
Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe	ReversingLabs: Detection: 73%

Antivirus / Scanner detection for submitted sample

Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe

Avira: detection malicious, Label: HEUR/AGEN.1213119

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe

ReversingLabs: Detection: 63%

Yara detected Nanocore RAT

Source: Yara match	File source: 3.2.RegAsm.exe.56a4629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.56a0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.3fdff7c.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.3fdb146.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.56a0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.3fe45a5.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.ople.exe.exe.2a00000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3ddff7c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3ddff7c.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3de45a5.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3ddb146.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.ople.exe.exe.2a00000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.3fdff7c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000000.296930304.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.513573670.00000000056A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.509119262.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.269192497.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.266056234.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.510200651.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.319192237.0000000003F99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.318213068.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.511424469.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.318967216.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.301093367.0000000002A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe PID: 5844, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ople.exe.exe PID: 1796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1428, type: MEMORYSTR

Machine Learning detection for sample

Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe

Joe Sandbox ML: detected

Source: 3.2.RegAsm.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 3.0.RegAsm.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 3.2.RegAsm.exe.56a0000.6.unpack	Avira: Label: TR/NanoCore.fadte
Source: 12.2.RegAsm.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.0.RegAsm.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wntdll.pdbUGP source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe, 00000000.00000003.255855415.0000000002C20000.00000004.00001000.00020000.00000000.sdmp, 692BB93169319EBA2F556174D781A8636D610A67E6838.exe, 00000000.00000003.255315849.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, ople.exe.exe, 00000007.00000003.293078354.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, ople.exe.exe, 00000007.00000003.291812090.0000000002E50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe, 00000000.00000003.255855415.0000000002C20000.00000004.00001000.00020000.00000000.sdmp, 692BB93169319EBA2F556174D781A8636D610A67E6838.exe, 00000000.00000003.255315849.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, ople.exe.exe, 00000007.00000003.293078354.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, ople.exe.exe, 00000007.00000003.291812090.0000000002E50000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Code function: 0_2_002651DA FindFirstFileExA,		0_2_002651DA
Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Code function: 7_2_00AB51DA FindFirstFileExA,		7_2_00AB51DA

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: dinolachy.duckdns.org
Source: Malware configuration extractor	URLs: 127.0.0.1

Uses dynamic DNS services

Source: unknown

DNS query: name: dinolachy.duckdns.org

Source: Joe Sandbox View

ASN Name: WOWUS WOWUS

Source: Joe Sandbox View	IP Address: 192.169.69.25 192.169.69.25
Source: Joe Sandbox View	IP Address: 192.169.69.25 192.169.69.25

Source: unknown

DNS traffic detected: queries for: dinolachy.duckdns.org

Source: RegAsm.exe, 00000003.00000002.511424469.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud

Yara detected Nanocore RAT

Source: Yara match	File source: 3.2.RegAsm.exe.56a4629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.56a0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.3fdff7c.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.3fdb146.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.56a0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.3fe45a5.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.ople.exe.exe.2a00000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3ddff7c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3ddff7c.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3de45a5.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3ddb146.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.ople.exe.exe.2a00000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.3fdff7c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000000.296930304.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.513573670.00000000056A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.509119262.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.269192497.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.266056234.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.510200651.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.319192237.0000000003F99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.318213068.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.511424469.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.318967216.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.301093367.0000000002A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe PID: 5844, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ople.exe.exe PID: 1796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1428, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.RegAsm.exe.56a4629.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.2.RegAsm.exe.56a4629.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 12.2.RegAsm.exe.2ffb670.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.2ffb670.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 3.2.RegAsm.exe.56a0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.2.RegAsm.exe.56a0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 3.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 3.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.3fdff7c.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.3fdff7c.2.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 3.2.RegAsm.exe.2dc5cb4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 12.2.RegAsm.exe.3fdb146.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.3fdb146.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 12.2.RegAsm.exe.3fdb146.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 3.2.RegAsm.exe.56a0000.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.2.RegAsm.exe.56a0000.6.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.3fe45a5.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.3fe45a5.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 7.2.ople.exe.exe.2a00000.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 7.2.ople.exe.exe.2a00000.2.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 7.2.ople.exe.exe.2a00000.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 3.2.RegAsm.exe.3ddff7c.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.2.RegAsm.exe.3ddff7c.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 3.2.RegAsm.exe.3ddff7c.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.2.RegAsm.exe.3ddff7c.3.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 3.2.RegAsm.exe.3de45a5.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.2.RegAsm.exe.3de45a5.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 3.2.RegAsm.exe.3ddb146.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.2.RegAsm.exe.3ddb146.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 3.2.RegAsm.exe.3ddb146.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 3.2.RegAsm.exe.5650000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.2.RegAsm.exe.5650000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 7.2.ople.exe.exe.2a00000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 7.2.ople.exe.exe.2a00000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 7.2.ople.exe.exe.2a00000.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 12.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.3fdff7c.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.3fdff7c.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0000000C.00000000.296930304.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000000.296930304.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000003.00000002.513573670.00000000056A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000003.00000002.513573670.00000000056A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects NanoCore Author: ditekSHen
Source: 00000003.00000002.509119262.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000003.00000002.509119262.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.269192497.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.269192497.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects NanoCore Author: ditekSHen
Source: 00000000.00000002.269192497.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000003.00000000.266056234.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000003.00000000.266056234.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.319192237.0000000003F99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000003.00000002.513552281.0000000005650000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000003.00000002.513552281.0000000005650000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0000000C.00000002.318213068.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.318213068.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000003.00000002.511424469.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.318967216.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000007.00000002.301093367.0000000002A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000007.00000002.301093367.0000000002A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects NanoCore Author: ditekSHen
Source: 00000007.00000002.301093367.0000000002A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe PID: 5844, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe PID: 5844, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: RegAsm.exe PID: 5596, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: RegAsm.exe PID: 5596, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: ople.exe.exe PID: 1796, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: ople.exe.exe PID: 1796, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: RegAsm.exe PID: 1428, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: RegAsm.exe PID: 1428, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 3.2.RegAsm.exe.56a4629.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.2.RegAsm.exe.56a4629.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.2.RegAsm.exe.56a4629.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 12.2.RegAsm.exe.2ffb670.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.2ffb670.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.RegAsm.exe.2ffb670.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 3.2.RegAsm.exe.56a0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.2.RegAsm.exe.56a0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.2.RegAsm.exe.56a0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 3.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 3.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.3fdff7c.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.3fdff7c.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.RegAsm.exe.3fdff7c.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 3.2.RegAsm.exe.2dc5cb4.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 12.2.RegAsm.exe.3fdb146.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.3fdb146.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.RegAsm.exe.3fdb146.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 12.2.RegAsm.exe.3fdb146.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 3.2.RegAsm.exe.56a0000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.2.RegAsm.exe.56a0000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.2.RegAsm.exe.56a0000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.3fe45a5.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.3fe45a5.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.RegAsm.exe.3fe45a5.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 7.2.ople.exe.exe.2a00000.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 7.2.ople.exe.exe.2a00000.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 7.2.ople.exe.exe.2a00000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 7.2.ople.exe.exe.2a00000.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 3.2.RegAsm.exe.3ddff7c.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.2.RegAsm.exe.3ddff7c.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.2.RegAsm.exe.3ddff7c.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 3.2.RegAsm.exe.3ddff7c.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.2.RegAsm.exe.3ddff7c.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.2.RegAsm.exe.3ddff7c.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 3.2.RegAsm.exe.3de45a5.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.2.RegAsm.exe.3de45a5.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.2.RegAsm.exe.3de45a5.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 3.2.RegAsm.exe.3ddb146.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.2.RegAsm.exe.3ddb146.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.2.RegAsm.exe.3ddb146.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 3.2.RegAsm.exe.3ddb146.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 3.2.RegAsm.exe.5650000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.2.RegAsm.exe.5650000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.2.RegAsm.exe.5650000.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 7.2.ople.exe.exe.2a00000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 7.2.ople.exe.exe.2a00000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 7.2.ople.exe.exe.2a00000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 7.2.ople.exe.exe.2a00000.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 12.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.3fdff7c.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.3fdff7c.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.RegAsm.exe.3fdff7c.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0000000C.00000000.296930304.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000000.296930304.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000003.00000002.513573670.00000000056A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000003.00000002.513573670.00000000056A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000003.00000002.513573670.00000000056A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000003.00000002.509119262.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000003.00000002.509119262.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.269192497.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.269192497.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000002.269192497.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000000.00000002.269192497.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000003.00000000.266056234.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000003.00000000.266056234.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.319192237.0000000003F99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000003.00000002.513552281.0000000005650000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000003.00000002.513552281.0000000005650000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000003.00000002.513552281.0000000005650000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0000000C.00000002.318213068.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.318213068.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000003.00000002.511424469.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.318967216.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000007.00000002.301093367.0000000002A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000007.00000002.301093367.0000000002A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000007.00000002.301093367.0000000002A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000007.00000002.301093367.0000000002A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe PID: 5844, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe PID: 5844, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: RegAsm.exe PID: 5596, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: RegAsm.exe PID: 5596, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: ople.exe.exe PID: 1796, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: ople.exe.exe PID: 1796, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: RegAsm.exe PID: 1428, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: RegAsm.exe PID: 1428, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Code function: 0_2_00261000	0_2_00261000
Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Code function: 0_2_0026B735	0_2_0026B735
Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Code function: 0_2_00D04515	0_2_00D04515
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0528E471	3_2_0528E471
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0528E480	3_2_0528E480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0528BBD4	3_2_0528BBD4
Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Code function: 7_2_00AB1000	7_2_00AB1000
Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Code function: 7_2_00ABB735	7_2_00ABB735
Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Code function: 7_2_010D4515	7_2_010D4515

Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Binary or memory string: OriginalFilename vs 692BB93169319EBA2F556174D781A8636D610A67E6838.exe
Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe, 00000000.00000003.261116621.0000000002BB6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 692BB93169319EBA2F556174D781A8636D610A67E6838.exe
Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe, 00000000.00000003.256211245.0000000002D3F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 692BB93169319EBA2F556174D781A8636D610A67E6838.exe
Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe, 00000000.00000002.269032372.0000000000C90000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunobservant.exe6 vs 692BB93169319EBA2F556174D781A8636D610A67E6838.exe
Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe, 00000000.00000000.242599852.0000000000275000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameunobservant.exe6 vs 692BB93169319EBA2F556174D781A8636D610A67E6838.exe
Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Binary or memory string: OriginalFilenameunobservant.exe6 vs 692BB93169319EBA2F556174D781A8636D610A67E6838.exe

Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ople.exe.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll			Jump to behavior

Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Virustotal: Detection: 72%
Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Metadefender: Detection: 41%
Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe	ReversingLabs: Detection: 73%

Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe

File read: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe

Jump to behavior

Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe "C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe"
Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ople.exe.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe C:\Users\user\AppData\Roaming\etwa\ople.exe.exe
Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\user\AppData\Roaming\etwa\ople.exe.exe
Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe

File created: C:\Users\user\AppData\Roaming\etwa

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@10/4@12/2

Source: 12.0.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 12.0.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 12.2.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 12.2.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3.2.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 3.2.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3.0.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 3.0.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1720:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{3b5167aa-3858-4f80-81dc-688e9982fe68}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6076:120:WilError_01

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ople.exe.vbs"

Source: 3.2.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.2.RegAsm.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.2.RegAsm.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 3.0.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.0.RegAsm.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.0.RegAsm.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 12.2.RegAsm.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 12.2.RegAsm.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe, 00000000.00000003.255855415.0000000002C20000.00000004.00001000.00020000.00000000.sdmp, 692BB93169319EBA2F556174D781A8636D610A67E6838.exe, 00000000.00000003.255315849.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, ople.exe.exe, 00000007.00000003.293078354.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, ople.exe.exe, 00000007.00000003.291812090.0000000002E50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe, 00000000.00000003.255855415.0000000002C20000.00000004.00001000.00020000.00000000.sdmp, 692BB93169319EBA2F556174D781A8636D610A67E6838.exe, 00000000.00000003.255315849.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, ople.exe.exe, 00000007.00000003.293078354.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, ople.exe.exe, 00000007.00000003.291812090.0000000002E50000.00000004.00001000.00020000.00000000.sdmp

Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

.NET source code contains potential unpacker

Source: 3.2.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.2.RegAsm.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.RegAsm.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.2.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.2.RegAsm.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.0.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.0.RegAsm.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Code function: 0_2_002627F6 push ecx; ret		0_2_00262809
Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Code function: 7_2_00AB27F6 push ecx; ret		7_2_00AB2809

Source: 3.2.RegAsm.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 3.2.RegAsm.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 3.0.RegAsm.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 3.0.RegAsm.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 12.2.RegAsm.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 12.2.RegAsm.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 12.0.RegAsm.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 12.0.RegAsm.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe

File created: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe

Jump to dropped file

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ople.exe.vbs

Jump to dropped file

Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ople.exe.vbs

Jump to behavior

Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ople.exe.vbs

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: icon (4).png

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4368	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe TID: 5928	Thread sleep time: -31025s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6332	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 6505	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 2973	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: foregroundWindowGot 1009	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Code function: 0_2_002651DA FindFirstFileExA,		0_2_002651DA
Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Code function: 7_2_00AB51DA FindFirstFileExA,		7_2_00AB51DA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Thread delayed: delay time: 31025	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RegAsm.exe, 00000003.00000002.510037415.0000000001195000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll/&3OH,

Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe

Code function: 0_2_00262598 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00262598

Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe

Code function: 0_2_00267394 GetProcessHeap,

0_2_00267394

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Code function: 0_2_00263E41 mov eax, dword ptr fs:[00000030h]	0_2_00263E41
Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Code function: 0_2_00D04405 mov eax, dword ptr fs:[00000030h]	0_2_00D04405
Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Code function: 0_2_00D04135 mov edx, dword ptr fs:[00000030h]	0_2_00D04135
Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Code function: 0_2_00D043A5 mov eax, dword ptr fs:[00000030h]	0_2_00D043A5
Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Code function: 7_2_00AB3E41 mov eax, dword ptr fs:[00000030h]	7_2_00AB3E41
Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Code function: 7_2_010D4135 mov edx, dword ptr fs:[00000030h]	7_2_010D4135
Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Code function: 7_2_010D4405 mov eax, dword ptr fs:[00000030h]	7_2_010D4405
Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Code function: 7_2_010D43A5 mov eax, dword ptr fs:[00000030h]	7_2_010D43A5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Code function: 0_2_002626FA SetUnhandledExceptionFilter,	0_2_002626FA
Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Code function: 0_2_00262598 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00262598
Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Code function: 0_2_00264D99 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00264D99
Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Code function: 0_2_002629CC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_002629CC
Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Code function: 7_2_00AB26FA SetUnhandledExceptionFilter,	7_2_00AB26FA
Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Code function: 7_2_00AB4D99 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00AB4D99
Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Code function: 7_2_00AB2598 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00AB2598
Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Code function: 7_2_00AB29CC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00AB29CC

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Section loaded: unknown target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Section loaded: unknown target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe protection: execute and read and write			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: D72008			Jump to behavior
Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: F1E008			Jump to behavior

Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	Jump to behavior

Source: RegAsm.exe, 00000003.00000002.510432918.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.510200651.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.511284047.00000000031D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managerh
Source: RegAsm.exe, 00000003.00000002.510432918.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.510200651.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.514013008.0000000006D3E000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RegAsm.exe, 00000003.00000002.510432918.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.510200651.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.511284047.00000000031D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerL
Source: RegAsm.exe, 00000003.00000002.510052393.00000000012AD000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: Program Manager h
Source: RegAsm.exe, 00000003.00000002.510432918.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.511284047.00000000031D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managerx
Source: RegAsm.exe, 00000003.00000002.513862048.00000000062BD000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: 'lProgram Manager

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe

Code function: 0_2_0026280B cpuid

0_2_0026280B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe

Code function: 0_2_00262484 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00262484

Stealing of Sensitive Information

Yara detected Nanocore RAT

Source: Yara match	File source: 3.2.RegAsm.exe.56a4629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.56a0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.3fdff7c.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.3fdb146.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.56a0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.3fe45a5.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.ople.exe.exe.2a00000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3ddff7c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3ddff7c.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3de45a5.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3ddb146.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.ople.exe.exe.2a00000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.3fdff7c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000000.296930304.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.513573670.00000000056A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.509119262.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.269192497.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.266056234.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.510200651.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.319192237.0000000003F99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.318213068.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.511424469.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.318967216.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.301093367.0000000002A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe PID: 5844, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ople.exe.exe PID: 1796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1428, type: MEMORYSTR

Remote Access Functionality

Detected Nanocore Rat

Source: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe, 00000000.00000002.269192497.0000000000D80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 00000003.00000002.509119262.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 00000003.00000002.510200651.0000000002D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 00000003.00000002.510200651.0000000002D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: RegAsm.exe, 00000003.00000002.511424469.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 00000003.00000002.511424469.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: ople.exe.exe, 00000007.00000002.301093367.0000000002A00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 0000000C.00000000.296930304.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 0000000C.00000002.319192237.0000000003F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 0000000C.00000002.319192237.0000000003F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: RegAsm.exe, 0000000C.00000002.318967216.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 0000000C.00000002.318967216.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll

Yara detected Nanocore RAT

Source: Yara match	File source: 3.2.RegAsm.exe.56a4629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.56a0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.3fdff7c.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.3fdb146.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.56a0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.3fe45a5.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.ople.exe.exe.2a00000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3ddff7c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3ddff7c.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3de45a5.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3ddb146.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.d80000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.ople.exe.exe.2a00000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.3fdff7c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000000.296930304.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.513573670.00000000056A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.509119262.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.269192497.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.266056234.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.510200651.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.319192237.0000000003F99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.318213068.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.511424469.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.318967216.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.301093367.0000000002A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 692BB93169319EBA2F556174D781A8636D610A67E6838.exe PID: 5844, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ople.exe.exe PID: 1796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1428, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	111 Scripting	2 Registry Run Keys / Startup Folder	212 Process Injection	11 Masquerading	11 Input Capture	1 System Time Discovery	Remote Services	11 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	2 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	Exfiltration Over Bluetooth	1 Remote Access Software	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	212 Process Injection	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	21 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	111 Scripting	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Obfuscated Files or Information	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	11 Software Packing	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 DLL Side-Loading	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
692BB93169319EBA2F556174D781A8636D610A67E6838.exe	72%	Virustotal		Browse
692BB93169319EBA2F556174D781A8636D610A67E6838.exe	41%	Metadefender		Browse
692BB93169319EBA2F556174D781A8636D610A67E6838.exe	73%	ReversingLabs	Win32.Trojan.AgentTesla
692BB93169319EBA2F556174D781A8636D610A67E6838.exe	100%	Avira	HEUR/AGEN.1213119
692BB93169319EBA2F556174D781A8636D610A67E6838.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	100%	Avira	HEUR/AGEN.1213119
C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\etwa\ople.exe.exe	63%	ReversingLabs	Win32.Trojan.AgentTesla

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.2.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.260000.0.unpack	100%	Avira	HEUR/AGEN.1213119	Download File
3.2.RegAsm.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
3.0.RegAsm.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
7.0.ople.exe.exe.ab0000.0.unpack	100%	Avira	HEUR/AGEN.1213119	Download File
3.2.RegAsm.exe.56a0000.6.unpack	100%	Avira	TR/NanoCore.fadte	Download File
0.0.692BB93169319EBA2F556174D781A8636D610A67E6838.exe.260000.0.unpack	100%	Avira	HEUR/AGEN.1213119	Download File
7.2.ople.exe.exe.ab0000.0.unpack	100%	Avira	HEUR/AGEN.1213119	Download File
12.2.RegAsm.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.0.RegAsm.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File

Domains

Source	Detection	Scanner	Label	Link
dinolachy.duckdns.org	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
127.0.0.1	1%	Virustotal		Browse
127.0.0.1	0%	Avira URL Cloud	safe
dinolachy.duckdns.org	1%	Virustotal		Browse
dinolachy.duckdns.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dinolachy.duckdns.org	192.169.69.25	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
127.0.0.1	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
dinolachy.duckdns.org	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.169.69.25	dinolachy.duckdns.org	United States		23033	WOWUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	629870
Start date and time: 19/05/202205:18:10	2022-05-19 05:18:10 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	692BB93169319EBA2F556174D781A8636D610A67E6838.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@10/4@12/2
EGA Information:	Successful, ratio: 75%
HDC Information:	Successful, ratio: 87.3% (good quality ratio 79.3%) Quality average: 77.4% Quality standard deviation: 31.9%
HCA Information:	Successful, ratio: 100% Number of executed functions: 36 Number of non-executed functions: 46
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, fs.microsoft.com, store-images.s-microsoft.com, login.live.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Execution Graph export aborted for target RegAsm.exe, PID 1428 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtProtectVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:19:25	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ople.exe.vbs
05:19:40	API Interceptor	1x Sleep call for process: ople.exe.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
192.169.69.25	2AE575F006FC418C72A55EC5FDC26BC821AA3929114EE.exe	Get hash	malicious	Browse	http://192.169.69.25/fakeurl.htm
	1F7E9C6AED2B8CB929E3677818BD2B72142254E17F790.exe	Get hash	malicious	Browse	strserver1.duckdns.org:8001/is-ready
	F4yQKL3fUH.exe	Get hash	malicious	Browse	alphaputin.duckdns.org/og/charly.bin
	orCJlXSGOG.exe	Get hash	malicious	Browse	alphaputin.duckdns.org/og/charly.bin
	PO20171118-COGRAL SPA.jar	Get hash	malicious	Browse	pluginsrv1.duckdns.org:7756/is-ready
	New Order_R4.jar	Get hash	malicious	Browse	pluginsrv1.duckdns.org:7756/is-ready
	10FCF8DA6000E34F9E8B8B173B6F8A65B6128E2422DB5.exe	Get hash	malicious	Browse	http://192.169.69.25/fakeurl.htm
	66D9612BA9CDE67EDEA09F3482459F3BFE03FAAA13EAD.exe	Get hash	malicious	Browse	ipvhosted.duckdns.org/rmarch/fre.php
	ttmPnejtED.js	Get hash	malicious	Browse	pluginsrv.duckdns.org:7744/is-ready
	New Order.xlsx	Get hash	malicious	Browse	systemserverrootmapforfiletrn.duckdns.org/explorer/black.exe
	Your Transport Plan has Changed - Maersk.xlsx	Get hash	malicious	Browse	covidinternationalspreadsoomuchtruehead.duckdns.org/covid/blk.exe
	XQqVczq7eQ.exe	Get hash	malicious	Browse	wetransferfax.duckdns.org/sftp.exe
	http://office365update.duckdns.org	Get hash	malicious	Browse	office365update.duckdns.org/
	TUdme7rF2G.rtf	Get hash	malicious	Browse	wsdykungcommunicationtarisupliermg55gms.duckdns.org/kungdoc/winlog.exe
	http://communicationideadedicatedserversystem.duckdns.org/bns/vbc.exe	Get hash	malicious	Browse	communicationideadedicatedserversystem.duckdns.org/bns/vbc.exe
	doc04483720200602121810.xlsx	Get hash	malicious	Browse	honeysposecurityfileexchangeservice.duckdns.org/org/vbc.exe
	doc04483720200602121810.xlsx	Get hash	malicious	Browse	honeysposecurityfileexchangeservice.duckdns.org/org/vbc.exe
	BBVA-Confirming Facturas Pagadas al Vencimiento.xlsx	Get hash	malicious	Browse	mkpksb2overhypetheykillppelforlifehelgg.duckdns.org/mkpk2doc/regasm.exe
	VqtnFLslNj_Purchase Order.vbs	Get hash	malicious	Browse	onyeeze.duckdns.org:5000/is-ready
	1.bin.js	Get hash	malicious	Browse	unknownsoft.duckdns.org:7755/is-ready

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
WOWUS	meihao.sh4	Get hash	malicious	Browse	216.176.191.230
	yM7xvqb6OL.exe	Get hash	malicious	Browse	192.169.69.26
	9BBAF063C0F092D248C755107F8BA10DFF6739A805F95.exe	Get hash	malicious	Browse	192.169.69.26
	NzDRLmVUQh.exe	Get hash	malicious	Browse	192.169.69.26
	Pm5WshbKaz.exe	Get hash	malicious	Browse	192.169.69.25
	SecuriteInfo.com.Trojan.AutoIt.833.17587.exe	Get hash	malicious	Browse	192.169.69.25
	https://www.portablefreeware.com/?id=693	Get hash	malicious	Browse	23.138.32.193
	F60FA93B7851B48E141C57BAC40D8846BE4B3FF3A9EC6.exe	Get hash	malicious	Browse	192.169.69.25
	FA57F7CBA4406D815947A3A2481842F6B0E1C6D82CB3E.exe	Get hash	malicious	Browse	192.169.69.25
	i586-20220412-0247	Get hash	malicious	Browse	208.115.121.73
	6C64CD522D7E6F3C0B6F0116271CDE81E35213AD4A360.exe	Get hash	malicious	Browse	192.169.69.26
	fhGFK34M3e.exe	Get hash	malicious	Browse	192.169.69.25
	5058533554DC63236F5945969A20574DF2E2B44982553.exe	Get hash	malicious	Browse	192.169.69.25
	2409D1664AD7CBBE19B0991D4BF92303DDA0DE873508E.exe	Get hash	malicious	Browse	192.169.69.25
	AQMWbVdilD	Get hash	malicious	Browse	208.87.97.14
	microsoft.hta	Get hash	malicious	Browse	192.169.69.26
	arm	Get hash	malicious	Browse	208.115.121.78
	54C1F3123187554C4637A2D0AB80ABFD06A27D61BB72D.exe	Get hash	malicious	Browse	192.169.69.25
	HHq5dFupRq.exe	Get hash	malicious	Browse	192.169.69.25
	5A8A49E14822787A453E28BB2F0782B91E2A1C7C00720.exe	Get hash	malicious	Browse	192.169.69.25

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
MD5:	69206D3AF7D6EFD08F4B4726998856D3
SHA1:	E778D4BF781F7712163CF5E2F5E7C15953E484CF
SHA-256:	A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
SHA-512:	CD270C3DF75E548C9B0727F13F44F45262BD474336E89AAEBE56FABFE8076CD4638F88D3C0837B67C2EB3C54055679B07E4212FB3FEDBF88C015EB5DBBCD7FF8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:Ll:Ll
MD5:	B0D520A58AFBB2268CEB35E278A4EB33
SHA1:	15B41F5F9DC6456482F03330B5450F3C0784F9A3
SHA-256:	D9BE84474B3876A55B0D1BD3971001A9F50C7F3039CEE9C09209C74E9C2BD316
SHA-512:	7E91CC1295EA5B68E151795ED5D6EC93105546405C02C56DC4A459A47865610D164D40635A0E01F91C4B4F63C353BEA0E7947DD4236BD189231235D0B66C605B
Malicious:	true
Reputation:	low
Preview:	f..dF9.H

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ople.exe.vbs

Download File

Process:	C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe
File Type:	data
Category:	dropped
Size (bytes):	304
Entropy (8bit):	3.410548573208775
Encrypted:	false
SSDEEP:	6:xPW+YR4lAINl1fYlfm3OOQd4l1RIlRKUEZglJPZ60mlRA6DA6nMWl1fYlxCv:xQ4lAN0+vcIlRKMJelRRFSji
MD5:	36615C3E591704897CAC5551FFD58553
SHA1:	ABDC43118D030E3716FA302B5E6B5AA6D7FD3C72
SHA-256:	CF648418AC15FCD4CD81C2AD4E289F149B52FCA8A6198F39EFBE52D71C602B04
SHA-512:	ACE72BF54585FD266CCD8732146C8D1BCE5E4731EC44C18A005759622C938D34C435BED0EAC1EEECCAC732EC1C125566862748B101383BAE8D2C16B45525F1D7
Malicious:	true
Reputation:	low
Preview:	O.n. .E.r.r.o.r. .R.e.s.u.m.e. .N.e.x.t...S.e.t. .S.h.e.l.l.V.a.r. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".W.S.c.r.i.p.t...S.h.e.l.l.".)...S.h.e.l.l.V.a.r...E.x.e.c.(.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.e.t.w.a.\.o.p.l.e...e.x.e...e.x.e.".)...S.e.t.S.h.e.l.l.V.a.r. .=.N.o.t.h.i.n.g.

C:\Users\user\AppData\Roaming\etwa\ople.exe.exe

Download File

Process:	C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	409170
Entropy (8bit):	7.3076840802364
Encrypted:	false
SSDEEP:	6144:PuWieVAGW6qGWdFlnHCDFrNAiX1AS0mrSMnBX21Cjna06R8fpR4Qq3fS:PVl+nHAZ19RrSMdd6qFyS
MD5:	CA51A0A9E3EF192B26D9818DC4EC5FF0
SHA1:	7D56B8436D501E6CDA892E61FA29BEEEDF65DA0E
SHA-256:	D0250A0B19CC73D8E6A4C97EA7935BA06BA70DD1FB9EEA8C44AEA396DD792A6E
SHA-512:	1997CFD7D25FFE7BB59A9C8A6F7E009D4B693FF4019B0E6698CEFE9FEBD393848C5F4DE9DD3025354E4059EAAD0B29CE2D3B141ED4586B1C7C8DB76303582F15
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f...........8h.....8h......8h.....!......!......!......8h............9......9............9......Rich....................PE..L......]............................."............@.......................................@..................................!.......`..........................8...P...............................p...@............................................text...G........................... ..`.rdata..(Z.......\..................@..@.data........0....... ..............@....gfids.......P.......(..............@..@.rsrc........`.......*..............@..@.reloc..8...........................@..B........................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.307692888739697
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	692BB93169319EBA2F556174D781A8636D610A67E6838.exe
File size:	409169
MD5:	a93162e62b49a591e0d481e030ffc9ea
SHA1:	b0c48a0fc418977051bea837c16aa7928f654da7
SHA256:	692bb93169319eba2f556174d781a8636d610a67e6838e19300a8a2454cd8b2b
SHA512:	2f5c74acd25c9a7fae88736e25e526155d09d5c1c0f66c833c8e6e0c3dfd74fd7d53438089d5de5a07fd2935a78a27a13d3d6ddeef020d42ecafb38497926c25
SSDEEP:	6144:PuWieVAGW6qGWdFlnHCDFrNAiX1AS0mrSMnBX21Cjna06R8fpR4Qq3fm:PVl+nHAZ19RrSMdd6qFym
TLSH:	E3949D52F29698A5E426B1F8A8359D32122B7D9558348A0B31BB312D4E733D3DC77E0F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........f.............8h......8h......8h......!.......!.......!.......8h..............9.......9...............9.......Rich...........

File Icon


Icon Hash:	4552445c54463289

Static PE Info

General

Entrypoint:	0x402212
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5DDBF1DC [Mon Nov 25 15:23:08 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	695a88385098872b689faf1f231ef8ea

Entrypoint Preview

Instruction
call 00007FBE38700972h
jmp 00007FBE3870058Dh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007FBE3870071Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007FBE3870070Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007FBE3870070Eh
add edx, 28h
cmp edx, esi
jne 00007FBE387006ECh
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007FBE387006FBh
call 00007FBE38700E4Fh
test eax, eax
jne 00007FBE38700705h
xor al, al
ret
mov eax, dword ptr fs:[00000018h]
push esi
mov esi, 00413794h
mov edx, dword ptr [eax+04h]
jmp 00007FBE38700706h
cmp edx, eax
je 00007FBE38700712h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007FBE387006F2h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007FBE38700709h
mov byte ptr [004137B0h], 00000001h
call 00007FBE38700C66h
call 00007FBE387010ECh
test al, al
jne 00007FBE38700706h
xor al, al
pop ebp
ret
call 00007FBE38702A00h
test al, al
jne 00007FBE3870070Ch
push 00000000h
call 00007FBE387010FDh
pop ecx
jmp 00007FBE387006EBh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0Ch
push esi
mov esi, dword ptr [ebp+08h]
test esi, esi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x12114	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16000	0x18b90	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2f000	0xe38	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x11a50	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x11a70	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xd000	0x1b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xbf47	0xc000	False	0.579060872396	data	6.64391063708	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0xd000	0x5a28	0x5c00	False	0.417246942935	data	4.87173398485	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x13000	0x11b8	0x800	False	0.17236328125	DOS executable (block device driver \277DN)	2.05377921789	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.gfids	0x15000	0xac	0x200	False	0.271484375	data	1.40558316368	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x16000	0x18b90	0x18c00	False	0.210611979167	data	4.88160389879	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2f000	0xe38	0x1000	False	0.744140625	data	6.17873004973	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x164b8	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x16920	0x10a8	data	English	United States
RT_ICON	0x179c8	0x25a8	data	English	United States
RT_ICON	0x19f70	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x1e198	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 33554431, next used block 33554431	English	United States
RT_GROUP_ICON	0x2e9c0	0x4c	data	English	United States
RT_VERSION	0x161f0	0x2c8	data	English	United States
RT_MANIFEST	0x2ea10	0x17d	XML 1.0 document text	English	United States

Imports

DLL	Import
KERNEL32.dll	VirtualProtect, GetConsoleWindow, CreateFileW, DecodePointer, WriteConsoleW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, FlushFileBuffers, HeapReAlloc, HeapSize, GetProcessHeap, GetStringTypeW, GetFileType, SetStdHandle, LCMapStringW, CompareStringW, SetEnvironmentVariableA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCPInfo, GetOEMCP, IsValidCodePage, FindNextFileA, FindFirstFileExA, FindClose, CloseHandle, HeapAlloc, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetModuleHandleW, GetCurrentProcess, TerminateProcess, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameA, MultiByteToWideChar, WideCharToMultiByte, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, GetACP, HeapFree, RaiseException
imagehlp.dll	UnDecorateSymbolName, SymGetSymFromAddr64
MAPI32.dll
USER32.dll	GetAncestor, SetWindowPos, ChangeMenuA, BroadcastSystemMessage, SubtractRect, IsDialogMessageA, CountClipboardFormats
mscms.dll	DeleteColorTransform, InstallColorProfileA, SetColorProfileHeader, GetPS2ColorRenderingIntent, SetColorProfileElementReference
WINSPOOL.DRV	EnumPrinterDataW, OpenPrinterA, EnumPrinterKeyA
ODBC32.dll
msi.dll

Version Infos

Description	Data
LegalCopyright	Copyright (C) land-born 2019
InternalName	cardsharper.exe
FileVersion	8.2.1.4
CompanyName	vanes
ProductName	aggeration
ProductVersion	7.6.0.2
FileDescription	spermary
OriginalFilename	unobservant.exe
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 19, 2022 05:19:35.391271114 CEST	49760	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:19:35.604505062 CEST	5626	49760	192.169.69.25	192.168.2.4
May 19, 2022 05:19:35.604670048 CEST	49760	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:19:35.661648035 CEST	49760	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:19:35.899727106 CEST	5626	49760	192.169.69.25	192.168.2.4
May 19, 2022 05:19:40.045200109 CEST	49761	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:19:40.334722042 CEST	5626	49761	192.169.69.25	192.168.2.4
May 19, 2022 05:19:40.334908962 CEST	49761	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:19:40.355438948 CEST	49761	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:19:40.629517078 CEST	5626	49761	192.169.69.25	192.168.2.4
May 19, 2022 05:19:44.675549030 CEST	49762	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:19:44.999265909 CEST	5626	49762	192.169.69.25	192.168.2.4
May 19, 2022 05:19:44.999759912 CEST	49762	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:19:45.004966021 CEST	49762	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:19:45.291423082 CEST	5626	49762	192.169.69.25	192.168.2.4
May 19, 2022 05:20:04.840961933 CEST	49774	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:20:05.154113054 CEST	5626	49774	192.169.69.25	192.168.2.4
May 19, 2022 05:20:05.154316902 CEST	49774	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:20:05.161387920 CEST	49774	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:20:05.464230061 CEST	5626	49774	192.169.69.25	192.168.2.4
May 19, 2022 05:20:09.601588964 CEST	49775	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:20:09.902873039 CEST	5626	49775	192.169.69.25	192.168.2.4
May 19, 2022 05:20:09.903219938 CEST	49775	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:20:09.904114008 CEST	49775	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:20:10.191227913 CEST	5626	49775	192.169.69.25	192.168.2.4
May 19, 2022 05:20:14.236185074 CEST	49776	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:20:14.530116081 CEST	5626	49776	192.169.69.25	192.168.2.4
May 19, 2022 05:20:14.530278921 CEST	49776	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:20:14.530742884 CEST	49776	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:20:14.815737009 CEST	5626	49776	192.169.69.25	192.168.2.4
May 19, 2022 05:20:34.964564085 CEST	49829	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:20:35.244076967 CEST	5626	49829	192.169.69.25	192.168.2.4
May 19, 2022 05:20:35.244360924 CEST	49829	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:20:35.251326084 CEST	49829	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:20:35.520592928 CEST	5626	49829	192.169.69.25	192.168.2.4
May 19, 2022 05:20:39.559667110 CEST	49837	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:20:39.872410059 CEST	5626	49837	192.169.69.25	192.168.2.4
May 19, 2022 05:20:39.872554064 CEST	49837	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:20:39.873094082 CEST	49837	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:20:40.164750099 CEST	5626	49837	192.169.69.25	192.168.2.4
May 19, 2022 05:20:44.291788101 CEST	49839	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:20:44.577816963 CEST	5626	49839	192.169.69.25	192.168.2.4
May 19, 2022 05:20:44.579777002 CEST	49839	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:20:44.602205038 CEST	49839	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:20:44.877954006 CEST	5626	49839	192.169.69.25	192.168.2.4
May 19, 2022 05:21:04.218692064 CEST	49866	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:21:04.455672026 CEST	5626	49866	192.169.69.25	192.168.2.4
May 19, 2022 05:21:04.455786943 CEST	49866	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:21:04.458276033 CEST	49866	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:21:04.747319937 CEST	5626	49866	192.169.69.25	192.168.2.4
May 19, 2022 05:21:08.868937969 CEST	49869	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:21:09.173266888 CEST	5626	49869	192.169.69.25	192.168.2.4
May 19, 2022 05:21:09.173451900 CEST	49869	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:21:09.174114943 CEST	49869	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:21:09.475833893 CEST	5626	49869	192.169.69.25	192.168.2.4
May 19, 2022 05:21:13.529231071 CEST	49871	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:21:13.753601074 CEST	5626	49871	192.169.69.25	192.168.2.4
May 19, 2022 05:21:13.753717899 CEST	49871	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:21:13.763097048 CEST	49871	5626	192.168.2.4	192.169.69.25
May 19, 2022 05:21:14.037683010 CEST	5626	49871	192.169.69.25	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 19, 2022 05:19:35.271678925 CEST	60506	53	192.168.2.4	8.8.8.8
May 19, 2022 05:19:35.380067110 CEST	53	60506	8.8.8.8	192.168.2.4
May 19, 2022 05:19:39.935419083 CEST	64277	53	192.168.2.4	8.8.8.8
May 19, 2022 05:19:40.044132948 CEST	53	64277	8.8.8.8	192.168.2.4
May 19, 2022 05:19:44.650464058 CEST	56076	53	192.168.2.4	8.8.8.8
May 19, 2022 05:19:44.667726994 CEST	53	56076	8.8.8.8	192.168.2.4
May 19, 2022 05:20:04.727262020 CEST	60381	53	192.168.2.4	8.8.8.8
May 19, 2022 05:20:04.837091923 CEST	53	60381	8.8.8.8	192.168.2.4
May 19, 2022 05:20:09.485280991 CEST	56509	53	192.168.2.4	8.8.8.8
May 19, 2022 05:20:09.593802929 CEST	53	56509	8.8.8.8	192.168.2.4
May 19, 2022 05:20:14.216454983 CEST	54069	53	192.168.2.4	8.8.8.8
May 19, 2022 05:20:14.234416008 CEST	53	54069	8.8.8.8	192.168.2.4
May 19, 2022 05:20:34.752480030 CEST	61497	53	192.168.2.4	8.8.8.8
May 19, 2022 05:20:34.861716032 CEST	53	61497	8.8.8.8	192.168.2.4
May 19, 2022 05:20:39.538358927 CEST	60418	53	192.168.2.4	8.8.8.8
May 19, 2022 05:20:39.558176041 CEST	53	60418	8.8.8.8	192.168.2.4
May 19, 2022 05:20:44.182333946 CEST	64259	53	192.168.2.4	8.8.8.8
May 19, 2022 05:20:44.290632010 CEST	53	64259	8.8.8.8	192.168.2.4
May 19, 2022 05:21:04.108495951 CEST	58715	53	192.168.2.4	8.8.8.8
May 19, 2022 05:21:04.217644930 CEST	53	58715	8.8.8.8	192.168.2.4
May 19, 2022 05:21:08.758953094 CEST	57816	53	192.168.2.4	8.8.8.8
May 19, 2022 05:21:08.867835999 CEST	53	57816	8.8.8.8	192.168.2.4
May 19, 2022 05:21:13.507783890 CEST	53916	53	192.168.2.4	8.8.8.8
May 19, 2022 05:21:13.527236938 CEST	53	53916	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 19, 2022 05:19:35.271678925 CEST	192.168.2.4	8.8.8.8	0x19ec	Standard query (0)	dinolachy.duckdns.org	A (IP address)	IN (0x0001)
May 19, 2022 05:19:39.935419083 CEST	192.168.2.4	8.8.8.8	0x5d07	Standard query (0)	dinolachy.duckdns.org	A (IP address)	IN (0x0001)
May 19, 2022 05:19:44.650464058 CEST	192.168.2.4	8.8.8.8	0x6fcf	Standard query (0)	dinolachy.duckdns.org	A (IP address)	IN (0x0001)
May 19, 2022 05:20:04.727262020 CEST	192.168.2.4	8.8.8.8	0xf60b	Standard query (0)	dinolachy.duckdns.org	A (IP address)	IN (0x0001)
May 19, 2022 05:20:09.485280991 CEST	192.168.2.4	8.8.8.8	0x474	Standard query (0)	dinolachy.duckdns.org	A (IP address)	IN (0x0001)
May 19, 2022 05:20:14.216454983 CEST	192.168.2.4	8.8.8.8	0x37a	Standard query (0)	dinolachy.duckdns.org	A (IP address)	IN (0x0001)
May 19, 2022 05:20:34.752480030 CEST	192.168.2.4	8.8.8.8	0xd39f	Standard query (0)	dinolachy.duckdns.org	A (IP address)	IN (0x0001)
May 19, 2022 05:20:39.538358927 CEST	192.168.2.4	8.8.8.8	0x6194	Standard query (0)	dinolachy.duckdns.org	A (IP address)	IN (0x0001)
May 19, 2022 05:20:44.182333946 CEST	192.168.2.4	8.8.8.8	0x4b2c	Standard query (0)	dinolachy.duckdns.org	A (IP address)	IN (0x0001)
May 19, 2022 05:21:04.108495951 CEST	192.168.2.4	8.8.8.8	0x30ea	Standard query (0)	dinolachy.duckdns.org	A (IP address)	IN (0x0001)
May 19, 2022 05:21:08.758953094 CEST	192.168.2.4	8.8.8.8	0xa247	Standard query (0)	dinolachy.duckdns.org	A (IP address)	IN (0x0001)
May 19, 2022 05:21:13.507783890 CEST	192.168.2.4	8.8.8.8	0x5cde	Standard query (0)	dinolachy.duckdns.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
May 19, 2022 05:19:35.380067110 CEST	8.8.8.8	192.168.2.4	0x19ec	No error (0)	dinolachy.duckdns.org	192.169.69.25	A (IP address)	IN (0x0001)
May 19, 2022 05:19:40.044132948 CEST	8.8.8.8	192.168.2.4	0x5d07	No error (0)	dinolachy.duckdns.org	192.169.69.25	A (IP address)	IN (0x0001)
May 19, 2022 05:19:44.667726994 CEST	8.8.8.8	192.168.2.4	0x6fcf	No error (0)	dinolachy.duckdns.org	192.169.69.25	A (IP address)	IN (0x0001)
May 19, 2022 05:20:04.837091923 CEST	8.8.8.8	192.168.2.4	0xf60b	No error (0)	dinolachy.duckdns.org	192.169.69.25	A (IP address)	IN (0x0001)
May 19, 2022 05:20:09.593802929 CEST	8.8.8.8	192.168.2.4	0x474	No error (0)	dinolachy.duckdns.org	192.169.69.25	A (IP address)	IN (0x0001)
May 19, 2022 05:20:14.234416008 CEST	8.8.8.8	192.168.2.4	0x37a	No error (0)	dinolachy.duckdns.org	192.169.69.25	A (IP address)	IN (0x0001)
May 19, 2022 05:20:34.861716032 CEST	8.8.8.8	192.168.2.4	0xd39f	No error (0)	dinolachy.duckdns.org	192.169.69.25	A (IP address)	IN (0x0001)
May 19, 2022 05:20:39.558176041 CEST	8.8.8.8	192.168.2.4	0x6194	No error (0)	dinolachy.duckdns.org	192.169.69.25	A (IP address)	IN (0x0001)
May 19, 2022 05:20:44.290632010 CEST	8.8.8.8	192.168.2.4	0x4b2c	No error (0)	dinolachy.duckdns.org	192.169.69.25	A (IP address)	IN (0x0001)
May 19, 2022 05:21:04.217644930 CEST	8.8.8.8	192.168.2.4	0x30ea	No error (0)	dinolachy.duckdns.org	192.169.69.25	A (IP address)	IN (0x0001)
May 19, 2022 05:21:08.867835999 CEST	8.8.8.8	192.168.2.4	0xa247	No error (0)	dinolachy.duckdns.org	192.169.69.25	A (IP address)	IN (0x0001)
May 19, 2022 05:21:13.527236938 CEST	8.8.8.8	192.168.2.4	0x5cde	No error (0)	dinolachy.duckdns.org	192.169.69.25	A (IP address)	IN (0x0001)

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 692BB93169319EBA2F556174D781A8636D610A67E6838.exePID: 5844, Parent PID: 2092

General

Target ID:	0
Start time:	05:19:17
Start date:	19/05/2022
Path:	C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe"
Imagebase:	0x260000
File size:	409169 bytes
MD5 hash:	A93162E62B49A591E0D481E030FFC9EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.269192497.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000000.00000002.269192497.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.269192497.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000000.00000002.269192497.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: NanoCore, Description: unknown, Source: 00000000.00000002.269192497.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6076, Parent PID: 5844

General

Target ID:	1
Start time:	05:19:18
Start date:	19/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff647620000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: RegAsm.exePID: 5596, Parent PID: 5844

General

Target ID:	3
Start time:	05:19:25
Start date:	19/05/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\692BB93169319EBA2F556174D781A8636D610A67E6838.exe"
Imagebase:	0xa90000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000003.00000002.513573670.00000000056A0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000003.00000002.513573670.00000000056A0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000003.00000002.513573670.00000000056A0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000003.00000002.513573670.00000000056A0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000003.00000002.509119262.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000003.00000002.509119262.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000003.00000002.509119262.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000003.00000000.266056234.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000003.00000000.266056234.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000003.00000000.266056234.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000003.00000002.510200651.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000003.00000002.513552281.0000000005650000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000003.00000002.513552281.0000000005650000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000003.00000002.513552281.0000000005650000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000003.00000002.511424469.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000003.00000002.511424469.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: wscript.exePID: 2208, Parent PID: 3616

General

Target ID:	6
Start time:	05:19:35
Start date:	19/05/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ople.exe.vbs"
Imagebase:	0x7ff784990000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: ople.exe.exePID: 1796, Parent PID: 2208

General

Target ID:	7
Start time:	05:19:36
Start date:	19/05/2022
Path:	C:\Users\user\AppData\Roaming\etwa\ople.exe.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\etwa\ople.exe.exe
Imagebase:	0xab0000
File size:	409170 bytes
MD5 hash:	CA51A0A9E3EF192B26D9818DC4EC5FF0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000007.00000002.301093367.0000000002A00000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000007.00000002.301093367.0000000002A00000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000007.00000002.301093367.0000000002A00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000007.00000002.301093367.0000000002A00000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: NanoCore, Description: unknown, Source: 00000007.00000002.301093367.0000000002A00000.00000004.00001000.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 1720, Parent PID: 1796

General

Target ID:	8
Start time:	05:19:36
Start date:	19/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff647620000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: RegAsm.exePID: 1428, Parent PID: 1796

General

Target ID:	12
Start time:	05:19:40
Start date:	19/05/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\etwa\ople.exe.exe
Imagebase:	0xca0000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000000.296930304.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000000.296930304.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000000.296930304.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.319192237.0000000003F99000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.319192237.0000000003F99000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000002.318213068.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.318213068.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.318213068.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.318967216.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.318967216.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 692BB93169319EBA2F556174D781A8636D610A67E6838.exePID: 5844, Parent PID: 2092COMMON

Execution Graph

Execution Coverage:	22.9%
Dynamic/Decrypted Code Coverage:	15.6%
Signature Coverage:	2.6%
Total number of Nodes:	1973
Total number of Limit Nodes:	49

Executed Functions

Function 00261000 Relevance: 32.3, APIs: 3, Strings: 15, Instructions: 845
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000080), ref: 002616FA
SetWindowPos.USER32(00000000), ref: 00261701
VirtualProtect.KERNELBASE(32342DD0,000002E2,00000040,?), ref: 00261EE2

Strings

0852, xrefs: 0026148A
952, xrefs: 00261520
S=]2, xrefs: 00261606
99fd, xrefs: 00261661
s=, xrefs: 0026119C
99fd, xrefs: 002612DC
,52, xrefs: 002612F0
99cb, xrefs: 002614EE
99_1, xrefs: 0026149E
9S1Z, xrefs: 00261516
oS2Z, xrefs: 002614A8
M,=, xrefs: 002615C0
9obc, xrefs: 00261016
gJ0xZISNT1QdY, xrefs: 00261EF3
-9, xrefs: 002616F4

Memory Dump Source

Source File: 00000000.00000002.268673362.0000000000261000.00000020.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.268665443.0000000000260000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268687601.000000000026D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268696251.0000000000273000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268711075.0000000000275000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: Window$ConsoleProtectVirtual
String ID: s=$,52$-9$0852$952$99_1$99cb$99fd$99fd$9S1Z$9obc$S=]2$gJ0xZISNT1QdY$oS2Z$M,=
API String ID: 2778018546-69423270
Opcode ID: 74864227211106a3b77f37cab878b13b7fa1d5f96a3d637c62092114488ae3dd
Instruction ID: 804441e8564c106b41cd610dd3b247decf1c9d8717c3a8d3919b555ce14a4b21
Opcode Fuzzy Hash: 74864227211106a3b77f37cab878b13b7fa1d5f96a3d637c62092114488ae3dd
Instruction Fuzzy Hash: 8D7299B2B5435A8BEB60CFB9DDC938ABAB0F715300F4445B8D548EB785D7789A858F00

Uniqueness

Uniqueness Score: -1.00%

Function 002626FA Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E002626FA() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E00262706); // executed
				return _t1;
			}

0x002626ff
0x00262705

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00002706,00262097), ref: 002626FF

Memory Dump Source

Source File: 00000000.00000002.268673362.0000000000261000.00000020.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.268665443.0000000000260000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268687601.000000000026D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268696251.0000000000273000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268711075.0000000000275000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e8f09c4807e8781d514f37eb2fb4b0ae164b850d9c5a277ad9807b65e9ea380f
Instruction ID: 14f904f24e09a44563244aae23fdd1d2f679eb90983097f1245eff154fe88aa0
Opcode Fuzzy Hash: e8f09c4807e8781d514f37eb2fb4b0ae164b850d9c5a277ad9807b65e9ea380f
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00D01FB5 Relevance: 14.6, APIs: 9, Instructions: 1075
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00000002,00003000,00000004,E84126B8,388F3ADB), ref: 00D02E5B
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00D02E71
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00D02E87
VirtualAlloc.KERNELBASE(00000000,00000001,00003000,00000004), ref: 00D02E9B
VirtualAlloc.KERNELBASE(00000000,00000001,00003000,00000004), ref: 00D02EAF
VirtualAlloc.KERNELBASE(00000000,0000003C,00003000,00000004), ref: 00D02EC3
VirtualAlloc.KERNELBASE(00000000,00000001,00003000,00000004), ref: 00D02ED7
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00D02EED

Part of subcall function 00D046C5: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,00003000,VirtualAlloc,00003000,VirtualFree,00000000), ref: 00D04863

ExitProcess.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6B68C4C6), ref: 00D0332A

Memory Dump Source

Source File: 00000000.00000002.269168079.0000000000D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: AllocVirtual$ExitProcess
String ID:
API String ID: 2301755047-0
Opcode ID: c8ee65299836c68aca4ffeeb21d0863f818415c9a351e9db538496d913c3f3ce
Instruction ID: ac8bd54dad2658fb530f6a316e94d665f15dd09a927c0997731e48b21d1e8ff2
Opcode Fuzzy Hash: c8ee65299836c68aca4ffeeb21d0863f818415c9a351e9db538496d913c3f3ce
Instruction Fuzzy Hash: D7A23620A14658D6EB20DF60DC55BDE7236EF68700F1050E9A20DEB3E1E77A5F81CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00D046C5 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 212
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,00003000,VirtualAlloc,00003000,VirtualFree,00000000), ref: 00D04863

Strings

VirtualFree, xrefs: 00D0482F, 00D04832
VirtualAlloc, xrefs: 00D0483F, 00D04842
CallWindowProcW, xrefs: 00D0481B, 00D0481E
LoadLibraryW, xrefs: 00D0480B, 00D0480E

Memory Dump Source

Source File: 00000000.00000002.269168079.0000000000D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: AllocVirtual
String ID: CallWindowProcW$LoadLibraryW$VirtualAlloc$VirtualFree
API String ID: 4275171209-840194956
Opcode ID: db5a3faaeca2214f847324c64107c7e948738704fc90c88045da66bf3d03da6a
Instruction ID: 937e469ea7efb9c9847788d163f5de056484bab8793757d74943dfe30e2e4b9b
Opcode Fuzzy Hash: db5a3faaeca2214f847324c64107c7e948738704fc90c88045da66bf3d03da6a
Instruction Fuzzy Hash: E4A12A70D082C8DAEB11CBE8C448BEDBFB2AF25704F144199E1847B382D7BA5554CB76

Uniqueness

Uniqueness Score: -1.00%

Function 00D03345 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 00D03416
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00D0362D

Memory Dump Source

Source File: 00000000.00000002.269168079.0000000000D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: 1b514a202ce007281f84b9962a7ae5b6aa93391a19764c4e7429361d82933d36
Instruction ID: 08af23fe6aeb5e7b7c7c08f6ac17dbbc7221ddb7d8edcb2cd8062d94e2b7d7ea
Opcode Fuzzy Hash: 1b514a202ce007281f84b9962a7ae5b6aa93391a19764c4e7429361d82933d36
Instruction Fuzzy Hash: FEA10574E00208EBDB14CFD4C899BEEBBB9BF48304F248159E605BB2D0D7759A41CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00D01985 Relevance: 7.9, APIs: 5, Instructions: 416
processthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000001,00000000), ref: 00D01AD2
GetThreadContext.KERNELBASE(?,00010007), ref: 00D01AF3
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00D01B15

Memory Dump Source

Source File: 00000000.00000002.269168079.0000000000D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThread
String ID:
API String ID: 2411489757-0
Opcode ID: 9921dd2f7bf092e1c61bebf1fceb29305424721e60a52d569aa8cd8431c28301
Instruction ID: d1f58f8dbd91554bca306f56ab62f0f56f48c5a6d4e9e06bbd3fddbda8ffc669
Opcode Fuzzy Hash: 9921dd2f7bf092e1c61bebf1fceb29305424721e60a52d569aa8cd8431c28301
Instruction Fuzzy Hash: 6F021874A00208EBDB18CF98C985FEEB7B6FF48704F248158E619AB2C5D774E941CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00266A69 Relevance: 3.1, APIs: 2, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00266A69() {
				signed int _t20;
				signed int _t22;
				long _t23;
				signed int _t25;
				void* _t28;
				signed int _t31;
				void* _t33;

				_t31 = 0;
				do {
					_t20 = _t31 & 0x0000003f;
					_t33 = _t20 * 0x30 +  *((intOrPtr*)(0x273f60 + (_t31 >> 6) * 4));
					if( *(_t33 + 0x18) == 0xffffffff ||  *(_t33 + 0x18) == 0xfffffffe) {
						 *(_t33 + 0x28) = 0x81;
						_t22 = _t31;
						if(_t22 == 0) {
							_push(0xfffffff6);
						} else {
							if(_t22 == 1) {
								_push(0xfffffff5);
							} else {
								_push(0xfffffff4);
							}
						}
						_pop(_t23);
						_t28 = GetStdHandle(_t23);
						if(_t28 == 0xffffffff || _t28 == 0) {
							_t25 = 0;
						} else {
							_t25 = GetFileType(_t28); // executed
						}
						if(_t25 == 0) {
							 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000040;
							 *(_t33 + 0x18) = 0xfffffffe;
							_t20 =  *0x274194;
							if(_t20 != 0) {
								_t20 =  *(_t20 + _t31 * 4);
								 *(_t20 + 0x10) = 0xfffffffe;
							}
						} else {
							_t20 = _t25 & 0x000000ff;
							 *(_t33 + 0x18) = _t28;
							if(_t20 != 2) {
								if(_t20 == 3) {
									 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000008;
								}
							} else {
								 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000040;
							}
						}
					} else {
						 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000080;
					}
					_t31 = _t31 + 1;
				} while (_t31 != 3);
				return _t20;
			}

0x00266a6e
0x00266a70
0x00266a74
0x00266a7d
0x00266a88
0x00266a98
0x00266a9c
0x00266a9f
0x00266ab1
0x00266aa1
0x00266aa4
0x00266aad
0x00266aa6
0x00266aa6
0x00266aa8
0x00266aa4
0x00266ab3
0x00266abb
0x00266ac0
0x00266acf
0x00266ac6
0x00266ac7
0x00266ac7
0x00266ad3
0x00266af3
0x00266af7
0x00266afe
0x00266b05
0x00266b07
0x00266b0a
0x00266b0a
0x00266ad5
0x00266ad5
0x00266ada
0x00266ae0
0x00266aeb
0x00266aed
0x00266aed
0x00266ae2
0x00266ae2
0x00266ae2
0x00266ae0
0x00266a90
0x00266a90
0x00266a90
0x00266b11
0x00266b12
0x00266b1e

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00266AB5
GetFileType.KERNELBASE(00000000), ref: 00266AC7

Memory Dump Source

Source File: 00000000.00000002.268673362.0000000000261000.00000020.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.268665443.0000000000260000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268687601.000000000026D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268696251.0000000000273000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268711075.0000000000275000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: a9ff9162e4d6951832b375df1fa78de665f8756ba0747dffbe668beb48bfcadb
Instruction ID: b83619fccbe7032395169eaa3195e074bf36dfea1d15cb08150c3bd468dd5f3f
Opcode Fuzzy Hash: a9ff9162e4d6951832b375df1fa78de665f8756ba0747dffbe668beb48bfcadb
Instruction Fuzzy Hash: 131106316347439AD7308E7E9C8C622BA949B96330F38471AD5B6E61F1CB70DDE29241

Uniqueness

Uniqueness Score: -1.00%

Function 0026479B Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E0026479B(void* __ecx, signed int _a4, signed int _a8) {
				void* __esi;
				void* _t8;
				void* _t12;
				signed int _t13;
				void* _t15;
				signed int _t16;
				signed int _t18;
				long _t19;

				_t15 = __ecx;
				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0x274170, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E002640A1();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E0026501F())) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E002674C4(_t15, _t16, _t19, __eflags, _t19);
						_pop(_t15);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				_t16 = _t13 % _t18;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x0026479b
0x002647a1
0x002647a6
0x002647b4
0x002647b4
0x002647ba
0x002647bc
0x002647bc
0x002647d3
0x002647dc
0x002647e4
0x00000000
0x00000000
0x002647c4
0x002647c6
0x002647e8
0x002647ed
0x002647f3
0x00000000
0x002647f3
0x002647c9
0x002647ce
0x002647cf
0x002647d1
0x00000000
0x00000000
0x002647d1
0x00000000
0x002647d3
0x002647ac
0x002647ad
0x002647b2
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00264CFF,00000001,00000364,?,00267370,?,00000004,00000000,?,?,?,0026437B), ref: 002647DC

Memory Dump Source

Source File: 00000000.00000002.268673362.0000000000261000.00000020.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.268665443.0000000000260000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268687601.000000000026D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268696251.0000000000273000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268711075.0000000000275000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2a648ca2aeb5940898c7fdecbcf5b07489256e973de24d8af121c1e9e692b9f4
Instruction ID: 4ca1fbd64708df269f909bdd3f32f0a19e1992259ec519c1e7f3fe264af29bc6
Opcode Fuzzy Hash: 2a648ca2aeb5940898c7fdecbcf5b07489256e973de24d8af121c1e9e692b9f4
Instruction Fuzzy Hash: BBF0E035534135A79B237E219C05B57BB8C9F42770F158112AC45DB5C1CB60DCF185F0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00264D99 Relevance: 4.6, APIs: 3, Instructions: 78
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 76%

			E00264D99(intOrPtr __ebx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				struct _EXCEPTION_POINTERS _v812;
				signed int _t40;
				char* _t47;
				char* _t49;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t66;
				intOrPtr _t67;
				int _t68;
				intOrPtr _t69;
				signed int _t70;

				_t69 = __esi;
				_t67 = __edi;
				_t66 = __edx;
				_t61 = __ebx;
				_t40 =  *0x273018; // 0x16a19189
				_t41 = _t40 ^ _t70;
				_v8 = _t40 ^ _t70;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E00262747(_t41);
					_pop(_t62);
				}
				E00262CE0(_t67,  &_v804, 0, 0x50);
				E00262CE0(_t67,  &_v724, 0, 0x2cc);
				_v812.ExceptionRecord =  &_v804;
				_t47 =  &_v724;
				_v812.ContextRecord = _t47;
				_v548 = _t47;
				_v552 = _t62;
				_v556 = _t66;
				_v560 = _t61;
				_v564 = _t69;
				_v568 = _t67;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t49 =  &_v0;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t68 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				if(UnhandledExceptionFilter( &_v812) == 0 && _t68 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					E00262747(_t57);
				}
				return E002629BB(_v8 ^ _t70);
			}

0x00264d99
0x00264d99
0x00264d99
0x00264d99
0x00264da4
0x00264da9
0x00264dab
0x00264db3
0x00264db5
0x00264db8
0x00264dbd
0x00264dbd
0x00264dc9
0x00264ddc
0x00264dea
0x00264df0
0x00264df6
0x00264dfc
0x00264e02
0x00264e08
0x00264e0e
0x00264e14
0x00264e1a
0x00264e20
0x00264e27
0x00264e2e
0x00264e35
0x00264e3c
0x00264e43
0x00264e4a
0x00264e4b
0x00264e54
0x00264e5a
0x00264e5d
0x00264e63
0x00264e70
0x00264e79
0x00264e82
0x00264e8b
0x00264e99
0x00264e9b
0x00264eb0
0x00264ebc
0x00264ebf
0x00264ec4
0x00264ed3

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00264E91
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00264E9B
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00264EA8

Memory Dump Source

Source File: 00000000.00000002.268673362.0000000000261000.00000020.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.268665443.0000000000260000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268687601.000000000026D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268696251.0000000000273000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268711075.0000000000275000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 156f4e04d5d5f713aa195b2498d2d7d7e584f4c8668883a5da9effad880ead74
Instruction ID: 6dba87d7f5988150ffe97fdea362ecff912699b638a221d0c5d2060c6f927fc3
Opcode Fuzzy Hash: 156f4e04d5d5f713aa195b2498d2d7d7e584f4c8668883a5da9effad880ead74
Instruction Fuzzy Hash: B331A27491122DABCB21DF64DD89B8DBBB8BF08310F5042DAE81CA6250EB709B958F44

Uniqueness

Uniqueness Score: -1.00%

Function 00263E41 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00263E41(int _a4) {
				void* _t14;
				void* _t16;

				if(E0026666E(_t14, _t16) != 0 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E00263E82(_t14, _t16, _a4);
				ExitProcess(_a4);
			}

0x00263e4d
0x00263e69
0x00263e69
0x00263e72
0x00263e7b

APIs

GetCurrentProcess.KERNEL32(00000003,?,00263E17,00000003,00271DE8,0000000C,00263F2A,00000003,00000002,00000000,?,0026479A,00000003), ref: 00263E62
TerminateProcess.KERNEL32(00000000,?,00263E17,00000003,00271DE8,0000000C,00263F2A,00000003,00000002,00000000,?,0026479A,00000003), ref: 00263E69
ExitProcess.KERNEL32 ref: 00263E7B

Memory Dump Source

Source File: 00000000.00000002.268673362.0000000000261000.00000020.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.268665443.0000000000260000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268687601.000000000026D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268696251.0000000000273000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268711075.0000000000275000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: f31c5546d564875db0e06bc5d16c02ed325e5de928041f1356f9c4b768c38380
Instruction ID: 2bec2746d834b899b9febcd200ac4aa292d98cfc0f35a1979e40f3d1872b236c
Opcode Fuzzy Hash: f31c5546d564875db0e06bc5d16c02ed325e5de928041f1356f9c4b768c38380
Instruction Fuzzy Hash: 70E0B631924148AFCF11AF69ED0DA593B69EF51741F148414F8058A122DBBADEA3CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0026280B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0026280B(intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed char _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _t59;
				signed int _t62;
				signed int _t63;
				intOrPtr _t65;
				signed int _t66;
				signed int _t68;
				intOrPtr _t73;
				intOrPtr* _t75;
				intOrPtr* _t77;
				intOrPtr _t84;
				intOrPtr* _t86;
				signed int _t91;
				signed int _t94;

				_t84 = __edx;
				 *0x2737d4 =  *0x2737d4 & 0x00000000;
				 *0x273010 =  *0x273010 | 1;
				if(IsProcessorFeaturePresent(0xa) == 0) {
					L20:
					return 0;
				}
				_v24 = _v24 & 0x00000000;
				 *0x273010 =  *0x273010 | 0x00000002;
				 *0x2737d4 = 1;
				_t86 =  &_v48;
				_push(1);
				asm("cpuid");
				_pop(_t73);
				 *_t86 = 0;
				 *((intOrPtr*)(_t86 + 4)) = 1;
				 *((intOrPtr*)(_t86 + 8)) = 0;
				 *((intOrPtr*)(_t86 + 0xc)) = _t84;
				_v16 = _v48;
				_v8 = _v36 ^ 0x49656e69;
				_v12 = _v40 ^ 0x6c65746e;
				_push(1);
				asm("cpuid");
				_t75 =  &_v48;
				 *_t75 = 1;
				 *((intOrPtr*)(_t75 + 4)) = _t73;
				 *((intOrPtr*)(_t75 + 8)) = 0;
				 *((intOrPtr*)(_t75 + 0xc)) = _t84;
				if((_v44 ^ 0x756e6547 | _v8 | _v12) != 0) {
					L9:
					_t91 =  *0x2737d8; // 0x2
					L10:
					_v32 = _v36;
					_t59 = _v40;
					_v8 = _t59;
					_v28 = _t59;
					if(_v16 >= 7) {
						_t65 = 7;
						_push(_t75);
						asm("cpuid");
						_t77 =  &_v48;
						 *_t77 = _t65;
						 *((intOrPtr*)(_t77 + 4)) = _t75;
						 *((intOrPtr*)(_t77 + 8)) = 0;
						 *((intOrPtr*)(_t77 + 0xc)) = _t84;
						_t66 = _v44;
						_v24 = _t66;
						_t59 = _v8;
						if((_t66 & 0x00000200) != 0) {
							 *0x2737d8 = _t91 | 0x00000002;
						}
					}
					if((_t59 & 0x00100000) != 0) {
						 *0x273010 =  *0x273010 | 0x00000004;
						 *0x2737d4 = 2;
						if((_t59 & 0x08000000) != 0 && (_t59 & 0x10000000) != 0) {
							asm("xgetbv");
							_v20 = _t59;
							_v16 = _t84;
							if((_v20 & 0x00000006) == 6 && 0 == 0) {
								_t62 =  *0x273010; // 0x2f
								_t63 = _t62 | 0x00000008;
								 *0x2737d4 = 3;
								 *0x273010 = _t63;
								if((_v24 & 0x00000020) != 0) {
									 *0x2737d4 = 5;
									 *0x273010 = _t63 | 0x00000020;
								}
							}
						}
					}
					goto L20;
				}
				_t68 = _v48 & 0x0fff3ff0;
				if(_t68 == 0x106c0 || _t68 == 0x20660 || _t68 == 0x20670 || _t68 == 0x30650 || _t68 == 0x30660 || _t68 == 0x30670) {
					_t94 =  *0x2737d8; // 0x2
					_t91 = _t94 | 0x00000001;
					 *0x2737d8 = _t91;
					goto L10;
				} else {
					goto L9;
				}
			}

0x0026280b
0x0026280e
0x0026281c
0x0026282b
0x002629a8
0x002629ae
0x002629ae
0x00262831
0x00262837
0x00262842
0x00262848
0x0026284b
0x0026284c
0x00262850
0x00262851
0x00262853
0x00262856
0x0026285b
0x00262864
0x00262875
0x00262880
0x00262886
0x00262887
0x0026288f
0x00262895
0x00262897
0x0026289a
0x0026289d
0x002628a0
0x002628e5
0x002628e5
0x002628eb
0x002628f2
0x002628f5
0x002628f8
0x002628fb
0x002628fe
0x00262902
0x00262905
0x00262906
0x0026290b
0x0026290e
0x00262910
0x00262913
0x00262916
0x00262919
0x00262921
0x00262924
0x00262927
0x0026292c
0x0026292c
0x00262927
0x00262939
0x0026293b
0x00262942
0x00262951
0x0026295c
0x0026295f
0x00262962
0x00262973
0x00262979
0x0026297e
0x00262981
0x0026298f
0x00262994
0x00262999
0x002629a3
0x002629a3
0x00262994
0x00262973
0x00262951
0x00000000
0x00262939
0x002628a5
0x002628af
0x002628d4
0x002628da
0x002628dd
0x00000000
0x00000000
0x00000000
0x00000000

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00262824

Strings

, xrefs: 0026298B

Memory Dump Source

Source File: 00000000.00000002.268673362.0000000000261000.00000020.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.268665443.0000000000260000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268687601.000000000026D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268696251.0000000000273000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268711075.0000000000275000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-3916222277
Opcode ID: 90e8a02e6d7f70ec969d27dfe0e090fd3ab49bb4fab0af06b4d8e63d2b3c8b5c
Instruction ID: 26dfdf7fb9347cbefc58f9ab96201d2552d7c7ef49ae76d6e73846e41c91d965
Opcode Fuzzy Hash: 90e8a02e6d7f70ec969d27dfe0e090fd3ab49bb4fab0af06b4d8e63d2b3c8b5c
Instruction Fuzzy Hash: BE518FB1E21605DFDB18CF69E98579EBBF4FB48310F24846AD408E7290D3749A94DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 002651DA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E002651DA(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr* _v32;
				CHAR* _v36;
				signed int _v48;
				char _v286;
				signed int _v287;
				struct _WIN32_FIND_DATAA _v332;
				intOrPtr* _v336;
				signed int _v340;
				signed int _v344;
				intOrPtr _v372;
				signed int _t35;
				signed int _t40;
				signed int _t43;
				intOrPtr _t45;
				signed char _t47;
				intOrPtr* _t55;
				union _FINDEX_INFO_LEVELS _t57;
				signed int _t62;
				signed int _t65;
				void* _t72;
				void* _t74;
				signed int _t75;
				void* _t78;
				CHAR* _t79;
				intOrPtr* _t83;
				intOrPtr _t85;
				void* _t87;
				intOrPtr* _t88;
				signed int _t92;
				signed int _t96;
				void* _t101;
				intOrPtr _t102;
				signed int _t105;
				union _FINDEX_INFO_LEVELS _t106;
				void* _t111;
				intOrPtr _t112;
				void* _t113;
				signed int _t118;
				void* _t119;
				signed int _t120;
				void* _t121;
				void* _t122;

				_push(__ecx);
				_t83 = _a4;
				_t2 = _t83 + 1; // 0x1
				_t101 = _t2;
				do {
					_t35 =  *_t83;
					_t83 = _t83 + 1;
				} while (_t35 != 0);
				_push(__edi);
				_t105 = _a12;
				_t85 = _t83 - _t101 + 1;
				_v8 = _t85;
				if(_t85 <= (_t35 | 0xffffffff) - _t105) {
					_push(__ebx);
					_push(__esi);
					_t5 = _t105 + 1; // 0x1
					_t78 = _t5 + _t85;
					_t111 = E0026479B(_t85, _t78, 1);
					_pop(_t87);
					__eflags = _t105;
					if(_t105 == 0) {
						L6:
						_push(_v8);
						_t78 = _t78 - _t105;
						_t40 = E0026874B(_t87, _t111 + _t105, _t78, _a4);
						_t120 = _t119 + 0x10;
						__eflags = _t40;
						if(__eflags != 0) {
							goto L9;
						} else {
							_t72 = E00265419(_a16, _t101, __eflags, _t111);
							E00264676(0);
							_t74 = _t72;
							goto L8;
						}
					} else {
						_push(_t105);
						_t75 = E0026874B(_t87, _t111, _t78, _a8);
						_t120 = _t119 + 0x10;
						__eflags = _t75;
						if(_t75 != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E00264F73();
							asm("int3");
							_t118 = _t120;
							_t121 = _t120 - 0x150;
							_t43 =  *0x273018; // 0x16a19189
							_v48 = _t43 ^ _t118;
							_t88 = _v32;
							_push(_t78);
							_t79 = _v36;
							_push(_t111);
							_t112 = _v332.cAlternateFileName;
							_push(_t105);
							_v372 = _t112;
							while(1) {
								__eflags = _t88 - _t79;
								if(_t88 == _t79) {
									break;
								}
								_t45 =  *_t88;
								__eflags = _t45 - 0x2f;
								if(_t45 != 0x2f) {
									__eflags = _t45 - 0x5c;
									if(_t45 != 0x5c) {
										__eflags = _t45 - 0x3a;
										if(_t45 != 0x3a) {
											_t88 = E002687A0(_t79, _t88);
											continue;
										}
									}
								}
								break;
							}
							_t102 =  *_t88;
							__eflags = _t102 - 0x3a;
							if(_t102 != 0x3a) {
								L19:
								_t106 = 0;
								__eflags = _t102 - 0x2f;
								if(_t102 == 0x2f) {
									L23:
									_t47 = 1;
									__eflags = 1;
								} else {
									__eflags = _t102 - 0x5c;
									if(_t102 == 0x5c) {
										goto L23;
									} else {
										__eflags = _t102 - 0x3a;
										if(_t102 == 0x3a) {
											goto L23;
										} else {
											_t47 = 0;
										}
									}
								}
								_t90 = _t88 - _t79 + 1;
								asm("sbb eax, eax");
								_v340 =  ~(_t47 & 0x000000ff) & _t88 - _t79 + 0x00000001;
								E00262CE0(_t106,  &_v332, _t106, 0x140);
								_t122 = _t121 + 0xc;
								_t113 = FindFirstFileExA(_t79, _t106,  &_v332, _t106, _t106, _t106);
								_t55 = _v336;
								__eflags = _t113 - 0xffffffff;
								if(_t113 != 0xffffffff) {
									_t92 =  *((intOrPtr*)(_t55 + 4)) -  *_t55;
									__eflags = _t92;
									_t93 = _t92 >> 2;
									_v344 = _t92 >> 2;
									do {
										__eflags = _v332.cFileName - 0x2e;
										if(_v332.cFileName != 0x2e) {
											L36:
											_push(_t55);
											_t57 = E002651DA(_t79, _t93, _t106, _t113,  &(_v332.cFileName), _t79, _v340);
											_t122 = _t122 + 0x10;
											__eflags = _t57;
											if(_t57 != 0) {
												goto L26;
											} else {
												goto L37;
											}
										} else {
											_t93 = _v287;
											__eflags = _t93;
											if(_t93 == 0) {
												goto L37;
											} else {
												__eflags = _t93 - 0x2e;
												if(_t93 != 0x2e) {
													goto L36;
												} else {
													__eflags = _v286;
													if(_v286 == 0) {
														goto L37;
													} else {
														goto L36;
													}
												}
											}
										}
										goto L40;
										L37:
										_t62 = FindNextFileA(_t113,  &_v332);
										__eflags = _t62;
										_t55 = _v336;
									} while (_t62 != 0);
									_t103 =  *_t55;
									_t96 = _v344;
									_t65 =  *((intOrPtr*)(_t55 + 4)) -  *_t55 >> 2;
									__eflags = _t96 - _t65;
									if(_t96 != _t65) {
										E00268300(_t79, _t106, _t113, _t103 + _t96 * 4, _t65 - _t96, 4, E00265032);
									}
								} else {
									_push(_t55);
									_t57 = E002651DA(_t79, _t90, _t106, _t113, _t79, _t106, _t106);
									L26:
									_t106 = _t57;
								}
								__eflags = _t113 - 0xffffffff;
								if(_t113 != 0xffffffff) {
									FindClose(_t113);
								}
							} else {
								__eflags = _t88 -  &(_t79[1]);
								if(_t88 ==  &(_t79[1])) {
									goto L19;
								} else {
									_push(_t112);
									E002651DA(_t79, _t88, 0, _t112, _t79, 0, 0);
								}
							}
							__eflags = _v12 ^ _t118;
							return E002629BB(_v12 ^ _t118);
						} else {
							goto L6;
						}
					}
				} else {
					_t74 = 0xc;
					L8:
					return _t74;
				}
				L40:
			}

0x002651df
0x002651e0
0x002651e3
0x002651e3
0x002651e6
0x002651e6
0x002651e8
0x002651e9
0x002651f2
0x002651f3
0x002651f6
0x002651f9
0x002651fe
0x00265205
0x00265206
0x00265207
0x0026520a
0x00265214
0x00265217
0x00265218
0x0026521a
0x0026522e
0x0026522e
0x00265231
0x0026523b
0x00265240
0x00265243
0x00265245
0x00000000
0x00265247
0x0026524b
0x00265254
0x0026525a
0x00000000
0x0026525d
0x0026521c
0x0026521c
0x00265222
0x00265227
0x0026522a
0x0026522c
0x00265263
0x00265265
0x00265266
0x00265267
0x00265268
0x00265269
0x0026526a
0x0026526f
0x00265273
0x00265275
0x0026527b
0x00265282
0x00265285
0x00265288
0x00265289
0x0026528c
0x0026528d
0x00265290
0x00265291
0x002652b2
0x002652b2
0x002652b4
0x00000000
0x00000000
0x00265299
0x0026529b
0x0026529d
0x0026529f
0x002652a1
0x002652a3
0x002652a5
0x002652b0
0x00000000
0x002652b0
0x002652a5
0x002652a1
0x00000000
0x0026529d
0x002652b6
0x002652b8
0x002652bb
0x002652d4
0x002652d4
0x002652d6
0x002652d9
0x002652e9
0x002652eb
0x002652eb
0x002652db
0x002652db
0x002652de
0x00000000
0x002652e0
0x002652e0
0x002652e3
0x00000000
0x002652e5
0x002652e5
0x002652e5
0x002652e3
0x002652de
0x002652f1
0x002652f9
0x002652fd
0x0026530b
0x00265310
0x00265325
0x00265327
0x0026532d
0x00265330
0x00265362
0x00265362
0x00265364
0x00265367
0x0026536d
0x0026536d
0x00265374
0x0026538e
0x0026538e
0x0026539d
0x002653a2
0x002653a5
0x002653a7
0x00000000
0x00000000
0x00000000
0x00000000
0x00265376
0x00265376
0x0026537c
0x0026537e
0x00000000
0x00265380
0x00265380
0x00265383
0x00000000
0x00265385
0x00265385
0x0026538c
0x00000000
0x00000000
0x00000000
0x00000000
0x0026538c
0x00265383
0x0026537e
0x00000000
0x002653a9
0x002653b1
0x002653b7
0x002653b9
0x002653b9
0x002653c1
0x002653c6
0x002653ce
0x002653d1
0x002653d3
0x002653e7
0x002653ec
0x00265332
0x00265332
0x00265336
0x0026533e
0x0026533e
0x0026533e
0x00265340
0x00265343
0x00265346
0x00265346
0x002652bd
0x002652c0
0x002652c2
0x00000000
0x002652c4
0x002652c4
0x002652ca
0x002652cf
0x002652c2
0x00265353
0x0026535e
0x00000000
0x00000000
0x00000000
0x0026522c
0x00265200
0x00265202
0x0026525e
0x00265262
0x00265262
0x00000000

Strings

., xrefs: 0026536D

Memory Dump Source

Source File: 00000000.00000002.268673362.0000000000261000.00000020.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.268665443.0000000000260000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268687601.000000000026D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268696251.0000000000273000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268711075.0000000000275000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 550bafeb7440cff57771b5d706f9a765665c92614d2adfba0dbba864e1a56aa0
Instruction ID: c4935911f62bdb3441139061be7f85624e7e0422526978d444e1dcc2527d4dd9
Opcode Fuzzy Hash: 550bafeb7440cff57771b5d706f9a765665c92614d2adfba0dbba864e1a56aa0
Instruction Fuzzy Hash: 0A313A7191061AAFCB24DE78CC88EFA7BBDEF45314F140198F859D7251E6709D948B90

Uniqueness

Uniqueness Score: -1.00%

Function 0026B735 Relevance: 1.8, APIs: 1, Instructions: 269
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E0026B735(long _a4, signed int* _a8, signed char _a12, signed int _a16, intOrPtr* _a20, unsigned int* _a24, intOrPtr _a28) {
				signed int _t172;
				signed int _t175;
				signed int _t178;
				signed int* _t179;
				signed int _t195;
				signed int _t199;
				signed int _t202;
				void* _t203;
				void* _t206;
				signed int _t209;
				void* _t210;
				signed int _t225;
				unsigned int* _t240;
				signed char _t242;
				signed int* _t250;
				unsigned int* _t256;
				signed int* _t257;
				signed char _t259;
				long _t262;
				signed int* _t265;

				 *(_a4 + 4) = 0;
				_t262 = 0xc000000d;
				 *(_a4 + 8) = 0;
				 *(_a4 + 0xc) = 0;
				_t242 = _a12;
				if((_t242 & 0x00000010) != 0) {
					_t262 = 0xc000008f;
					 *(_a4 + 4) =  *(_a4 + 4) | 1;
				}
				if((_t242 & 0x00000002) != 0) {
					_t262 = 0xc0000093;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000002;
				}
				if((_t242 & 0x00000001) != 0) {
					_t262 = 0xc0000091;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000004;
				}
				if((_t242 & 0x00000004) != 0) {
					_t262 = 0xc000008e;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
				}
				if((_t242 & 0x00000008) != 0) {
					_t262 = 0xc0000090;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000010;
				}
				_t265 = _a8;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 << 4) ^  *(_a4 + 8)) & 0x00000010;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 +  *_t265) ^  *(_a4 + 8)) & 0x00000008;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 1) ^  *(_a4 + 8)) & 0x00000004;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 3) ^  *(_a4 + 8)) & 0x00000002;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 5) ^  *(_a4 + 8)) & 1;
				_t259 = E00269026(_a4);
				if((_t259 & 0x00000001) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000010;
				}
				if((_t259 & 0x00000004) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000008;
				}
				if((_t259 & 0x00000008) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000004;
				}
				if((_t259 & 0x00000010) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000002;
				}
				if((_t259 & 0x00000020) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 1;
				}
				_t172 =  *_t265 & 0x00000c00;
				if(_t172 == 0) {
					 *_a4 =  *_a4 & 0xfffffffc;
				} else {
					if(_t172 == 0x400) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffd | 1;
						L26:
						 *_t257 = _t225;
						L29:
						_t175 =  *_t265 & 0x00000300;
						if(_t175 == 0) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffeb | 0x00000008;
							L35:
							 *_t250 = _t178;
							L36:
							_t179 = _a4;
							_t254 = (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *_t179 =  *_t179 ^ (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *(_a4 + 0x20) =  *(_a4 + 0x20) | 1;
							if(_a28 == 0) {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe3 | 0x00000002;
								 *((long long*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t254 = _a4;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe3 | 0x00000002;
								 *(_a4 + 0x50) =  *_t240;
							} else {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe1;
								 *((intOrPtr*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe1;
								 *(_a4 + 0x50) =  *_t240;
							}
							E00268F8C(_t254);
							RaiseException(_t262, 0, 1,  &_a4);
							_t256 = _a4;
							if((_t256[2] & 0x00000010) != 0) {
								 *_t265 =  *_t265 & 0xfffffffe;
							}
							if((_t256[2] & 0x00000008) != 0) {
								 *_t265 =  *_t265 & 0xfffffffb;
							}
							if((_t256[2] & 0x00000004) != 0) {
								 *_t265 =  *_t265 & 0xfffffff7;
							}
							if((_t256[2] & 0x00000002) != 0) {
								 *_t265 =  *_t265 & 0xffffffef;
							}
							if((_t256[2] & 0x00000001) != 0) {
								 *_t265 =  *_t265 & 0xffffffdf;
							}
							_t195 =  *_t256 & 0x00000003;
							if(_t195 == 0) {
								 *_t265 =  *_t265 & 0xfffff3ff;
							} else {
								_t206 = _t195 - 1;
								if(_t206 == 0) {
									_t209 =  *_t265 & 0xfffff7ff | 0x00000400;
									L55:
									 *_t265 = _t209;
									L58:
									_t199 =  *_t256 >> 0x00000002 & 0x00000007;
									if(_t199 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000300;
										L64:
										 *_t265 = _t202;
										L65:
										if(_a28 == 0) {
											 *_t240 = _t256[0x14];
										} else {
											 *_t240 = _t256[0x14];
										}
										return _t202;
									}
									_t203 = _t199 - 1;
									if(_t203 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000200;
										goto L64;
									}
									_t202 = _t203 - 1;
									if(_t202 == 0) {
										 *_t265 =  *_t265 & 0xfffff3ff;
									}
									goto L65;
								}
								_t210 = _t206 - 1;
								if(_t210 == 0) {
									_t209 =  *_t265 & 0xfffffbff | 0x00000800;
									goto L55;
								}
								if(_t210 == 1) {
									 *_t265 =  *_t265 | 0x00000c00;
								}
							}
							goto L58;
						}
						if(_t175 == 0x200) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffe7 | 0x00000004;
							goto L35;
						}
						if(_t175 == 0x300) {
							 *_a4 =  *_a4 & 0xffffffe3;
						}
						goto L36;
					}
					if(_t172 == 0x800) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffe | 0x00000002;
						goto L26;
					}
					if(_t172 == 0xc00) {
						 *_a4 =  *_a4 | 0x00000003;
					}
				}
			}

0x0026b743
0x0026b74a
0x0026b74f
0x0026b755
0x0026b758
0x0026b75e
0x0026b763
0x0026b768
0x0026b768
0x0026b76e
0x0026b773
0x0026b778
0x0026b778
0x0026b77f
0x0026b784
0x0026b789
0x0026b789
0x0026b790
0x0026b795
0x0026b79a
0x0026b79a
0x0026b7a1
0x0026b7a6
0x0026b7ab
0x0026b7ab
0x0026b7b3
0x0026b7c3
0x0026b7d5
0x0026b7e7
0x0026b7fa
0x0026b80c
0x0026b814
0x0026b819
0x0026b81e
0x0026b81e
0x0026b825
0x0026b82a
0x0026b82a
0x0026b831
0x0026b836
0x0026b836
0x0026b83d
0x0026b842
0x0026b842
0x0026b849
0x0026b84e
0x0026b84e
0x0026b858
0x0026b85a
0x0026b894
0x0026b85c
0x0026b861
0x0026b885
0x0026b88d
0x0026b881
0x0026b881
0x0026b897
0x0026b89e
0x0026b8a0
0x0026b8c2
0x0026b8ca
0x0026b8cd
0x0026b8cd
0x0026b8cf
0x0026b8cf
0x0026b8da
0x0026b8e0
0x0026b8e5
0x0026b8ec
0x0026b926
0x0026b931
0x0026b937
0x0026b93a
0x0026b93d
0x0026b949
0x0026b951
0x0026b8ee
0x0026b8f1
0x0026b8fd
0x0026b903
0x0026b909
0x0026b90c
0x0026b915
0x0026b915
0x0026b954
0x0026b962
0x0026b968
0x0026b96f
0x0026b971
0x0026b971
0x0026b978
0x0026b97a
0x0026b97a
0x0026b981
0x0026b983
0x0026b983
0x0026b98a
0x0026b98c
0x0026b98c
0x0026b993
0x0026b995
0x0026b995
0x0026b9a2
0x0026b9a5
0x0026b9dc
0x0026b9a7
0x0026b9a7
0x0026b9aa
0x0026b9d5
0x0026b9ca
0x0026b9ca
0x0026b9de
0x0026b9e6
0x0026b9e9
0x0026ba08
0x0026ba0d
0x0026ba0d
0x0026ba0f
0x0026ba14
0x0026ba20
0x0026ba16
0x0026ba19
0x0026ba19
0x0026ba25
0x0026ba25
0x0026b9eb
0x0026b9ee
0x0026b9fd
0x00000000
0x0026b9fd
0x0026b9f0
0x0026b9f3
0x0026b9f5
0x0026b9f5
0x00000000
0x0026b9f3
0x0026b9ac
0x0026b9af
0x0026b9c5
0x00000000
0x0026b9c5
0x0026b9b4
0x0026b9b6
0x0026b9b6
0x0026b9b4
0x00000000
0x0026b9a5
0x0026b8a7
0x0026b8b5
0x0026b8bd
0x00000000
0x0026b8bd
0x0026b8ab
0x0026b8b0
0x0026b8b0
0x00000000
0x0026b8ab
0x0026b868
0x0026b876
0x0026b87e
0x00000000
0x0026b87e
0x0026b86c
0x0026b871
0x0026b871
0x0026b86c

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0026B730,?,?,00000008,?,?,0026B3D0,00000000), ref: 0026B962

Memory Dump Source

Source File: 00000000.00000002.268673362.0000000000261000.00000020.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.268665443.0000000000260000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268687601.000000000026D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268696251.0000000000273000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268711075.0000000000275000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 00a5052d3ccc7e1a3f276b5cc73a54603234640315d3b503fff9fb7d8ee9ed12
Instruction ID: dd371f74595c6280f4fd8e19717cb49b7e2738abf764d04a4ac2c5f5eaa72a6a
Opcode Fuzzy Hash: 00a5052d3ccc7e1a3f276b5cc73a54603234640315d3b503fff9fb7d8ee9ed12
Instruction Fuzzy Hash: 9BB13C31620609DFDB16CF28C48AB657BE0FF45365F298658E999CF2A1C335E9E1CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00267394 Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00267394() {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0x274170 = _t3;
				return _t3 & 0xffffff00 | _t3 != 0x00000000;
			}

0x00267394
0x0026739c
0x002673a4

APIs

GetProcessHeap.KERNEL32 ref: 00267394

Memory Dump Source

Source File: 00000000.00000002.268673362.0000000000261000.00000020.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.268665443.0000000000260000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268687601.000000000026D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268696251.0000000000273000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268711075.0000000000275000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 853cb6cf9af2aa9ffd44843e043c1cfecde058b87429f58ab31b870cb88ce46e
Instruction ID: 611b545593b3d2e4edff44d2a8de3b9403aebcbf3b24379336f62b9675d7cf94
Opcode Fuzzy Hash: 853cb6cf9af2aa9ffd44843e043c1cfecde058b87429f58ab31b870cb88ce46e
Instruction Fuzzy Hash: F3A01130A02202CB8300AF32BE0CB083AA8BA08280B808028E008C0220EB3080828A00

Uniqueness

Uniqueness Score: -1.00%

Function 00D04515 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269168079.0000000000D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: fa9b1bb3b7addc612f684838101b2d2085241f349b7c115856b2d1a71459c6e6
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: 0541B571D1051CEBCF48CFADC991AEEBBF1AF88201F548299D516AB345D730AB41DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00D04405 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269168079.0000000000D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35fae48b58514328602f79420b2e81abbf1084ebf9a99db8433c1080f312f74a
Instruction ID: 68a42f234c4d5b7c8d00bb974057f570423e623d65decc3924a2b87886151272
Opcode Fuzzy Hash: 35fae48b58514328602f79420b2e81abbf1084ebf9a99db8433c1080f312f74a
Instruction Fuzzy Hash: 6A0180B8A01109EFCB44DF98C590EAEF7B5FB48310B208599E919A7341D730EE51DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00D043A5 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269168079.0000000000D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bcb60f536e0ace9363e1095d119401d239975132a0b2009284b610fb2bfc0a9
Instruction ID: 4d3f7e9a8cab99d15ba8e95a15caecfad213766a8de30c8b41d00eb45b6f0992
Opcode Fuzzy Hash: 2bcb60f536e0ace9363e1095d119401d239975132a0b2009284b610fb2bfc0a9
Instruction Fuzzy Hash: 1B019278A01109EFCB44DF98C590EAEF7B6FF48310F208599E919A7341D730AE41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00D04135 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269168079.0000000000D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c83a6b6a472ec04d6c9d5fb753ffd229562f112202eda93caf714974bbbe2610
Instruction ID: 88b96bc2bf26666b3bf0ee9af6500240d9f2b4d31e6a717651da7f404f3bcf61
Opcode Fuzzy Hash: c83a6b6a472ec04d6c9d5fb753ffd229562f112202eda93caf714974bbbe2610
Instruction Fuzzy Hash: 36E092BA34021487C700CA15D480E43B7AAF7D8230B5182A0CA1D87346C930EDC385E2

Uniqueness

Uniqueness Score: -1.00%

Function 00268853 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 216
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00268853(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char* _a16, int _a20, intOrPtr _a24, short* _a28, int _a32, intOrPtr _a36) {
				signed int _v8;
				int _v12;
				void* _v24;
				signed int _t49;
				signed int _t54;
				int _t58;
				signed int _t60;
				short* _t62;
				signed int _t66;
				short* _t70;
				int _t71;
				int _t78;
				short* _t81;
				signed int _t87;
				signed int _t90;
				void* _t95;
				void* _t96;
				int _t98;
				short* _t101;
				int _t103;
				signed int _t106;
				short* _t107;
				void* _t110;

				_push(__ecx);
				_push(__ecx);
				_t49 =  *0x273018; // 0x16a19189
				_v8 = _t49 ^ _t106;
				_push(__esi);
				_t103 = _a20;
				if(_t103 > 0) {
					_t78 = E0026914F(_a16, _t103);
					_t110 = _t78 - _t103;
					_t4 = _t78 + 1; // 0x1
					_t103 = _t4;
					if(_t110 >= 0) {
						_t103 = _t78;
					}
				}
				_t98 = _a32;
				if(_t98 == 0) {
					_t98 =  *( *_a4 + 8);
					_a32 = _t98;
				}
				_t54 = MultiByteToWideChar(_t98, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t103, 0, 0);
				_v12 = _t54;
				if(_t54 == 0) {
					L38:
					return E002629BB(_v8 ^ _t106);
				} else {
					_t95 = _t54 + _t54;
					_t85 = _t95 + 8;
					asm("sbb eax, eax");
					if((_t95 + 0x00000008 & _t54) == 0) {
						_t81 = 0;
						__eflags = 0;
						L14:
						if(_t81 == 0) {
							L36:
							_t105 = 0;
							L37:
							E00266F6B(_t81);
							goto L38;
						}
						_t58 = MultiByteToWideChar(_t98, 1, _a16, _t103, _t81, _v12);
						_t121 = _t58;
						if(_t58 == 0) {
							goto L36;
						}
						_t100 = _v12;
						_t60 = E00266564(_t85, _t103, _t121, _a8, _a12, _t81, _v12, 0, 0, 0, 0, 0);
						_t105 = _t60;
						if(_t105 == 0) {
							goto L36;
						}
						if((_a12 & 0x00000400) == 0) {
							_t96 = _t105 + _t105;
							_t87 = _t96 + 8;
							__eflags = _t96 - _t87;
							asm("sbb eax, eax");
							__eflags = _t87 & _t60;
							if((_t87 & _t60) == 0) {
								_t101 = 0;
								__eflags = 0;
								L30:
								__eflags = _t101;
								if(__eflags == 0) {
									L35:
									E00266F6B(_t101);
									goto L36;
								}
								_t62 = E00266564(_t87, _t105, __eflags, _a8, _a12, _t81, _v12, _t101, _t105, 0, 0, 0);
								__eflags = _t62;
								if(_t62 == 0) {
									goto L35;
								}
								_push(0);
								_push(0);
								__eflags = _a28;
								if(_a28 != 0) {
									_push(_a28);
									_push(_a24);
								} else {
									_push(0);
									_push(0);
								}
								_t105 = WideCharToMultiByte(_a32, 0, _t101, _t105, ??, ??, ??, ??);
								__eflags = _t105;
								if(_t105 != 0) {
									E00266F6B(_t101);
									goto L37;
								} else {
									goto L35;
								}
							}
							_t90 = _t96 + 8;
							__eflags = _t96 - _t90;
							asm("sbb eax, eax");
							_t66 = _t60 & _t90;
							_t87 = _t96 + 8;
							__eflags = _t66 - 0x400;
							if(_t66 > 0x400) {
								__eflags = _t96 - _t87;
								asm("sbb eax, eax");
								_t101 = E002646B0(_t87, _t66 & _t87);
								_pop(_t87);
								__eflags = _t101;
								if(_t101 == 0) {
									goto L35;
								}
								 *_t101 = 0xdddd;
								L28:
								_t101 =  &(_t101[4]);
								goto L30;
							}
							__eflags = _t96 - _t87;
							asm("sbb eax, eax");
							E0026BFA0();
							_t101 = _t107;
							__eflags = _t101;
							if(_t101 == 0) {
								goto L35;
							}
							 *_t101 = 0xcccc;
							goto L28;
						}
						_t70 = _a28;
						if(_t70 == 0) {
							goto L37;
						}
						_t125 = _t105 - _t70;
						if(_t105 > _t70) {
							goto L36;
						}
						_t71 = E00266564(0, _t105, _t125, _a8, _a12, _t81, _t100, _a24, _t70, 0, 0, 0);
						_t105 = _t71;
						if(_t71 != 0) {
							goto L37;
						}
						goto L36;
					}
					asm("sbb eax, eax");
					_t72 = _t54 & _t95 + 0x00000008;
					_t85 = _t95 + 8;
					if((_t54 & _t95 + 0x00000008) > 0x400) {
						__eflags = _t95 - _t85;
						asm("sbb eax, eax");
						_t81 = E002646B0(_t85, _t72 & _t85);
						_pop(_t85);
						__eflags = _t81;
						if(__eflags == 0) {
							goto L36;
						}
						 *_t81 = 0xdddd;
						L12:
						_t81 =  &(_t81[4]);
						goto L14;
					}
					asm("sbb eax, eax");
					E0026BFA0();
					_t81 = _t107;
					if(_t81 == 0) {
						goto L36;
					}
					 *_t81 = 0xcccc;
					goto L12;
				}
			}

0x00268858
0x00268859
0x0026885a
0x00268861
0x00268865
0x00268866
0x0026886c
0x00268872
0x00268878
0x0026887b
0x0026887b
0x0026887e
0x00268880
0x00268880
0x0026887e
0x00268882
0x00268887
0x0026888e
0x00268891
0x00268891
0x002688ad
0x002688b3
0x002688b8
0x00268a4b
0x00268a5e
0x002688be
0x002688be
0x002688c1
0x002688c6
0x002688ca
0x0026891e
0x0026891e
0x00268920
0x00268922
0x00268a40
0x00268a40
0x00268a42
0x00268a43
0x00000000
0x00268a49
0x00268933
0x00268939
0x0026893b
0x00000000
0x00000000
0x00268941
0x00268953
0x00268958
0x0026895c
0x00000000
0x00000000
0x00268969
0x002689a3
0x002689a6
0x002689a9
0x002689ab
0x002689ad
0x002689af
0x002689fb
0x002689fb
0x002689fd
0x002689fd
0x002689ff
0x00268a39
0x00268a3a
0x00000000
0x00268a3f
0x00268a13
0x00268a18
0x00268a1a
0x00000000
0x00000000
0x00268a1e
0x00268a1f
0x00268a20
0x00268a23
0x00268a5f
0x00268a62
0x00268a25
0x00268a25
0x00268a26
0x00268a26
0x00268a33
0x00268a35
0x00268a37
0x00268a68
0x00000000
0x00000000
0x00000000
0x00000000
0x00268a37
0x002689b1
0x002689b4
0x002689b6
0x002689b8
0x002689ba
0x002689bd
0x002689c2
0x002689dd
0x002689df
0x002689e9
0x002689eb
0x002689ec
0x002689ee
0x00000000
0x00000000
0x002689f0
0x002689f6
0x002689f6
0x00000000
0x002689f6
0x002689c4
0x002689c6
0x002689ca
0x002689cf
0x002689d1
0x002689d3
0x00000000
0x00000000
0x002689d5
0x00000000
0x002689d5
0x0026896b
0x00268970
0x00000000
0x00000000
0x00268976
0x00268978
0x00000000
0x00000000
0x0026898f
0x00268994
0x00268998
0x00000000
0x00000000
0x00000000
0x0026899e
0x002688d1
0x002688d3
0x002688d5
0x002688dd
0x002688fc
0x002688fe
0x00268908
0x0026890a
0x0026890b
0x0026890d
0x00000000
0x00000000
0x00268913
0x00268919
0x00268919
0x00000000
0x00268919
0x002688e1
0x002688e5
0x002688ea
0x002688ee
0x00000000
0x00000000
0x002688f4
0x00000000
0x002688f4

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,W\&,00000000,?,?,?,00268AA4,?,?,00000100), ref: 002688AD
__alloca_probe_16.LIBCMT ref: 002688E5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,00268AA4,?,?,00000100,?,?,?), ref: 00268933
__alloca_probe_16.LIBCMT ref: 002689CA
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,00000100,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00268A2D
__freea.LIBCMT ref: 00268A3A

Part of subcall function 002646B0: HeapAlloc.KERNEL32(00000000,?,00000004,?,00268CDE,?,00000000,?,00267370,?,00000004,00000000,?,?,?,0026437B), ref: 002646E2

__freea.LIBCMT ref: 00268A43
__freea.LIBCMT ref: 00268A68

Strings

W\&, xrefs: 00268865

Memory Dump Source

Source File: 00000000.00000002.268673362.0000000000261000.00000020.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.268665443.0000000000260000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268687601.000000000026D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268696251.0000000000273000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268711075.0000000000275000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocHeap
String ID: W\&
API String ID: 2597970681-1387361922
Opcode ID: 3b90bad7f2d91844969e3a08ce2f42e82e601955718ed36c877d301712c63050
Instruction ID: 3403a379ff7b55b9d50530792f4e1bbcc35033d2bb80ca051bec6f53c0fe2e3d
Opcode Fuzzy Hash: 3b90bad7f2d91844969e3a08ce2f42e82e601955718ed36c877d301712c63050
Instruction Fuzzy Hash: 1A51D072630216ABDF258EA4DC45EBB77A9EB44750F24472AFC05D6240EF74DCE0DA90

Uniqueness

Uniqueness Score: -1.00%

Function 0026928E Relevance: 13.8, APIs: 9, Instructions: 268
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0026928E(void* __ebx, void* __edi, void* __esi, int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16, int _a20, char* _a24, int _a28, int _a32) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				short* _v32;
				int _v36;
				char* _v40;
				int _v44;
				intOrPtr _v48;
				void* _v60;
				signed int _t63;
				int _t70;
				signed int _t72;
				short* _t73;
				signed int _t77;
				short* _t87;
				void* _t89;
				void* _t92;
				int _t99;
				intOrPtr _t101;
				intOrPtr _t102;
				signed int _t112;
				char* _t114;
				char* _t115;
				void* _t120;
				void* _t121;
				intOrPtr _t122;
				intOrPtr _t123;
				intOrPtr* _t125;
				short* _t126;
				int _t128;
				int _t129;
				short* _t130;
				intOrPtr* _t131;
				signed int _t132;
				short* _t133;

				_t63 =  *0x273018; // 0x16a19189
				_v8 = _t63 ^ _t132;
				_t128 = _a20;
				_v44 = _a4;
				_v48 = _a8;
				_t67 = _a24;
				_v40 = _a24;
				_t125 = _a16;
				_v36 = _t125;
				if(_t128 <= 0) {
					if(_t128 >= 0xffffffff) {
						goto L2;
					} else {
						goto L5;
					}
				} else {
					_t128 = E0026914F(_t125, _t128);
					_t67 = _v40;
					L2:
					_t99 = _a28;
					if(_t99 <= 0) {
						if(_t99 < 0xffffffff) {
							goto L5;
						} else {
							goto L7;
						}
					} else {
						_t99 = E0026914F(_t67, _t99);
						L7:
						_t70 = _a32;
						if(_t70 == 0) {
							_t70 =  *( *_v44 + 8);
							_a32 = _t70;
						}
						if(_t128 == 0 || _t99 == 0) {
							if(_t128 != _t99) {
								if(_t99 <= 1) {
									if(_t128 <= 1) {
										if(GetCPInfo(_t70,  &_v28) == 0) {
											goto L5;
										} else {
											if(_t128 <= 0) {
												if(_t99 <= 0) {
													goto L36;
												} else {
													_t89 = 2;
													if(_v28 >= _t89) {
														_t114 =  &_v22;
														if(_v22 != 0) {
															_t131 = _v40;
															while(1) {
																_t122 =  *((intOrPtr*)(_t114 + 1));
																if(_t122 == 0) {
																	goto L15;
																}
																_t101 =  *_t131;
																if(_t101 <  *_t114 || _t101 > _t122) {
																	_t114 = _t114 + _t89;
																	if( *_t114 != 0) {
																		continue;
																	} else {
																		goto L15;
																	}
																}
																goto L63;
															}
														}
													}
													goto L15;
												}
											} else {
												_t92 = 2;
												if(_v28 >= _t92) {
													_t115 =  &_v22;
													if(_v22 != 0) {
														while(1) {
															_t123 =  *((intOrPtr*)(_t115 + 1));
															if(_t123 == 0) {
																goto L17;
															}
															_t102 =  *_t125;
															if(_t102 <  *_t115 || _t102 > _t123) {
																_t115 = _t115 + _t92;
																if( *_t115 != 0) {
																	continue;
																} else {
																	goto L17;
																}
															}
															goto L63;
														}
													}
												}
												goto L17;
											}
										}
									} else {
										L17:
										_push(3);
										goto L13;
									}
								} else {
									L15:
								}
							} else {
								_push(2);
								L13:
							}
						} else {
							L36:
							_t126 = 0;
							_t72 = MultiByteToWideChar(_a32, 9, _v36, _t128, 0, 0);
							_v44 = _t72;
							if(_t72 == 0) {
								L5:
							} else {
								_t120 = _t72 + _t72;
								asm("sbb eax, eax");
								if((_t120 + 0x00000008 & _t72) == 0) {
									_t73 = 0;
									_v32 = 0;
									goto L45;
								} else {
									asm("sbb eax, eax");
									_t85 = _t72 & _t120 + 0x00000008;
									_t112 = _t120 + 8;
									if((_t72 & _t120 + 0x00000008) > 0x400) {
										asm("sbb eax, eax");
										_t87 = E002646B0(_t112, _t85 & _t112);
										_v32 = _t87;
										if(_t87 == 0) {
											goto L61;
										} else {
											 *_t87 = 0xdddd;
											goto L43;
										}
									} else {
										asm("sbb eax, eax");
										E0026BFA0();
										_t87 = _t133;
										_v32 = _t87;
										if(_t87 == 0) {
											L61:
											_t100 = _v32;
										} else {
											 *_t87 = 0xcccc;
											L43:
											_t73 =  &(_t87[4]);
											_v32 = _t73;
											L45:
											if(_t73 == 0) {
												goto L61;
											} else {
												_t129 = _a32;
												if(MultiByteToWideChar(_t129, 1, _v36, _t128, _t73, _v44) == 0) {
													goto L61;
												} else {
													_t77 = MultiByteToWideChar(_t129, 9, _v40, _t99, _t126, _t126);
													_v36 = _t77;
													if(_t77 == 0) {
														goto L61;
													} else {
														_t121 = _t77 + _t77;
														_t108 = _t121 + 8;
														asm("sbb eax, eax");
														if((_t121 + 0x00000008 & _t77) == 0) {
															_t130 = _t126;
															goto L56;
														} else {
															asm("sbb eax, eax");
															_t81 = _t77 & _t121 + 0x00000008;
															_t108 = _t121 + 8;
															if((_t77 & _t121 + 0x00000008) > 0x400) {
																asm("sbb eax, eax");
																_t130 = E002646B0(_t108, _t81 & _t108);
																_pop(_t108);
																if(_t130 == 0) {
																	goto L59;
																} else {
																	 *_t130 = 0xdddd;
																	goto L54;
																}
															} else {
																asm("sbb eax, eax");
																E0026BFA0();
																_t130 = _t133;
																if(_t130 == 0) {
																	L59:
																	_t100 = _v32;
																} else {
																	 *_t130 = 0xcccc;
																	L54:
																	_t130 =  &(_t130[4]);
																	L56:
																	if(_t130 == 0 || MultiByteToWideChar(_a32, 1, _v40, _t99, _t130, _v36) == 0) {
																		goto L59;
																	} else {
																		_t100 = _v32;
																		_t126 = E00266333(_t108, _t130, _v48, _a12, _v32, _v44, _t130, _v36, _t126, _t126, _t126);
																	}
																}
															}
														}
														E00266F6B(_t130);
													}
												}
											}
										}
									}
								}
								E00266F6B(_t100);
							}
						}
					}
				}
				L63:
				return E002629BB(_v8 ^ _t132);
			}

0x00269296
0x0026929d
0x002692a5
0x002692a8
0x002692ae
0x002692b1
0x002692b4
0x002692b8
0x002692bb
0x002692c0
0x002692e7
0x00000000
0x00000000
0x00000000
0x00000000
0x002692c2
0x002692ca
0x002692cc
0x002692d0
0x002692d0
0x002692d5
0x002692f3
0x00000000
0x00000000
0x00000000
0x00000000
0x002692d7
0x002692e0
0x002692f5
0x002692f5
0x002692fa
0x00269301
0x00269304
0x00269304
0x00269309
0x00269315
0x00269322
0x0026932f
0x00269342
0x00000000
0x00269344
0x00269346
0x00269379
0x00000000
0x0026937b
0x0026937d
0x00269381
0x00269387
0x0026938a
0x0026938c
0x0026938f
0x0026938f
0x00269394
0x00000000
0x00000000
0x00269396
0x0026939a
0x002693a4
0x002693a9
0x00000000
0x002693ab
0x00000000
0x002693ab
0x002693a9
0x00000000
0x0026939a
0x0026938f
0x0026938a
0x00000000
0x00269381
0x00269348
0x0026934a
0x0026934e
0x00269354
0x00269357
0x00269359
0x00269359
0x0026935e
0x00000000
0x00000000
0x00269360
0x00269364
0x0026936e
0x00269373
0x00000000
0x00269375
0x00000000
0x00269375
0x00269373
0x00000000
0x00269364
0x00269359
0x00269357
0x00000000
0x0026934e
0x00269346
0x00269331
0x00269331
0x00269331
0x00000000
0x00269331
0x00269324
0x00269324
0x00269326
0x00269317
0x00269317
0x00269319
0x00269319
0x002693b0
0x002693b0
0x002693b0
0x002693bd
0x002693c3
0x002693c8
0x002692e9
0x002693ce
0x002693ce
0x002693d6
0x002693da
0x00269435
0x00269437
0x00000000
0x002693dc
0x002693e1
0x002693e3
0x002693e5
0x002693ed
0x00269411
0x00269416
0x0026941b
0x00269421
0x00000000
0x00269427
0x00269427
0x00000000
0x00269427
0x002693ef
0x002693f1
0x002693f5
0x002693fa
0x002693fc
0x00269401
0x00269516
0x00269516
0x00269407
0x00269407
0x0026942d
0x0026942d
0x00269430
0x0026943a
0x0026943c
0x00000000
0x00269442
0x0026944a
0x00269458
0x00000000
0x0026945e
0x00269467
0x0026946d
0x00269472
0x00000000
0x00269478
0x00269478
0x0026947b
0x00269480
0x00269484
0x002694d0
0x00000000
0x00269486
0x0026948b
0x0026948d
0x0026948f
0x00269497
0x002694b4
0x002694be
0x002694c0
0x002694c3
0x00000000
0x002694c5
0x002694c5
0x00000000
0x002694c5
0x00269499
0x0026949b
0x0026949f
0x002694a4
0x002694a8
0x0026950a
0x0026950a
0x002694aa
0x002694aa
0x002694cb
0x002694cb
0x002694d2
0x002694d4
0x00000000
0x002694ed
0x002694ed
0x00269506
0x00269506
0x002694d4
0x002694a8
0x00269497
0x0026950e
0x00269513
0x00269472
0x00269458
0x0026943c
0x00269401
0x002693ed
0x0026951a
0x00269520
0x002693c8
0x00269309
0x002692d5
0x00269522
0x00269535

APIs

GetCPInfo.KERNEL32(0089F0A0,0089F0A0,?,7FFFFFFF,?,?,00269567,0089F0A0,0089F0A0,?,0089F0A0,?,?,?,?,0089F0A0), ref: 0026933A
MultiByteToWideChar.KERNEL32(0089F0A0,00000009,0089F0A0,0089F0A0,00000000,00000000,?,00269567,0089F0A0,0089F0A0,?,0089F0A0,?,?,?,?), ref: 002693BD
__alloca_probe_16.LIBCMT ref: 002693F5
MultiByteToWideChar.KERNEL32(0089F0A0,00000001,0089F0A0,0089F0A0,00000000,00269567,?,00269567,0089F0A0,0089F0A0,?,0089F0A0,?,?,?,?), ref: 00269450
__alloca_probe_16.LIBCMT ref: 0026949F
MultiByteToWideChar.KERNEL32(0089F0A0,00000009,0089F0A0,0089F0A0,00000000,00000000,?,00269567,0089F0A0,0089F0A0,?,0089F0A0,?,?,?,?), ref: 00269467

Part of subcall function 002646B0: HeapAlloc.KERNEL32(00000000,?,00000004,?,00268CDE,?,00000000,?,00267370,?,00000004,00000000,?,?,?,0026437B), ref: 002646E2

MultiByteToWideChar.KERNEL32(0089F0A0,00000001,0089F0A0,0089F0A0,00000000,0089F0A0,?,00269567,0089F0A0,0089F0A0,?,0089F0A0,?,?,?,?), ref: 002694E3
__freea.LIBCMT ref: 0026950E
__freea.LIBCMT ref: 0026951A

Memory Dump Source

Source File: 00000000.00000002.268673362.0000000000261000.00000020.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.268665443.0000000000260000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268687601.000000000026D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268696251.0000000000273000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268711075.0000000000275000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocHeapInfo
String ID:
API String ID: 3256262068-0
Opcode ID: 0ee0b04173fa58a3d404fba1ece44143371e964666c9e073b66f613eba416741
Instruction ID: 1fc09f7c748d35bfa61373416bbbcf00cbb86ad607a2f40e6ef4cf53f875c171
Opcode Fuzzy Hash: 0ee0b04173fa58a3d404fba1ece44143371e964666c9e073b66f613eba416741
Instruction Fuzzy Hash: 4A91D471E302469ADF218E75C885AEE7BBDAF49710F584159E805E7280DF34DCE1CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 002696AD Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E002696AD(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				signed char _v15;
				char _v16;
				void _v24;
				short _v28;
				char _v31;
				void _v32;
				long _v36;
				intOrPtr _v40;
				void* _v44;
				signed int _v48;
				signed char* _v52;
				long _v56;
				int _v60;
				signed int _t78;
				signed int _t80;
				int _t86;
				void* _t94;
				long _t97;
				void _t105;
				void* _t112;
				signed int _t116;
				signed int _t118;
				signed char _t123;
				signed char _t128;
				intOrPtr _t129;
				signed int _t131;
				signed char* _t133;
				intOrPtr* _t135;
				signed int _t136;
				void* _t137;

				_t78 =  *0x273018; // 0x16a19189
				_v8 = _t78 ^ _t136;
				_t80 = _a8;
				_t118 = _t80 >> 6;
				_t116 = (_t80 & 0x0000003f) * 0x30;
				_t133 = _a12;
				_v52 = _t133;
				_v48 = _t118;
				_v44 =  *((intOrPtr*)( *((intOrPtr*)(0x273f60 + _t118 * 4)) + _t116 + 0x18));
				_v40 = _a16 + _t133;
				_t86 = GetConsoleCP();
				_t135 = _a4;
				_v60 = _t86;
				 *_t135 = 0;
				 *((intOrPtr*)(_t135 + 4)) = 0;
				 *((intOrPtr*)(_t135 + 8)) = 0;
				while(_t133 < _v40) {
					_v28 = 0;
					_v31 =  *_t133;
					_t129 =  *((intOrPtr*)(0x273f60 + _v48 * 4));
					_t123 =  *(_t129 + _t116 + 0x2d);
					if((_t123 & 0x00000004) == 0) {
						if(( *(E00266BA1(_t116, _t129) + ( *_t133 & 0x000000ff) * 2) & 0x00008000) == 0) {
							_push(1);
							_push(_t133);
							goto L8;
						} else {
							if(_t133 >= _v40) {
								_t131 = _v48;
								 *((char*)( *((intOrPtr*)(0x273f60 + _t131 * 4)) + _t116 + 0x2e)) =  *_t133;
								 *( *((intOrPtr*)(0x273f60 + _t131 * 4)) + _t116 + 0x2d) =  *( *((intOrPtr*)(0x273f60 + _t131 * 4)) + _t116 + 0x2d) | 0x00000004;
								 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 4)) + 1;
							} else {
								_t112 = E00267F6A( &_v28, _t133, 2);
								_t137 = _t137 + 0xc;
								if(_t112 != 0xffffffff) {
									_t133 =  &(_t133[1]);
									goto L9;
								}
							}
						}
					} else {
						_t128 = _t123 & 0x000000fb;
						_v16 =  *((intOrPtr*)(_t129 + _t116 + 0x2e));
						_push(2);
						_v15 = _t128;
						 *(_t129 + _t116 + 0x2d) = _t128;
						_push( &_v16);
						L8:
						_push( &_v28);
						_t94 = E00267F6A();
						_t137 = _t137 + 0xc;
						if(_t94 != 0xffffffff) {
							L9:
							_t133 =  &(_t133[1]);
							_t97 = WideCharToMultiByte(_v60, 0,  &_v28, 1,  &_v24, 5, 0, 0);
							_v56 = _t97;
							if(_t97 != 0) {
								if(WriteFile(_v44,  &_v24, _t97,  &_v36, 0) == 0) {
									L19:
									 *_t135 = GetLastError();
								} else {
									 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 8)) - _v52 + _t133;
									if(_v36 >= _v56) {
										if(_v31 != 0xa) {
											goto L16;
										} else {
											_t105 = 0xd;
											_v32 = _t105;
											if(WriteFile(_v44,  &_v32, 1,  &_v36, 0) == 0) {
												goto L19;
											} else {
												if(_v36 >= 1) {
													 *((intOrPtr*)(_t135 + 8)) =  *((intOrPtr*)(_t135 + 8)) + 1;
													 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 4)) + 1;
													goto L16;
												}
											}
										}
									}
								}
							}
						}
					}
					goto L20;
					L16:
				}
				L20:
				return E002629BB(_v8 ^ _t136);
			}

0x002696b5
0x002696bc
0x002696bf
0x002696c7
0x002696cb
0x002696d7
0x002696da
0x002696dd
0x002696e4
0x002696ec
0x002696ef
0x002696f5
0x002696fb
0x00269700
0x00269702
0x00269705
0x0026970a
0x00269714
0x0026971b
0x0026971e
0x00269725
0x0026972c
0x00269758
0x0026977e
0x00269780
0x00000000
0x0026975a
0x0026975d
0x00269824
0x00269830
0x0026983b
0x00269840
0x00269763
0x0026976a
0x0026976f
0x00269775
0x0026977b
0x00000000
0x0026977b
0x00269775
0x0026975d
0x0026972e
0x00269732
0x00269735
0x0026973b
0x0026973d
0x00269740
0x00269744
0x00269781
0x00269784
0x00269785
0x0026978a
0x00269790
0x00269796
0x002697a5
0x002697ab
0x002697b1
0x002697b6
0x002697d2
0x00269845
0x0026984b
0x002697d4
0x002697dc
0x002697e5
0x002697eb
0x00000000
0x002697ed
0x002697ef
0x002697f2
0x0026980b
0x00000000
0x0026980d
0x00269811
0x00269813
0x00269816
0x00000000
0x00269816
0x00269811
0x0026980b
0x002697eb
0x002697e5
0x002697d2
0x002697b6
0x00269790
0x00000000
0x00269819
0x00269819
0x0026984d
0x0026985f

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,00269E22,?,00000000,?,00000000,00000000), ref: 002696EF
__fassign.LIBCMT ref: 0026976A
__fassign.LIBCMT ref: 00269785
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 002697AB
WriteFile.KERNEL32(?,?,00000000,00269E22,00000000,?,?,?,?,?,?,?,?,?,00269E22,?), ref: 002697CA
WriteFile.KERNEL32(?,?,00000001,00269E22,00000000,?,?,?,?,?,?,?,?,?,00269E22,?), ref: 00269803

Memory Dump Source

Source File: 00000000.00000002.268673362.0000000000261000.00000020.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.268665443.0000000000260000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268687601.000000000026D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268696251.0000000000273000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268711075.0000000000275000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 83a01840890a629c4e2a4222b114a2b19e8a239ae741a9c370d48621211d9045
Instruction ID: 9ab9997cf284bd8a723c4120c8d7c62a48dc0579cdf394286804d6d858ca98e3
Opcode Fuzzy Hash: 83a01840890a629c4e2a4222b114a2b19e8a239ae741a9c370d48621211d9045
Instruction Fuzzy Hash: 9151B371E10209DFCB10CFA8D885AEEBBF8EF0A710F14415AE955E7251DA70A9D1CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00266E4E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00266E4E(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, int _a8, char* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28) {
				signed int _v8;
				int _v12;
				char _v16;
				intOrPtr _v24;
				char _v28;
				void* _v40;
				signed int _t34;
				signed int _t40;
				int _t46;
				int _t53;
				void* _t55;
				int _t57;
				signed int _t63;
				int _t67;
				short* _t69;
				signed int _t70;
				short* _t71;

				_t34 =  *0x273018; // 0x16a19189
				_v8 = _t34 ^ _t70;
				E002647F8(__ebx,  &_v28, __edx, _a4);
				_t57 = _a24;
				if(_t57 == 0) {
					_t53 =  *(_v24 + 8);
					_t57 = _t53;
					_a24 = _t53;
				}
				_t67 = 0;
				_t40 = MultiByteToWideChar(_t57, 1 + (0 | _a28 != 0x00000000) * 8, _a12, _a16, 0, 0);
				_v12 = _t40;
				if(_t40 == 0) {
					L15:
					if(_v16 != 0) {
						 *(_v28 + 0x350) =  *(_v28 + 0x350) & 0xfffffffd;
					}
					return E002629BB(_v8 ^ _t70);
				}
				_t55 = _t40 + _t40;
				_t17 = _t55 + 8; // 0x8
				asm("sbb eax, eax");
				if((_t17 & _t40) == 0) {
					_t69 = 0;
					L11:
					if(_t69 != 0) {
						E00262CE0(_t67, _t69, _t67, _t55);
						_t46 = MultiByteToWideChar(_a24, 1, _a12, _a16, _t69, _v12);
						if(_t46 != 0) {
							_t67 = GetStringTypeW(_a8, _t69, _t46, _a20);
						}
					}
					L14:
					E00266F6B(_t69);
					goto L15;
				}
				_t20 = _t55 + 8; // 0x8
				asm("sbb eax, eax");
				_t48 = _t40 & _t20;
				_t21 = _t55 + 8; // 0x8
				_t63 = _t21;
				if((_t40 & _t20) > 0x400) {
					asm("sbb eax, eax");
					_t69 = E002646B0(_t63, _t48 & _t63);
					if(_t69 == 0) {
						goto L14;
					}
					 *_t69 = 0xdddd;
					L9:
					_t69 =  &(_t69[4]);
					goto L11;
				}
				asm("sbb eax, eax");
				E0026BFA0();
				_t69 = _t71;
				if(_t69 == 0) {
					goto L14;
				}
				 *_t69 = 0xcccc;
				goto L9;
			}

0x00266e56
0x00266e5d
0x00266e69
0x00266e6e
0x00266e73
0x00266e78
0x00266e7b
0x00266e7d
0x00266e7d
0x00266e82
0x00266e9b
0x00266ea1
0x00266ea6
0x00266f45
0x00266f49
0x00266f4e
0x00266f4e
0x00266f6a
0x00266f6a
0x00266eac
0x00266eaf
0x00266eb4
0x00266eb8
0x00266f04
0x00266f06
0x00266f08
0x00266f0d
0x00266f24
0x00266f2c
0x00266f3c
0x00266f3c
0x00266f2c
0x00266f3e
0x00266f3f
0x00000000
0x00266f44
0x00266eba
0x00266ebf
0x00266ec1
0x00266ec3
0x00266ec3
0x00266ecb
0x00266ee8
0x00266ef2
0x00266ef7
0x00000000
0x00000000
0x00266ef9
0x00266eff
0x00266eff
0x00000000
0x00266eff
0x00266ecf
0x00266ed3
0x00266ed8
0x00266edc
0x00000000
0x00000000
0x00266ede
0x00000000

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000100,00000020,00000000,00000000,?,00000100,W\&,00000000,00000001,00000020,00000100,?,?,00000000), ref: 00266E9B
__alloca_probe_16.LIBCMT ref: 00266ED3
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00266F24
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00266F36
__freea.LIBCMT ref: 00266F3F

Part of subcall function 002646B0: HeapAlloc.KERNEL32(00000000,?,00000004,?,00268CDE,?,00000000,?,00267370,?,00000004,00000000,?,?,?,0026437B), ref: 002646E2

Strings

W\&, xrefs: 00266E61

Memory Dump Source

Source File: 00000000.00000002.268673362.0000000000261000.00000020.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.268665443.0000000000260000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268687601.000000000026D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268696251.0000000000273000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268711075.0000000000275000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeapStringType__alloca_probe_16__freea
String ID: W\&
API String ID: 1857427562-1387361922
Opcode ID: cca6bc33cd76bd1b9e7f245ecc5d17f5535ac08f3914a20ca6f2c1e96b13fb4a
Instruction ID: 39dcb7cd0fb2784a1cb8ab69a8150955550f694fa09c5ede622078be21596546
Opcode Fuzzy Hash: cca6bc33cd76bd1b9e7f245ecc5d17f5535ac08f3914a20ca6f2c1e96b13fb4a
Instruction Fuzzy Hash: 3131E132A2020AABDF259F65EC49DAE7BA5EF40310F054129FC05D6250EB35CDA5CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00263E82 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00263E77,00000003,?,00263E17,00000003,00271DE8,0000000C,00263F2A,00000003,00000002), ref: 00263EA2
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00263EB5
FreeLibrary.KERNEL32(00000000,?,?,?,00263E77,00000003,?,00263E17,00000003,00271DE8,0000000C,00263F2A,00000003,00000002,00000000), ref: 00263ED8

Strings

mscoree.dll, xrefs: 00263E9B
CorExitProcess, xrefs: 00263EAD

Memory Dump Source

Source File: 00000000.00000002.268673362.0000000000261000.00000020.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.268665443.0000000000260000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268687601.000000000026D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268696251.0000000000273000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268711075.0000000000275000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 1e3e832be9080082fd7db613749d6674b6eca1a80f2129bad3be4517cdc0da5c
Instruction ID: 0bed24f7fd3fb98934fe6d9236fb5bfe959acb8e98a2780c8860cf0cdd5d304f
Opcode Fuzzy Hash: 1e3e832be9080082fd7db613749d6674b6eca1a80f2129bad3be4517cdc0da5c
Instruction Fuzzy Hash: D7F04F30B1060DBBCB119F95EC0DB9EBFB9EF48711F014065F809A2190DB718A91DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00265D94 Relevance: 6.1, APIs: 4, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00265D94() {
				int _v8;
				void* __ecx;
				void* _t6;
				int _t7;
				char* _t13;
				int _t17;
				void* _t19;
				char* _t25;
				WCHAR* _t27;

				_t27 = GetEnvironmentStringsW();
				if(_t27 == 0) {
					L7:
					_t13 = 0;
				} else {
					_t6 = E00265D5D(_t27);
					_pop(_t19);
					_t17 = _t6 - _t27 >> 1;
					_t7 = WideCharToMultiByte(0, 0, _t27, _t17, 0, 0, 0, 0);
					_v8 = _t7;
					if(_t7 == 0) {
						goto L7;
					} else {
						_t25 = E002646B0(_t19, _t7);
						if(_t25 == 0 || WideCharToMultiByte(0, 0, _t27, _t17, _t25, _v8, 0, 0) == 0) {
							_t13 = 0;
						} else {
							_t13 = _t25;
							_t25 = 0;
						}
						E00264676(_t25);
					}
				}
				if(_t27 != 0) {
					FreeEnvironmentStringsW(_t27);
				}
				return _t13;
			}

0x00265da3
0x00265da9
0x00265e01
0x00265e01
0x00265dab
0x00265dac
0x00265db1
0x00265dba
0x00265dc0
0x00265dc6
0x00265dcb
0x00000000
0x00265dcd
0x00265dd3
0x00265dd8
0x00265df6
0x00265df0
0x00265df0
0x00265df2
0x00265df2
0x00265df9
0x00265dfe
0x00265dcb
0x00265e05
0x00265e08
0x00265e08
0x00265e16

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00265D9D
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00265DC0

Part of subcall function 002646B0: HeapAlloc.KERNEL32(00000000,?,00000004,?,00268CDE,?,00000000,?,00267370,?,00000004,00000000,?,?,?,0026437B), ref: 002646E2

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00265DE6
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00265E08

Memory Dump Source

Source File: 00000000.00000002.268673362.0000000000261000.00000020.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.268665443.0000000000260000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268687601.000000000026D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268696251.0000000000273000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268711075.0000000000275000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocFreeHeap
String ID:
API String ID: 1993637811-0
Opcode ID: 76ed4cde9dfe343071b43692a0c63a05511953a0282e956d668d2d38d5439fa8
Instruction ID: cc6247097d8f34e0be9506594a5a024d10720bd81d2b743ff46b18356e82f57b
Opcode Fuzzy Hash: 76ed4cde9dfe343071b43692a0c63a05511953a0282e956d668d2d38d5439fa8
Instruction Fuzzy Hash: 6601AC72A21A657F67211ABA6C8CC7F6D6DDFC7B607144129FD04C6240DEB18E6185F0

Uniqueness

Uniqueness Score: -1.00%

Function 002662B8 Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E002662B8(signed int _a4) {
				signed int _t9;
				void* _t13;
				signed int _t15;
				WCHAR* _t22;
				signed int _t24;
				signed int* _t25;
				void* _t27;

				_t9 = _a4;
				_t25 = 0x273e88 + _t9 * 4;
				_t24 =  *_t25;
				if(_t24 == 0) {
					_t22 =  *(0x26dd68 + _t9 * 4);
					_t27 = LoadLibraryExW(_t22, 0, 0x800);
					if(_t27 != 0) {
						L8:
						 *_t25 = _t27;
						if( *_t25 != 0) {
							FreeLibrary(_t27);
						}
						_t13 = _t27;
						L11:
						return _t13;
					}
					_t15 = GetLastError();
					if(_t15 != 0x57) {
						_t27 = 0;
					} else {
						_t15 = LoadLibraryExW(_t22, _t27, _t27);
						_t27 = _t15;
					}
					if(_t27 != 0) {
						goto L8;
					} else {
						 *_t25 = _t15 | 0xffffffff;
						_t13 = 0;
						goto L11;
					}
				}
				_t4 = _t24 + 1; // 0x16a1918a
				asm("sbb eax, eax");
				return  ~_t4 & _t24;
			}

0x002662bd
0x002662c1
0x002662c8
0x002662cc
0x002662da
0x002662f0
0x002662f4
0x0026631d
0x0026631f
0x00266323
0x00266326
0x00266326
0x0026632c
0x0026632e
0x00000000
0x0026632f
0x002662f6
0x002662ff
0x0026630e
0x00266301
0x00266304
0x0026630a
0x0026630a
0x00266312
0x00000000
0x00266314
0x00266317
0x00266319
0x00000000
0x00266319
0x00266312
0x002662ce
0x002662d3
0x00000000

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,0026625F,00000000,00000000,00000000,00000000,?,002664D0,00000006,FlsSetValue), ref: 002662EA
GetLastError.KERNEL32(?,0026625F,00000000,00000000,00000000,00000000,?,002664D0,00000006,FlsSetValue,0026E238,0026E240,00000000,00000364,?,00264D1C), ref: 002662F6
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0026625F,00000000,00000000,00000000,00000000,?,002664D0,00000006,FlsSetValue,0026E238,0026E240,00000000), ref: 00266304

Memory Dump Source

Source File: 00000000.00000002.268673362.0000000000261000.00000020.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.268665443.0000000000260000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268687601.000000000026D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268696251.0000000000273000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268711075.0000000000275000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 869576cca074a11acf64842192cdcd2ddaf645ba1259f048e3f81e6abcc04f6d
Instruction ID: 6232e0c0471b2493acab9d21eda24b251f48decafaf381deb73604ef5f051c5e
Opcode Fuzzy Hash: 869576cca074a11acf64842192cdcd2ddaf645ba1259f048e3f81e6abcc04f6d
Instruction Fuzzy Hash: 4801F736B21377ABC7215E78BC4CA567B58AF05FA0F204561F90AD3280C761D8B1C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 00264C4A Relevance: 6.0, APIs: 4, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E00264C4A(void* __ebx, void* __ecx, void* __edx) {
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				void* _t3;
				void* _t4;
				intOrPtr _t9;
				void* _t11;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t31;
				void* _t32;
				long _t36;
				long _t37;
				void* _t40;

				_t29 = __edx;
				_t23 = __ecx;
				_t20 = __ebx;
				_t36 = GetLastError();
				_t2 =  *0x273044; // 0x6
				_t42 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t3 = E0026479B(_t23, 1, 0x364);
					_t31 = _t3;
					_pop(_t25);
					if(_t31 != 0) {
						_t4 = E002664A9(_t25, _t36, __eflags,  *0x273044, _t31);
						__eflags = _t4;
						if(_t4 != 0) {
							E00264ABC(_t25, _t31, 0x274164);
							E00264676(0);
							_t40 = _t40 + 0xc;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t31);
							goto L4;
						}
					} else {
						_push(_t3);
						L4:
						E00264676();
						_pop(_t25);
						L9:
						SetLastError(_t36);
						E00264758(_t20, _t29, _t31, _t36);
						asm("int3");
						_push(_t20);
						_push(_t36);
						_push(_t31);
						_t37 = GetLastError();
						_t21 = 0;
						_t9 =  *0x273044; // 0x6
						_t45 = _t9 - 0xffffffff;
						if(_t9 == 0xffffffff) {
							L12:
							_t32 = E0026479B(_t25, 1, 0x364);
							_pop(_t27);
							if(_t32 != 0) {
								_t11 = E002664A9(_t27, _t37, __eflags,  *0x273044, _t32);
								__eflags = _t11;
								if(_t11 != 0) {
									E00264ABC(_t27, _t32, 0x274164);
									E00264676(_t21);
									__eflags = _t32;
									if(_t32 != 0) {
										goto L19;
									} else {
										goto L18;
									}
								} else {
									_push(_t32);
									goto L14;
								}
							} else {
								_push(_t21);
								L14:
								E00264676();
								L18:
								SetLastError(_t37);
							}
						} else {
							_t32 = E00266453(_t25, _t37, _t45, _t9);
							if(_t32 != 0) {
								L19:
								SetLastError(_t37);
								_t21 = _t32;
							} else {
								goto L12;
							}
						}
						return _t21;
					}
				} else {
					_t31 = E00266453(_t23, _t36, _t42, _t2);
					if(_t31 != 0) {
						L8:
						SetLastError(_t36);
						return _t31;
					} else {
						goto L2;
					}
				}
			}

0x00264c4a
0x00264c4a
0x00264c4a
0x00264c54
0x00264c56
0x00264c5b
0x00264c5e
0x00264c6c
0x00264c73
0x00264c78
0x00264c7b
0x00264c7e
0x00264c90
0x00264c95
0x00264c97
0x00264ca2
0x00264ca9
0x00264cae
0x00264cb1
0x00264cb3
0x00000000
0x00000000
0x00000000
0x00000000
0x00264c99
0x00264c99
0x00000000
0x00264c99
0x00264c80
0x00264c80
0x00264c81
0x00264c81
0x00264c86
0x00264cc1
0x00264cc2
0x00264cc8
0x00264ccd
0x00264cd0
0x00264cd1
0x00264cd2
0x00264cd9
0x00264cdb
0x00264cdd
0x00264ce2
0x00264ce5
0x00264cf3
0x00264cff
0x00264d02
0x00264d05
0x00264d17
0x00264d1c
0x00264d1e
0x00264d29
0x00264d2f
0x00264d37
0x00264d39
0x00000000
0x00000000
0x00000000
0x00000000
0x00264d20
0x00264d20
0x00000000
0x00264d20
0x00264d07
0x00264d07
0x00264d08
0x00264d08
0x00264d3b
0x00264d3c
0x00264d3c
0x00264ce7
0x00264ced
0x00264cf1
0x00264d44
0x00264d45
0x00264d4b
0x00000000
0x00000000
0x00000000
0x00264cf1
0x00264d52
0x00264d52
0x00264c60
0x00264c66
0x00264c6a
0x00264cb5
0x00264cb6
0x00264cc0
0x00000000
0x00000000
0x00000000
0x00264c6a

APIs

GetLastError.KERNEL32(?,?,0026464B,00271E70,0000000C,00262746), ref: 00264C4E
SetLastError.KERNEL32(00000000), ref: 00264CB6
SetLastError.KERNEL32(00000000), ref: 00264CC2
_abort.LIBCMT ref: 00264CC8

Memory Dump Source

Source File: 00000000.00000002.268673362.0000000000261000.00000020.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.268665443.0000000000260000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268687601.000000000026D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268696251.0000000000273000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268711075.0000000000275000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: ErrorLast$_abort
String ID:
API String ID: 88804580-0
Opcode ID: 82d340f4e564f17cc91e2c65371d745acc6dda8953eb7050a86b12bff6069027
Instruction ID: c0a1e4825a3a27ba85d700c26d5ebc424a388352a838c2e4fc84216bb02b81b8
Opcode Fuzzy Hash: 82d340f4e564f17cc91e2c65371d745acc6dda8953eb7050a86b12bff6069027
Instruction Fuzzy Hash: 92F028366316017AC6127B38BD0EF1B2A598FC2730F254115F89892392EF61CDF25860

Uniqueness

Uniqueness Score: -1.00%

Function 00262C96 Relevance: 6.0, APIs: 4, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00262C96() {
				void* _t4;
				void* _t8;

				E00263315();
				E002632A9();
				if(E00263009() != 0) {
					_t4 = E00262FBB(_t8, __eflags);
					__eflags = _t4;
					if(_t4 != 0) {
						return 1;
					} else {
						E00263045();
						goto L1;
					}
				} else {
					L1:
					return 0;
				}
			}

0x00262c96
0x00262c9b
0x00262ca7
0x00262cac
0x00262cb1
0x00262cb3
0x00262cbe
0x00262cb5
0x00262cb5
0x00000000
0x00262cb5
0x00262ca9
0x00262ca9
0x00262cab
0x00262cab

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00262C96
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00262C9B
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00262CA0

Part of subcall function 00263009: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 0026301A

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00262CB5

Memory Dump Source

Source File: 00000000.00000002.268673362.0000000000261000.00000020.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.268665443.0000000000260000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268687601.000000000026D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268696251.0000000000273000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268711075.0000000000275000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: b1b90c0d53e394bb07de617adf9d7015355adfa0c29a78e449e0bafd0537e884
Instruction ID: b00f0dc759edb05f9e3cfb45e8f109a6409cea188fa363a7a031f599eb2c8058
Opcode Fuzzy Hash: b1b90c0d53e394bb07de617adf9d7015355adfa0c29a78e449e0bafd0537e884
Instruction Fuzzy Hash: 20C04818030A42E4AC60BBB12A131AD23100EA2786B9218C6EC5027593DE1B0BFE6D32

Uniqueness

Uniqueness Score: -1.00%

Function 00265725 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00265725(void* __ebx, signed int __edx, void* __edi, void* __esi, char _a4) {
				signed int _v8;
				char _v264;
				char _v520;
				char _v776;
				char _v1800;
				char _v1814;
				struct _cpinfo _v1820;
				intOrPtr _v1824;
				signed int _v1828;
				signed int _t63;
				void* _t67;
				signed int _t68;
				intOrPtr _t69;
				void* _t72;
				char _t73;
				char _t74;
				signed char _t75;
				signed int _t76;
				signed char _t86;
				char _t87;
				char _t90;
				signed int _t93;
				signed int _t94;
				signed int _t95;
				void* _t96;
				char* _t97;
				intOrPtr _t101;
				signed int _t102;

				_t95 = __edx;
				_t63 =  *0x273018; // 0x16a19189
				_v8 = _t63 ^ _t102;
				_t2 =  &_a4; // 0x265c57
				_t101 =  *_t2;
				if(GetCPInfo( *(_t101 + 4),  &_v1820) == 0) {
					_t96 = _t101 + 0x119;
					_t90 = 0;
					_t67 = 0xffffff9f;
					_t68 = _t67 - _t96;
					__eflags = _t68;
					_v1828 = _t68;
					do {
						_t97 = _t96 + _t90;
						_t69 = _t68 + _t97;
						_v1824 = _t69;
						__eflags = _t69 + 0x20 - 0x19;
						if(_t69 + 0x20 > 0x19) {
							__eflags = _v1824 - 0x19;
							if(_v1824 > 0x19) {
								 *_t97 = 0;
							} else {
								_t72 = _t101 + _t90;
								_t57 = _t72 + 0x19;
								 *_t57 =  *(_t72 + 0x19) | 0x00000020;
								__eflags =  *_t57;
								_t59 = _t90 - 0x20; // -32
								_t73 = _t59;
								goto L24;
							}
						} else {
							 *(_t101 + _t90 + 0x19) =  *(_t101 + _t90 + 0x19) | 0x00000010;
							_t54 = _t90 + 0x20; // 0x20
							_t73 = _t54;
							L24:
							 *_t97 = _t73;
						}
						_t68 = _v1828;
						_t96 = _t101 + 0x119;
						_t90 = _t90 + 1;
						__eflags = _t90 - 0x100;
					} while (_t90 < 0x100);
				} else {
					_t74 = 0;
					do {
						 *((char*)(_t102 + _t74 - 0x104)) = _t74;
						_t74 = _t74 + 1;
					} while (_t74 < 0x100);
					_t75 = _v1814;
					_t93 =  &_v1814;
					_v264 = 0x20;
					while(1) {
						_t108 = _t75;
						if(_t75 == 0) {
							break;
						}
						_t95 =  *(_t93 + 1) & 0x000000ff;
						_t76 = _t75 & 0x000000ff;
						while(1) {
							__eflags = _t76 - _t95;
							if(_t76 > _t95) {
								break;
							}
							__eflags = _t76 - 0x100;
							if(_t76 < 0x100) {
								 *((char*)(_t102 + _t76 - 0x104)) = 0x20;
								_t76 = _t76 + 1;
								__eflags = _t76;
								continue;
							}
							break;
						}
						_t93 = _t93 + 2;
						__eflags = _t93;
						_t75 =  *_t93;
					}
					E00266E4E(0, _t95, 0x100, _t101, _t108, 0, 1,  &_v264, 0x100,  &_v1800,  *(_t101 + 4), 0);
					E00268A70(0x100, _t101, _t108, 0,  *((intOrPtr*)(_t101 + 0x21c)), 0x100,  &_v264, 0x100,  &_v520, 0x100,  *(_t101 + 4), 0);
					E00268A70(0x100, _t101, _t108, 0,  *((intOrPtr*)(_t101 + 0x21c)), 0x200,  &_v264, 0x100,  &_v776, 0x100,  *(_t101 + 4), 0);
					_t94 = 0;
					do {
						_t86 =  *(_t102 + _t94 * 2 - 0x704) & 0x0000ffff;
						if((_t86 & 0x00000001) == 0) {
							__eflags = _t86 & 0x00000002;
							if((_t86 & 0x00000002) == 0) {
								 *((char*)(_t101 + _t94 + 0x119)) = 0;
							} else {
								_t37 = _t101 + _t94 + 0x19;
								 *_t37 =  *(_t101 + _t94 + 0x19) | 0x00000020;
								__eflags =  *_t37;
								_t87 =  *((intOrPtr*)(_t102 + _t94 - 0x304));
								goto L15;
							}
						} else {
							 *(_t101 + _t94 + 0x19) =  *(_t101 + _t94 + 0x19) | 0x00000010;
							_t87 =  *((intOrPtr*)(_t102 + _t94 - 0x204));
							L15:
							 *((char*)(_t101 + _t94 + 0x119)) = _t87;
						}
						_t94 = _t94 + 1;
					} while (_t94 < 0x100);
				}
				return E002629BB(_v8 ^ _t102);
			}

0x00265725
0x00265730
0x00265737
0x0026573c
0x0026573c
0x00265759
0x00265851
0x00265857
0x00265859
0x0026585a
0x0026585a
0x0026585c
0x00265862
0x00265862
0x00265864
0x00265866
0x0026586f
0x00265872
0x0026587e
0x00265885
0x00265895
0x00265887
0x00265887
0x0026588a
0x0026588a
0x0026588a
0x0026588e
0x0026588e
0x00000000
0x0026588e
0x00265874
0x00265874
0x00265879
0x00265879
0x00265891
0x00265891
0x00265891
0x00265897
0x0026589d
0x002658a3
0x002658a4
0x002658a4
0x0026575f
0x0026575f
0x00265761
0x00265761
0x00265768
0x00265769
0x0026576d
0x00265773
0x00265779
0x002657a1
0x002657a1
0x002657a3
0x00000000
0x00000000
0x00265782
0x00265786
0x00265798
0x00265798
0x0026579a
0x00000000
0x00000000
0x0026578b
0x0026578d
0x0026578f
0x00265797
0x00265797
0x00000000
0x00265797
0x00000000
0x0026578d
0x0026579c
0x0026579c
0x0026579f
0x0026579f
0x002657bb
0x002657dc
0x00265804
0x0026580c
0x0026580e
0x0026580e
0x00265818
0x00265828
0x0026582a
0x00265841
0x0026582c
0x0026582c
0x0026582c
0x0026582c
0x00265831
0x00000000
0x00265831
0x0026581a
0x0026581a
0x0026581f
0x00265838
0x00265838
0x00265838
0x00265848
0x00265849
0x0026584d
0x002658b8

APIs

GetCPInfo.KERNEL32(?,?,00000005,?,00000000), ref: 0026574A

Strings

, xrefs: 0026578F
W\&, xrefs: 0026573C

Memory Dump Source

Source File: 00000000.00000002.268673362.0000000000261000.00000020.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.268665443.0000000000260000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268687601.000000000026D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268696251.0000000000273000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268711075.0000000000275000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: Info
String ID: $W\&
API String ID: 1807457897-2235781088
Opcode ID: b7c4f52ae674a20d6a2b737af35fbe9d94f9b69e5ec37e8d236280ebd1dc815a
Instruction ID: af64aec6933f7bf4dcacf6cd2847c49bc8f82f8f3bd770fac1e6fd6c12ed95f6
Opcode Fuzzy Hash: b7c4f52ae674a20d6a2b737af35fbe9d94f9b69e5ec37e8d236280ebd1dc815a
Instruction Fuzzy Hash: 37411A705147A89BDB228E64CC84BFABBADEB45308F1404EDE58A87142D2359AD5DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00267008 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00267008(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0x273648) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E00264676(_t46);
							E00266BC7( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E00264676(_t47);
							E00266CC5( *((intOrPtr*)(_t74 + 0x88)));
						}
						E00264676( *((intOrPtr*)(_t74 + 0x7c)));
						E00264676( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E00264676( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E00264676( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E00264676( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E00264676( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E0026717B( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x273638) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E00264676(_t31);
							E00264676( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E00264676(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E00264676(_t74);
			}

0x00267010
0x00267014
0x0026701c
0x00267025
0x0026702a
0x00267031
0x00267039
0x00267041
0x0026704c
0x00267052
0x00267053
0x0026705b
0x00267063
0x0026706e
0x00267074
0x00267078
0x00267083
0x00267089
0x0026702a
0x0026708a
0x00267092
0x002670a5
0x002670b8
0x002670c6
0x002670d1
0x002670d6
0x002670df
0x002670e7
0x002670e8
0x002670ee
0x002670f1
0x002670f4
0x002670fb
0x002670fd
0x00267101
0x00267109
0x00267110
0x00267116
0x00267117
0x00267117
0x0026711e
0x00267120
0x00267125
0x0026712d
0x00267132
0x00267133
0x00267133
0x00267136
0x00267139
0x0026713c
0x0026713f
0x0026713f
0x00267151

APIs

Part of subcall function 00264676: HeapFree.KERNEL32(00000000,00000000,?,00266D5C,?,00000000,?,00000000,?,00266D83,?,00000007,?,?,002671A0,?), ref: 0026468C
Part of subcall function 00264676: GetLastError.KERNEL32(?,?,00266D5C,?,00000000,?,00000000,?,00266D83,?,00000007,?,?,002671A0,?,?), ref: 0026469E

___free_lconv_mon.LIBCMT ref: 0026704C

Strings

H6', xrefs: 0026701E
86', xrefs: 002670F4

Memory Dump Source

Source File: 00000000.00000002.268673362.0000000000261000.00000020.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.268665443.0000000000260000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268687601.000000000026D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268696251.0000000000273000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268711075.0000000000275000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: ErrorFreeHeapLast___free_lconv_mon
String ID: 86'$H6'
API String ID: 4068849827-3673023456
Opcode ID: 573fa373422200d2e1b05edf697862e32f2f17e8cc7402b457796e532929bc92
Instruction ID: 95771267e7f82dff7fdccc1dd0f54122ab7ffda271c8586fb0243569bd653d88
Opcode Fuzzy Hash: 573fa373422200d2e1b05edf697862e32f2f17e8cc7402b457796e532929bc92
Instruction Fuzzy Hash: BC318131524306AFEB30AE38E845F56B3E9EF01364F10945AF498D7291DF31ADE08B64

Uniqueness

Uniqueness Score: -1.00%

Function 002629BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E002629BB(void* __ecx, struct _EXCEPTION_POINTERS* _a4) {

				asm("repne jnz 0x5");
				asm("repne ret");
				asm("repne jmp 0x2e");
				SetUnhandledExceptionFilter(0);
				UnhandledExceptionFilter(_a4);
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x002629c1
0x002629c4
0x002629c6
0x002629d1
0x002629da
0x002629f3

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 002629FF
___raise_securityfailure.LIBCMT ref: 00262AE6

Strings

7', xrefs: 00262AE1

Memory Dump Source

Source File: 00000000.00000002.268673362.0000000000261000.00000020.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.268665443.0000000000260000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268687601.000000000026D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268696251.0000000000273000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.268711075.0000000000275000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_692BB93169319EBA2F556174D781A8636D610A67E6838.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 7'
API String ID: 3761405300-3510403523
Opcode ID: 1d5acf04c4619cb5f5ade7bff8e575651fda13b3d32257f44a8a6f8cbd6082e7
Instruction ID: cbc95e0f854bd962945d6313ee6b166a1953d7142782bf61e70552959614c19d
Opcode Fuzzy Hash: 1d5acf04c4619cb5f5ade7bff8e575651fda13b3d32257f44a8a6f8cbd6082e7
Instruction Fuzzy Hash: 6621EFF4661202EAD314DF15F94AA54BBE4FB48310F14506AF95C8B3A0E3B19AC5EF46

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 5596, Parent PID: 5844COMMON

Execution Graph

Execution Coverage:	14%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	283
Total number of Limit Nodes:	25

Executed Functions

Function 064C2710 Relevance: 1.7, APIs: 1, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.513968175.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_64c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36d2bac85079fd26bbdb6eebd69a17f0567ac80cb825f194865fe0e922054fe1
Instruction ID: 3a6990b83a87128883d35db871b93bd46521825587bf7c825846d80ad13b4c06
Opcode Fuzzy Hash: 36d2bac85079fd26bbdb6eebd69a17f0567ac80cb825f194865fe0e922054fe1
Instruction Fuzzy Hash: 11814775D00209CFDB50DFA9D880ADEBBB1FF49324F24852ED815AB350DBB49A46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 052893E8 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0528962E

Memory Dump Source

Source File: 00000003.00000002.512983718.0000000005280000.00000040.00000800.00020000.00000000.sdmp, Offset: 05280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5280000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 26ca5a99a1b696bacf892ec10484ffeaa4af3bb1c3cc516656d8a767fe401c8a
Instruction ID: 679185e6800bc8a720fd8d6bae56474a68351090ac296afdcb76447da8767358
Opcode Fuzzy Hash: 26ca5a99a1b696bacf892ec10484ffeaa4af3bb1c3cc516656d8a767fe401c8a
Instruction Fuzzy Hash: F6711470A11B058FD724EF6AD445B6ABBF1BF88204F00892DD58AD7B90D774E849CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0528FB61 Relevance: 1.7, APIs: 1, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0528FD0A

Memory Dump Source

Source File: 00000003.00000002.512983718.0000000005280000.00000040.00000800.00020000.00000000.sdmp, Offset: 05280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5280000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 51d178dc7a0d44b67cbed7918c1b2e9b893b805ef4a13db186e44e81c4fb3fa2
Instruction ID: b8e33509e291c295633d399b1bb592244c105efb94396bd1a4cf819e40be368e
Opcode Fuzzy Hash: 51d178dc7a0d44b67cbed7918c1b2e9b893b805ef4a13db186e44e81c4fb3fa2
Instruction Fuzzy Hash: 016123B1C14289AFCF02CFA9D984ADDBFB1FF49304F29815AE858AB261D7349945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 064C27BC Relevance: 1.6, APIs: 1, Instructions: 140
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DnsQuery_A.DNSAPI(?,?,?,?,?,?), ref: 064C28F0

Memory Dump Source

Source File: 00000003.00000002.513968175.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_64c0000_RegAsm.jbxd

Similarity

API ID: Query_
String ID:
API String ID: 428220571-0
Opcode ID: 2dfecb64ff034d644c14c69990b6f5e42e2428027406dcb08868f8ce85dc95c8
Instruction ID: 49f88f14014a867960b988af847a4afce04408f2572675cb41b5f105e27e33ee
Opcode Fuzzy Hash: 2dfecb64ff034d644c14c69990b6f5e42e2428027406dcb08868f8ce85dc95c8
Instruction Fuzzy Hash: 2B511375D002598FDB50CFA9D880ADEBBB1BF48714F24812EE814AB350DBB49A46CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0528DA04 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0528FD0A

Memory Dump Source

Source File: 00000003.00000002.512983718.0000000005280000.00000040.00000800.00020000.00000000.sdmp, Offset: 05280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5280000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: aa77246ce5ea0f3eae35c8e6a5f2e69f5fc739f2f3bb96bdbe3fd2c7b15f9406
Instruction ID: f033ebde3298e0cb705e22933d8ee88c673f6c8136c181456b18400fd3c231b8
Opcode Fuzzy Hash: aa77246ce5ea0f3eae35c8e6a5f2e69f5fc739f2f3bb96bdbe3fd2c7b15f9406
Instruction Fuzzy Hash: 2351BEB1D10309EFDB14CF99C984AEEBBB5BF48314F24812AE919AB250D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0528A14C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0528BCC6,?,?,?,?,?), ref: 0528BD87

Memory Dump Source

Source File: 00000003.00000002.512983718.0000000005280000.00000040.00000800.00020000.00000000.sdmp, Offset: 05280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5280000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8de46ace49c77b8e7526bd75f5a8eafbf8009468d7609ad9acfb362cef249d3e
Instruction ID: fad9c2dadc97201589dc4255f08b3275b16e1488c5b5e1d32f46d57f86967bc4
Opcode Fuzzy Hash: 8de46ace49c77b8e7526bd75f5a8eafbf8009468d7609ad9acfb362cef249d3e
Instruction Fuzzy Hash: 2121E3B5904249AFDB10CF99D884AEEBBF4FF48314F14841AE958A3350D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0528BCF9 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0528BCC6,?,?,?,?,?), ref: 0528BD87

Memory Dump Source

Source File: 00000003.00000002.512983718.0000000005280000.00000040.00000800.00020000.00000000.sdmp, Offset: 05280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5280000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3874517441988043b1902305824c59456bd8e65c40230f43b747dea86abee866
Instruction ID: e988a6e2fa1036fce4ff44135b3b44c35032a40c83b8b0918ea94d8e599ce08f
Opcode Fuzzy Hash: 3874517441988043b1902305824c59456bd8e65c40230f43b747dea86abee866
Instruction Fuzzy Hash: 3421E5B5900249AFDB10CF99D884AEEBFF4EB49314F14841AE954A3250D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05288768 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,052896A9,00000800,00000000,00000000), ref: 052898BA

Memory Dump Source

Source File: 00000003.00000002.512983718.0000000005280000.00000040.00000800.00020000.00000000.sdmp, Offset: 05280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5280000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6914461865381251d79c41f1f89a6ea53ed22ebe90a9d4561228f45447392709
Instruction ID: 6d2b7347acbbd5fb693f5d7ed6ba2a1c3e0b9a9157509b97c847d59bd47236d7
Opcode Fuzzy Hash: 6914461865381251d79c41f1f89a6ea53ed22ebe90a9d4561228f45447392709
Instruction Fuzzy Hash: CA1106B59042499FCB10DF9AC844BEEFBF4EF48314F14842AD519B7640C374A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05289849 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,052896A9,00000800,00000000,00000000), ref: 052898BA

Memory Dump Source

Source File: 00000003.00000002.512983718.0000000005280000.00000040.00000800.00020000.00000000.sdmp, Offset: 05280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5280000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7c094254a81cc1602147c503eac6eeaeff691de6d3613cd0844543672d88cd64
Instruction ID: 1b2143060366e6f7ee358a740b16bf1c2ce4aef259e5df3ff6da8fdf8266352b
Opcode Fuzzy Hash: 7c094254a81cc1602147c503eac6eeaeff691de6d3613cd0844543672d88cd64
Instruction Fuzzy Hash: 1A1114B6C042098FCB10CFA9C848BEEFBF4AF48314F15882AD529B7600C378A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 052895C8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0528962E

Memory Dump Source

Source File: 00000003.00000002.512983718.0000000005280000.00000040.00000800.00020000.00000000.sdmp, Offset: 05280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5280000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a6838614d8099e2a5f4f212b549def7b4adef180bb81132a7752eef3ef77bd84
Instruction ID: 266286fefa2b94afca845daf0a2b82817f66d47f30bec6f263d7f0c21b4d2d74
Opcode Fuzzy Hash: a6838614d8099e2a5f4f212b549def7b4adef180bb81132a7752eef3ef77bd84
Instruction Fuzzy Hash: 3311E0B5C002598FCB10CF9AC444BEEFBF4AF89214F14C41AD829B7640D378A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0528DA3C Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,0528FE28,?,?,?,?), ref: 0528FE9D

Memory Dump Source

Source File: 00000003.00000002.512983718.0000000005280000.00000040.00000800.00020000.00000000.sdmp, Offset: 05280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5280000_RegAsm.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 737ce399f674d90fc27891b280b2adf5584039ed4eb4429ef9320132e60ba098
Instruction ID: 7f6139a975a9de710614797fc51bde47ecc4a65f5d050c692a1c1f26266e933e
Opcode Fuzzy Hash: 737ce399f674d90fc27891b280b2adf5584039ed4eb4429ef9320132e60ba098
Instruction Fuzzy Hash: E11103B59102499FDB10DF99D584BEEFBF8EB48324F20841AE919B7341C3B4A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0528FE38 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,0528FE28,?,?,?,?), ref: 0528FE9D

Memory Dump Source

Source File: 00000003.00000002.512983718.0000000005280000.00000040.00000800.00020000.00000000.sdmp, Offset: 05280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5280000_RegAsm.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: b8718fb7163689ad5abf35e5f54f158a54b2fca5c377606b7fe7173cf3b2a5c6
Instruction ID: 2cc1ad669782c11fb1db5ae85cc3dca28c706c54ceba752469499283f5989e01
Opcode Fuzzy Hash: b8718fb7163689ad5abf35e5f54f158a54b2fca5c377606b7fe7173cf3b2a5c6
Instruction Fuzzy Hash: 251106B5800249CFDB10CF99D589BEEFBF4EB48314F24881AD955B3640C374A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F5D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.509616179.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f5d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e645f06323adac951954ce958b7c73a4c0e68b3ae77ae6c9e8148f8e12f7448
Instruction ID: 09fe0bdbcd644265792779c14b8a499cc2eaa3620440b2258b667d6c9d0e3650
Opcode Fuzzy Hash: 8e645f06323adac951954ce958b7c73a4c0e68b3ae77ae6c9e8148f8e12f7448
Instruction Fuzzy Hash: BE2106B1905240DFDB25CF14D8C0B26BB61FB98329F28C569DE054B216C336D859EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F6D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.509678155.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f6d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77af7af3712ead8348e3f0c896e24769011365aecd88a4086b834aceca7b9a88
Instruction ID: 47a9bb846b6adfd346c709a87c59194e07c6b31aaec42f8027d0e1c5268223eb
Opcode Fuzzy Hash: 77af7af3712ead8348e3f0c896e24769011365aecd88a4086b834aceca7b9a88
Instruction Fuzzy Hash: 2121B375B08240EFDB14CF14D8C4B26BB65EB88328F24C569D9494B24AC33AD846DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F6D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.509678155.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f6d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66b7894a2f1f3a16001a6845a4eaf50f8e8dff5a4c9319d6187a37b8716f9129
Instruction ID: c5829f5d5d8667bc86f42b1da2e786d060ea36600de519fc62dc893a06a63381
Opcode Fuzzy Hash: 66b7894a2f1f3a16001a6845a4eaf50f8e8dff5a4c9319d6187a37b8716f9129
Instruction Fuzzy Hash: B52153759093C09FCB12CF24D994B15BF71EB46314F28C5EAD8498B657C33AD80ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00F5D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.509616179.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f5d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5150f7a57a8d53df84542f52b091e2a3c21df0421a9b8367837477cfcd62eb91
Instruction ID: 900641c66f3b925384d13cf8d725f2fa5dfed29fb4960079318e593330b38496
Opcode Fuzzy Hash: 5150f7a57a8d53df84542f52b091e2a3c21df0421a9b8367837477cfcd62eb91
Instruction Fuzzy Hash: 2611AF76804280CFCB16CF14D9C4B16BF61FB94324F28C6A9DD054B616C33AD85ADBA2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ople.exe.exePID: 1796, Parent PID: 2208COMMON

Executed Functions

Function 00AB1000 Relevance: 32.3, APIs: 3, Strings: 15, Instructions: 845
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000080), ref: 00AB16FA
SetWindowPos.USER32(00000000), ref: 00AB1701
VirtualProtect.KERNELBASE(32342DD0,000002E2,00000040,?), ref: 00AB1EE2

Strings

-9, xrefs: 00AB16F4
M,=, xrefs: 00AB15C0
99fd, xrefs: 00AB12DC
gJ0xZISNT1QdY, xrefs: 00AB1EF3
9S1Z, xrefs: 00AB1516
99_1, xrefs: 00AB149E
oS2Z, xrefs: 00AB14A8
s=, xrefs: 00AB119C
,52, xrefs: 00AB12F0
9obc, xrefs: 00AB1016
952, xrefs: 00AB1520
99fd, xrefs: 00AB1661
0852, xrefs: 00AB148A
99cb, xrefs: 00AB14EE
S=]2, xrefs: 00AB1606

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: Window$ConsoleProtectVirtual
String ID: s=$,52$-9$0852$952$99_1$99cb$99fd$99fd$9S1Z$9obc$S=]2$gJ0xZISNT1QdY$oS2Z$M,=
API String ID: 2778018546-69423270
Opcode ID: cea02692d4d5dae1178001425dd2090182ee1401fc29c1d42fa345ab55f34d4b
Instruction ID: d510442d84501647f97bd337e3c1679d7287c050c6cf90f6aa591e224b8a27d5
Opcode Fuzzy Hash: cea02692d4d5dae1178001425dd2090182ee1401fc29c1d42fa345ab55f34d4b
Instruction Fuzzy Hash: 81728AB2B543598BEB60CFB9DDC978ABAB0F715300F4045B8D548EB785D7789A858F00

Uniqueness

Uniqueness Score: -1.00%

Function 00AB26FA Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00AB26FA() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E00AB2706); // executed
				return _t1;
			}

0x00ab26ff
0x00ab2705

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00002706,00AB2097), ref: 00AB26FF

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ca51bbea88f5ac8503704557342a54a00557fa7c84e3450247de3c4d69ce4034
Instruction ID: 2f28c79fa198a18b9df90005cdbd1cf7e8fb5daae5a7955380944dd4d9fdc971
Opcode Fuzzy Hash: ca51bbea88f5ac8503704557342a54a00557fa7c84e3450247de3c4d69ce4034
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 010D1FB5 Relevance: 14.6, APIs: 9, Instructions: 1075
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00000002,00003000,00000004,E84126B8,388F3ADB), ref: 010D2E5B
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 010D2E71
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 010D2E87
VirtualAlloc.KERNELBASE(00000000,00000001,00003000,00000004), ref: 010D2E9B
VirtualAlloc.KERNELBASE(00000000,00000001,00003000,00000004), ref: 010D2EAF
VirtualAlloc.KERNELBASE(00000000,0000003C,00003000,00000004), ref: 010D2EC3
VirtualAlloc.KERNELBASE(00000000,00000001,00003000,00000004), ref: 010D2ED7
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 010D2EED

Part of subcall function 010D46C5: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,00003000,VirtualAlloc,00003000,VirtualFree,00000000), ref: 010D4863

ExitProcess.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6B68C4C6), ref: 010D332A

Memory Dump Source

Source File: 00000007.00000002.301067751.00000000010D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10d0000_ople.jbxd

Similarity

API ID: AllocVirtual$ExitProcess
String ID:
API String ID: 2301755047-0
Opcode ID: a118c34d102690ef0c4d506b9dcacaf28342d3ffce4d2a2770a5fc4f27c1cb82
Instruction ID: ced4b79273daafc0ab3c84676ce694e7d2b4d436aebc662bdf3ef55e1aa4e3a1
Opcode Fuzzy Hash: a118c34d102690ef0c4d506b9dcacaf28342d3ffce4d2a2770a5fc4f27c1cb82
Instruction Fuzzy Hash: B8A23220A14758D6EB20DF64DC54BDEB236EF68700F1050E9920DEB3E5E67A4F81CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 010D46C5 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 212
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,00003000,VirtualAlloc,00003000,VirtualFree,00000000), ref: 010D4863

Strings

LoadLibraryW, xrefs: 010D480B, 010D480E
VirtualFree, xrefs: 010D482F, 010D4832
VirtualAlloc, xrefs: 010D483F, 010D4842
CallWindowProcW, xrefs: 010D481B, 010D481E

Memory Dump Source

Source File: 00000007.00000002.301067751.00000000010D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10d0000_ople.jbxd

Similarity

API ID: AllocVirtual
String ID: CallWindowProcW$LoadLibraryW$VirtualAlloc$VirtualFree
API String ID: 4275171209-840194956
Opcode ID: db5a3faaeca2214f847324c64107c7e948738704fc90c88045da66bf3d03da6a
Instruction ID: bc08e8c46c1f417394dfdf05d8c87dce487f2a22f7a02074595b31c0c0e3087f
Opcode Fuzzy Hash: db5a3faaeca2214f847324c64107c7e948738704fc90c88045da66bf3d03da6a
Instruction Fuzzy Hash: B9A11970D083C8DAEB11CBE8C448BEDBFB2AF25704F144199D584BB382D7BA5554CB66

Uniqueness

Uniqueness Score: -1.00%

Function 010D3345 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 010D3416
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 010D362D

Memory Dump Source

Source File: 00000007.00000002.301067751.00000000010D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10d0000_ople.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: 1b514a202ce007281f84b9962a7ae5b6aa93391a19764c4e7429361d82933d36
Instruction ID: 242ca8bc9f6f57fee1e207a09d5aaf3d8be905b971b0372d3796b1d4c100a775
Opcode Fuzzy Hash: 1b514a202ce007281f84b9962a7ae5b6aa93391a19764c4e7429361d82933d36
Instruction Fuzzy Hash: 66A117B4E00309EBDB14CFD8C895BEEBBB5BF48304F108199E641BB284D775AA41CB55

Uniqueness

Uniqueness Score: -1.00%

Function 010D1985 Relevance: 7.9, APIs: 5, Instructions: 416
processthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000001,00000000), ref: 010D1AD2
GetThreadContext.KERNELBASE(?,00010007), ref: 010D1AF3
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 010D1B15

Memory Dump Source

Source File: 00000007.00000002.301067751.00000000010D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 010D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10d0000_ople.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThread
String ID:
API String ID: 2411489757-0
Opcode ID: 9cf7fa00ef4e5d423118deeadac9358b6660a85b94d1e07586abdd49760e417c
Instruction ID: c9c05f63df1b36cc6d8db86c8ef6ecb082d6112438f5efc11ff0664b159850f4
Opcode Fuzzy Hash: 9cf7fa00ef4e5d423118deeadac9358b6660a85b94d1e07586abdd49760e417c
Instruction Fuzzy Hash: 75022B70A00309EBEB18DFD8C985FEEB7B6FF48704F108158E655AB284DB74A941CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00AB5D94 Relevance: 6.1, APIs: 4, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00AB5D94() {
				int _v8;
				void* __ecx;
				void* _t6;
				int _t7;
				char* _t8;
				char* _t13;
				int _t17;
				void* _t19;
				char* _t25;
				WCHAR* _t27;

				_t27 = GetEnvironmentStringsW();
				if(_t27 == 0) {
					L7:
					_t13 = 0;
				} else {
					_t6 = E00AB5D5D(_t27);
					_pop(_t19);
					_t17 = _t6 - _t27 >> 1;
					_t7 = WideCharToMultiByte(0, 0, _t27, _t17, 0, 0, 0, 0);
					_v8 = _t7;
					if(_t7 == 0) {
						goto L7;
					} else {
						_t8 = E00AB46B0(_t19, _t7); // executed
						_t25 = _t8;
						if(_t25 == 0 || WideCharToMultiByte(0, 0, _t27, _t17, _t25, _v8, 0, 0) == 0) {
							_t13 = 0;
						} else {
							_t13 = _t25;
							_t25 = 0;
						}
						E00AB4676(_t25);
					}
				}
				if(_t27 != 0) {
					FreeEnvironmentStringsW(_t27);
				}
				return _t13;
			}

0x00ab5da3
0x00ab5da9
0x00ab5e01
0x00ab5e01
0x00ab5dab
0x00ab5dac
0x00ab5db1
0x00ab5dba
0x00ab5dc0
0x00ab5dc6
0x00ab5dcb
0x00000000
0x00ab5dcd
0x00ab5dce
0x00ab5dd3
0x00ab5dd8
0x00ab5df6
0x00ab5df0
0x00ab5df0
0x00ab5df2
0x00ab5df2
0x00ab5df9
0x00ab5dfe
0x00ab5dcb
0x00ab5e05
0x00ab5e08
0x00ab5e08
0x00ab5e16

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00AB5D9D
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00AB5DC0

Part of subcall function 00AB46B0: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,00AB8CDE,?,00000000,?,00AB7370,?,00000004,00000000,?,?,?,00AB437B), ref: 00AB46E2

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00AB5DE6
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00AB5E08

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap
String ID:
API String ID: 1794362364-0
Opcode ID: 37e1c9ba13b137657fd6ac405a921b2d664aec0aee812ecaec851e0bac0a46fa
Instruction ID: e6f9634e3acde5a122f4b88e78a8398e3afc17fc57b969ab31f5f5af8657a3a6
Opcode Fuzzy Hash: 37e1c9ba13b137657fd6ac405a921b2d664aec0aee812ecaec851e0bac0a46fa
Instruction Fuzzy Hash: 10018872E01A157B672167BA6C8DEBF6E6DDEC6B607140229FD05C6213EA61CE0285F0

Uniqueness

Uniqueness Score: -1.00%

Function 00AB6A69 Relevance: 3.1, APIs: 2, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00AB6A69() {
				signed int _t20;
				signed int _t22;
				long _t23;
				signed int _t25;
				void* _t28;
				signed int _t31;
				void* _t33;

				_t31 = 0;
				do {
					_t20 = _t31 & 0x0000003f;
					_t33 = _t20 * 0x30 +  *((intOrPtr*)(0xac3f60 + (_t31 >> 6) * 4));
					if( *(_t33 + 0x18) == 0xffffffff ||  *(_t33 + 0x18) == 0xfffffffe) {
						 *(_t33 + 0x28) = 0x81;
						_t22 = _t31;
						if(_t22 == 0) {
							_push(0xfffffff6);
						} else {
							if(_t22 == 1) {
								_push(0xfffffff5);
							} else {
								_push(0xfffffff4);
							}
						}
						_pop(_t23);
						_t28 = GetStdHandle(_t23);
						if(_t28 == 0xffffffff || _t28 == 0) {
							_t25 = 0;
						} else {
							_t25 = GetFileType(_t28); // executed
						}
						if(_t25 == 0) {
							 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000040;
							 *(_t33 + 0x18) = 0xfffffffe;
							_t20 =  *0xac4194;
							if(_t20 != 0) {
								_t20 =  *(_t20 + _t31 * 4);
								 *(_t20 + 0x10) = 0xfffffffe;
							}
						} else {
							_t20 = _t25 & 0x000000ff;
							 *(_t33 + 0x18) = _t28;
							if(_t20 != 2) {
								if(_t20 == 3) {
									 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000008;
								}
							} else {
								 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000040;
							}
						}
					} else {
						 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000080;
					}
					_t31 = _t31 + 1;
				} while (_t31 != 3);
				return _t20;
			}

0x00ab6a6e
0x00ab6a70
0x00ab6a74
0x00ab6a7d
0x00ab6a88
0x00ab6a98
0x00ab6a9c
0x00ab6a9f
0x00ab6ab1
0x00ab6aa1
0x00ab6aa4
0x00ab6aad
0x00ab6aa6
0x00ab6aa6
0x00ab6aa8
0x00ab6aa4
0x00ab6ab3
0x00ab6abb
0x00ab6ac0
0x00ab6acf
0x00ab6ac6
0x00ab6ac7
0x00ab6ac7
0x00ab6ad3
0x00ab6af3
0x00ab6af7
0x00ab6afe
0x00ab6b05
0x00ab6b07
0x00ab6b0a
0x00ab6b0a
0x00ab6ad5
0x00ab6ad5
0x00ab6ada
0x00ab6ae0
0x00ab6aeb
0x00ab6aed
0x00ab6aed
0x00ab6ae2
0x00ab6ae2
0x00ab6ae2
0x00ab6ae0
0x00ab6a90
0x00ab6a90
0x00ab6a90
0x00ab6b11
0x00ab6b12
0x00ab6b1e

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00AB6AB5
GetFileType.KERNELBASE(00000000), ref: 00AB6AC7

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 44312b8f7d6f426817b612e65a466f121903b375cd927831d64066db3e1cd5f2
Instruction ID: 2d9f21da217e2b1da78f7c5366b9bd58a77ba8cda9c20cd4decd3eddb0382352
Opcode Fuzzy Hash: 44312b8f7d6f426817b612e65a466f121903b375cd927831d64066db3e1cd5f2
Instruction Fuzzy Hash: 2811DA3120474246DF308F3D8C886A2BABC9B56370B38471ED5B6E61F3D638DD869241

Uniqueness

Uniqueness Score: -1.00%

Function 00AB479B Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00AB479B(void* __ecx, signed int _a4, signed int _a8) {
				void* __esi;
				void* _t8;
				void* _t12;
				signed int _t13;
				void* _t15;
				signed int _t16;
				signed int _t18;
				long _t19;

				_t15 = __ecx;
				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0xac4170, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E00AB40A1();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E00AB501F())) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E00AB74C4(_t15, _t16, _t19, __eflags, _t19);
						_pop(_t15);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				_t16 = _t13 % _t18;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x00ab479b
0x00ab47a1
0x00ab47a6
0x00ab47b4
0x00ab47b4
0x00ab47ba
0x00ab47bc
0x00ab47bc
0x00ab47d3
0x00ab47dc
0x00ab47e4
0x00000000
0x00000000
0x00ab47c4
0x00ab47c6
0x00ab47e8
0x00ab47ed
0x00ab47f3
0x00000000
0x00ab47f3
0x00ab47c9
0x00ab47ce
0x00ab47cf
0x00ab47d1
0x00000000
0x00000000
0x00ab47d1
0x00000000
0x00ab47d3
0x00ab47ac
0x00ab47ad
0x00ab47b2
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00AB4CFF,00000001,00000364,?,00AB7370,?,00000004,00000000,?,?,?,00AB437B), ref: 00AB47DC

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c6ac69dcef7bd2abe3d1f07c1bcc1c56182fbfc8642fb997c4081ea0d1a361e0
Instruction ID: c0bd75d233fb953e74f507119e43a9384eee2be33271e0372f5281f5811b2d9f
Opcode Fuzzy Hash: c6ac69dcef7bd2abe3d1f07c1bcc1c56182fbfc8642fb997c4081ea0d1a361e0
Instruction Fuzzy Hash: 27F0B431544624AB9B216B629D01BDA3B9CAB4A760F168152A80597593CF20DC92C2E0

Uniqueness

Uniqueness Score: -1.00%

Function 00AB46B0 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00AB46B0(void* __ecx, long _a4) {
				void* __esi;
				void* _t4;
				void* _t6;
				void* _t7;
				void* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = _a4;
				if(_t9 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E00AB501F())) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t9 == 0) {
					_t9 = _t9 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0xac4170, 0, _t9); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E00AB40A1();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E00AB74C4(_t7, _t8, _t9, __eflags, _t9);
					_pop(_t7);
					__eflags = _t6;
					if(_t6 == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x00ab46b0
0x00ab46b6
0x00ab46bc
0x00ab46ee
0x00ab46f3
0x00ab46f9
0x00000000
0x00ab46f9
0x00ab46c0
0x00ab46c2
0x00ab46c2
0x00ab46d9
0x00ab46e2
0x00ab46ea
0x00000000
0x00000000
0x00ab46ca
0x00ab46cc
0x00000000
0x00000000
0x00ab46cf
0x00ab46d4
0x00ab46d5
0x00ab46d7
0x00000000
0x00000000
0x00ab46d7
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000004,?,00AB8CDE,?,00000000,?,00AB7370,?,00000004,00000000,?,?,?,00AB437B), ref: 00AB46E2

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 57b5c00c2262e2eaf88ce6e693d368af67ee2ae930881987326fca2d58d79e3a
Instruction ID: e9d0d8ddc88622a8429906e93988934bc34f6f616d43fe4381af3d796f4c10fd
Opcode Fuzzy Hash: 57b5c00c2262e2eaf88ce6e693d368af67ee2ae930881987326fca2d58d79e3a
Instruction Fuzzy Hash: 72E0ED35144624ABE6203B759E20BDA3BAC9B4B7A0F090221BC46D65D3EF20CC4182E4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00AB4D99 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 76%

			E00AB4D99(intOrPtr __ebx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				struct _EXCEPTION_POINTERS _v812;
				signed int _t40;
				char* _t47;
				char* _t49;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t66;
				intOrPtr _t67;
				int _t68;
				intOrPtr _t69;
				signed int _t70;

				_t69 = __esi;
				_t67 = __edi;
				_t66 = __edx;
				_t61 = __ebx;
				_t40 =  *0xac3018; // 0x4c695d09
				_t41 = _t40 ^ _t70;
				_v8 = _t40 ^ _t70;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E00AB2747(_t41);
					_pop(_t62);
				}
				E00AB2CE0(_t67,  &_v804, 0, 0x50);
				E00AB2CE0(_t67,  &_v724, 0, 0x2cc);
				_v812.ExceptionRecord =  &_v804;
				_t47 =  &_v724;
				_v812.ContextRecord = _t47;
				_v548 = _t47;
				_v552 = _t62;
				_v556 = _t66;
				_v560 = _t61;
				_v564 = _t69;
				_v568 = _t67;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t49 =  &_v0;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t68 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				if(UnhandledExceptionFilter( &_v812) == 0 && _t68 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					E00AB2747(_t57);
				}
				return E00AB29BB(_v8 ^ _t70);
			}

0x00ab4d99
0x00ab4d99
0x00ab4d99
0x00ab4d99
0x00ab4da4
0x00ab4da9
0x00ab4dab
0x00ab4db3
0x00ab4db5
0x00ab4db8
0x00ab4dbd
0x00ab4dbd
0x00ab4dc9
0x00ab4ddc
0x00ab4dea
0x00ab4df0
0x00ab4df6
0x00ab4dfc
0x00ab4e02
0x00ab4e08
0x00ab4e0e
0x00ab4e14
0x00ab4e1a
0x00ab4e20
0x00ab4e27
0x00ab4e2e
0x00ab4e35
0x00ab4e3c
0x00ab4e43
0x00ab4e4a
0x00ab4e4b
0x00ab4e54
0x00ab4e5a
0x00ab4e5d
0x00ab4e63
0x00ab4e70
0x00ab4e79
0x00ab4e82
0x00ab4e8b
0x00ab4e99
0x00ab4e9b
0x00ab4eb0
0x00ab4ebc
0x00ab4ebf
0x00ab4ec4
0x00ab4ed3

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00AB4E91
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00AB4E9B
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00AB4EA8

Strings

]iL, xrefs: 00AB4DA4

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: ]iL
API String ID: 3906539128-4085116960
Opcode ID: ce8ae586833aba35fd4efbf588e3aaea851044772a6bcb1afccd8e1900290b43
Instruction ID: 7d507d22a7d2f986a604c781b14a6c06d1afc15c465a5be547dbdf2601595461
Opcode Fuzzy Hash: ce8ae586833aba35fd4efbf588e3aaea851044772a6bcb1afccd8e1900290b43
Instruction Fuzzy Hash: 973195759012289BCB61DF64DD897DDBBB8BF08310F5042DAE41CA7262E7749B858F44

Uniqueness

Uniqueness Score: -1.00%

Function 00AB51DA Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00AB51DA(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr* _v32;
				CHAR* _v36;
				signed int _v48;
				char _v286;
				signed int _v287;
				struct _WIN32_FIND_DATAA _v332;
				intOrPtr* _v336;
				signed int _v340;
				signed int _v344;
				intOrPtr _v372;
				signed int _t35;
				signed int _t40;
				signed int _t43;
				intOrPtr _t45;
				signed char _t47;
				intOrPtr* _t55;
				union _FINDEX_INFO_LEVELS _t57;
				signed int _t62;
				signed int _t65;
				void* _t72;
				void* _t74;
				signed int _t75;
				void* _t78;
				CHAR* _t79;
				intOrPtr* _t83;
				intOrPtr _t85;
				void* _t87;
				intOrPtr* _t88;
				signed int _t92;
				signed int _t96;
				void* _t101;
				intOrPtr _t102;
				signed int _t105;
				union _FINDEX_INFO_LEVELS _t106;
				void* _t111;
				intOrPtr _t112;
				void* _t113;
				signed int _t118;
				void* _t119;
				signed int _t120;
				void* _t121;
				void* _t122;

				_push(__ecx);
				_t83 = _a4;
				_t2 = _t83 + 1; // 0x1
				_t101 = _t2;
				do {
					_t35 =  *_t83;
					_t83 = _t83 + 1;
				} while (_t35 != 0);
				_push(__edi);
				_t105 = _a12;
				_t85 = _t83 - _t101 + 1;
				_v8 = _t85;
				if(_t85 <= (_t35 | 0xffffffff) - _t105) {
					_push(__ebx);
					_push(__esi);
					_t5 = _t105 + 1; // 0x1
					_t78 = _t5 + _t85;
					_t111 = E00AB479B(_t85, _t78, 1);
					_pop(_t87);
					__eflags = _t105;
					if(_t105 == 0) {
						L6:
						_push(_v8);
						_t78 = _t78 - _t105;
						_t40 = E00AB874B(_t87, _t111 + _t105, _t78, _a4);
						_t120 = _t119 + 0x10;
						__eflags = _t40;
						if(__eflags != 0) {
							goto L9;
						} else {
							_t72 = E00AB5419(_a16, _t101, __eflags, _t111);
							E00AB4676(0);
							_t74 = _t72;
							goto L8;
						}
					} else {
						_push(_t105);
						_t75 = E00AB874B(_t87, _t111, _t78, _a8);
						_t120 = _t119 + 0x10;
						__eflags = _t75;
						if(_t75 != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E00AB4F73();
							asm("int3");
							_t118 = _t120;
							_t121 = _t120 - 0x150;
							_t43 =  *0xac3018; // 0x4c695d09
							_v48 = _t43 ^ _t118;
							_t88 = _v32;
							_push(_t78);
							_t79 = _v36;
							_push(_t111);
							_t112 = _v332.cAlternateFileName;
							_push(_t105);
							_v372 = _t112;
							while(1) {
								__eflags = _t88 - _t79;
								if(_t88 == _t79) {
									break;
								}
								_t45 =  *_t88;
								__eflags = _t45 - 0x2f;
								if(_t45 != 0x2f) {
									__eflags = _t45 - 0x5c;
									if(_t45 != 0x5c) {
										__eflags = _t45 - 0x3a;
										if(_t45 != 0x3a) {
											_t88 = E00AB87A0(_t79, _t88);
											continue;
										}
									}
								}
								break;
							}
							_t102 =  *_t88;
							__eflags = _t102 - 0x3a;
							if(_t102 != 0x3a) {
								L19:
								_t106 = 0;
								__eflags = _t102 - 0x2f;
								if(_t102 == 0x2f) {
									L23:
									_t47 = 1;
									__eflags = 1;
								} else {
									__eflags = _t102 - 0x5c;
									if(_t102 == 0x5c) {
										goto L23;
									} else {
										__eflags = _t102 - 0x3a;
										if(_t102 == 0x3a) {
											goto L23;
										} else {
											_t47 = 0;
										}
									}
								}
								_t90 = _t88 - _t79 + 1;
								asm("sbb eax, eax");
								_v340 =  ~(_t47 & 0x000000ff) & _t88 - _t79 + 0x00000001;
								E00AB2CE0(_t106,  &_v332, _t106, 0x140);
								_t122 = _t121 + 0xc;
								_t113 = FindFirstFileExA(_t79, _t106,  &_v332, _t106, _t106, _t106);
								_t55 = _v336;
								__eflags = _t113 - 0xffffffff;
								if(_t113 != 0xffffffff) {
									_t92 =  *((intOrPtr*)(_t55 + 4)) -  *_t55;
									__eflags = _t92;
									_t93 = _t92 >> 2;
									_v344 = _t92 >> 2;
									do {
										__eflags = _v332.cFileName - 0x2e;
										if(_v332.cFileName != 0x2e) {
											L36:
											_push(_t55);
											_t57 = E00AB51DA(_t79, _t93, _t106, _t113,  &(_v332.cFileName), _t79, _v340);
											_t122 = _t122 + 0x10;
											__eflags = _t57;
											if(_t57 != 0) {
												goto L26;
											} else {
												goto L37;
											}
										} else {
											_t93 = _v287;
											__eflags = _t93;
											if(_t93 == 0) {
												goto L37;
											} else {
												__eflags = _t93 - 0x2e;
												if(_t93 != 0x2e) {
													goto L36;
												} else {
													__eflags = _v286;
													if(_v286 == 0) {
														goto L37;
													} else {
														goto L36;
													}
												}
											}
										}
										goto L40;
										L37:
										_t62 = FindNextFileA(_t113,  &_v332);
										__eflags = _t62;
										_t55 = _v336;
									} while (_t62 != 0);
									_t103 =  *_t55;
									_t96 = _v344;
									_t65 =  *((intOrPtr*)(_t55 + 4)) -  *_t55 >> 2;
									__eflags = _t96 - _t65;
									if(_t96 != _t65) {
										E00AB8300(_t79, _t106, _t113, _t103 + _t96 * 4, _t65 - _t96, 4, E00AB5032);
									}
								} else {
									_push(_t55);
									_t57 = E00AB51DA(_t79, _t90, _t106, _t113, _t79, _t106, _t106);
									L26:
									_t106 = _t57;
								}
								__eflags = _t113 - 0xffffffff;
								if(_t113 != 0xffffffff) {
									FindClose(_t113);
								}
							} else {
								__eflags = _t88 -  &(_t79[1]);
								if(_t88 ==  &(_t79[1])) {
									goto L19;
								} else {
									_push(_t112);
									E00AB51DA(_t79, _t88, 0, _t112, _t79, 0, 0);
								}
							}
							__eflags = _v12 ^ _t118;
							return E00AB29BB(_v12 ^ _t118);
						} else {
							goto L6;
						}
					}
				} else {
					_t74 = 0xc;
					L8:
					return _t74;
				}
				L40:
			}

0x00ab51df
0x00ab51e0
0x00ab51e3
0x00ab51e3
0x00ab51e6
0x00ab51e6
0x00ab51e8
0x00ab51e9
0x00ab51f2
0x00ab51f3
0x00ab51f6
0x00ab51f9
0x00ab51fe
0x00ab5205
0x00ab5206
0x00ab5207
0x00ab520a
0x00ab5214
0x00ab5217
0x00ab5218
0x00ab521a
0x00ab522e
0x00ab522e
0x00ab5231
0x00ab523b
0x00ab5240
0x00ab5243
0x00ab5245
0x00000000
0x00ab5247
0x00ab524b
0x00ab5254
0x00ab525a
0x00000000
0x00ab525d
0x00ab521c
0x00ab521c
0x00ab5222
0x00ab5227
0x00ab522a
0x00ab522c
0x00ab5263
0x00ab5265
0x00ab5266
0x00ab5267
0x00ab5268
0x00ab5269
0x00ab526a
0x00ab526f
0x00ab5273
0x00ab5275
0x00ab527b
0x00ab5282
0x00ab5285
0x00ab5288
0x00ab5289
0x00ab528c
0x00ab528d
0x00ab5290
0x00ab5291
0x00ab52b2
0x00ab52b2
0x00ab52b4
0x00000000
0x00000000
0x00ab5299
0x00ab529b
0x00ab529d
0x00ab529f
0x00ab52a1
0x00ab52a3
0x00ab52a5
0x00ab52b0
0x00000000
0x00ab52b0
0x00ab52a5
0x00ab52a1
0x00000000
0x00ab529d
0x00ab52b6
0x00ab52b8
0x00ab52bb
0x00ab52d4
0x00ab52d4
0x00ab52d6
0x00ab52d9
0x00ab52e9
0x00ab52eb
0x00ab52eb
0x00ab52db
0x00ab52db
0x00ab52de
0x00000000
0x00ab52e0
0x00ab52e0
0x00ab52e3
0x00000000
0x00ab52e5
0x00ab52e5
0x00ab52e5
0x00ab52e3
0x00ab52de
0x00ab52f1
0x00ab52f9
0x00ab52fd
0x00ab530b
0x00ab5310
0x00ab5325
0x00ab5327
0x00ab532d
0x00ab5330
0x00ab5362
0x00ab5362
0x00ab5364
0x00ab5367
0x00ab536d
0x00ab536d
0x00ab5374
0x00ab538e
0x00ab538e
0x00ab539d
0x00ab53a2
0x00ab53a5
0x00ab53a7
0x00000000
0x00000000
0x00000000
0x00000000
0x00ab5376
0x00ab5376
0x00ab537c
0x00ab537e
0x00000000
0x00ab5380
0x00ab5380
0x00ab5383
0x00000000
0x00ab5385
0x00ab5385
0x00ab538c
0x00000000
0x00000000
0x00000000
0x00000000
0x00ab538c
0x00ab5383
0x00ab537e
0x00000000
0x00ab53a9
0x00ab53b1
0x00ab53b7
0x00ab53b9
0x00ab53b9
0x00ab53c1
0x00ab53c6
0x00ab53ce
0x00ab53d1
0x00ab53d3
0x00ab53e7
0x00ab53ec
0x00ab5332
0x00ab5332
0x00ab5336
0x00ab533e
0x00ab533e
0x00ab533e
0x00ab5340
0x00ab5343
0x00ab5346
0x00ab5346
0x00ab52bd
0x00ab52c0
0x00ab52c2
0x00000000
0x00ab52c4
0x00ab52c4
0x00ab52ca
0x00ab52cf
0x00ab52c2
0x00ab5353
0x00ab535e
0x00000000
0x00000000
0x00000000
0x00ab522c
0x00ab5200
0x00ab5202
0x00ab525e
0x00ab5262
0x00ab5262
0x00000000

Strings

]iL, xrefs: 00AB527B
., xrefs: 00AB536D

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID:
String ID: ]iL$.
API String ID: 0-1155455829
Opcode ID: 827799c2969346a33addeb5b3585b0a649b565dec7c4c3602534e6a12f8e8db3
Instruction ID: a7e33e062fd99d81d8f018dbcc7c50d3b7802bd478d50eb9b32a6a64386cad3d
Opcode Fuzzy Hash: 827799c2969346a33addeb5b3585b0a649b565dec7c4c3602534e6a12f8e8db3
Instruction Fuzzy Hash: C131E471D00609AFCB249F79DC89FFA7BBDEB85314F1402A8F81997252E6319E458B50

Uniqueness

Uniqueness Score: -1.00%

Function 00AB928E Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 268
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00AB928E(void* __ebx, void* __edi, void* __esi, int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16, int _a20, char* _a24, int _a28, int _a32) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				short* _v32;
				int _v36;
				char* _v40;
				int _v44;
				intOrPtr _v48;
				void* _v60;
				signed int _t63;
				int _t70;
				signed int _t72;
				short* _t73;
				signed int _t77;
				short* _t87;
				void* _t89;
				void* _t92;
				int _t99;
				intOrPtr _t101;
				intOrPtr _t102;
				signed int _t112;
				char* _t114;
				char* _t115;
				void* _t120;
				void* _t121;
				intOrPtr _t122;
				intOrPtr _t123;
				intOrPtr* _t125;
				short* _t126;
				int _t128;
				int _t129;
				short* _t130;
				intOrPtr* _t131;
				signed int _t132;
				short* _t133;

				_t63 =  *0xac3018; // 0x4c695d09
				_v8 = _t63 ^ _t132;
				_t128 = _a20;
				_v44 = _a4;
				_v48 = _a8;
				_t67 = _a24;
				_v40 = _a24;
				_t125 = _a16;
				_v36 = _t125;
				if(_t128 <= 0) {
					if(_t128 >= 0xffffffff) {
						goto L2;
					} else {
						goto L5;
					}
				} else {
					_t128 = E00AB914F(_t125, _t128);
					_t67 = _v40;
					L2:
					_t99 = _a28;
					if(_t99 <= 0) {
						if(_t99 < 0xffffffff) {
							goto L5;
						} else {
							goto L7;
						}
					} else {
						_t99 = E00AB914F(_t67, _t99);
						L7:
						_t70 = _a32;
						if(_t70 == 0) {
							_t70 =  *( *_v44 + 8);
							_a32 = _t70;
						}
						if(_t128 == 0 || _t99 == 0) {
							if(_t128 != _t99) {
								if(_t99 <= 1) {
									if(_t128 <= 1) {
										if(GetCPInfo(_t70,  &_v28) == 0) {
											goto L5;
										} else {
											if(_t128 <= 0) {
												if(_t99 <= 0) {
													goto L36;
												} else {
													_t89 = 2;
													if(_v28 >= _t89) {
														_t114 =  &_v22;
														if(_v22 != 0) {
															_t131 = _v40;
															while(1) {
																_t122 =  *((intOrPtr*)(_t114 + 1));
																if(_t122 == 0) {
																	goto L15;
																}
																_t101 =  *_t131;
																if(_t101 <  *_t114 || _t101 > _t122) {
																	_t114 = _t114 + _t89;
																	if( *_t114 != 0) {
																		continue;
																	} else {
																		goto L15;
																	}
																}
																goto L63;
															}
														}
													}
													goto L15;
												}
											} else {
												_t92 = 2;
												if(_v28 >= _t92) {
													_t115 =  &_v22;
													if(_v22 != 0) {
														while(1) {
															_t123 =  *((intOrPtr*)(_t115 + 1));
															if(_t123 == 0) {
																goto L17;
															}
															_t102 =  *_t125;
															if(_t102 <  *_t115 || _t102 > _t123) {
																_t115 = _t115 + _t92;
																if( *_t115 != 0) {
																	continue;
																} else {
																	goto L17;
																}
															}
															goto L63;
														}
													}
												}
												goto L17;
											}
										}
									} else {
										L17:
										_push(3);
										goto L13;
									}
								} else {
									L15:
								}
							} else {
								_push(2);
								L13:
							}
						} else {
							L36:
							_t126 = 0;
							_t72 = MultiByteToWideChar(_a32, 9, _v36, _t128, 0, 0);
							_v44 = _t72;
							if(_t72 == 0) {
								L5:
							} else {
								_t120 = _t72 + _t72;
								asm("sbb eax, eax");
								if((_t120 + 0x00000008 & _t72) == 0) {
									_t73 = 0;
									_v32 = 0;
									goto L45;
								} else {
									asm("sbb eax, eax");
									_t85 = _t72 & _t120 + 0x00000008;
									_t112 = _t120 + 8;
									if((_t72 & _t120 + 0x00000008) > 0x400) {
										asm("sbb eax, eax");
										_t87 = E00AB46B0(_t112, _t85 & _t112);
										_v32 = _t87;
										if(_t87 == 0) {
											goto L61;
										} else {
											 *_t87 = 0xdddd;
											goto L43;
										}
									} else {
										asm("sbb eax, eax");
										E00ABBFA0();
										_t87 = _t133;
										_v32 = _t87;
										if(_t87 == 0) {
											L61:
											_t100 = _v32;
										} else {
											 *_t87 = 0xcccc;
											L43:
											_t73 =  &(_t87[4]);
											_v32 = _t73;
											L45:
											if(_t73 == 0) {
												goto L61;
											} else {
												_t129 = _a32;
												if(MultiByteToWideChar(_t129, 1, _v36, _t128, _t73, _v44) == 0) {
													goto L61;
												} else {
													_t77 = MultiByteToWideChar(_t129, 9, _v40, _t99, _t126, _t126);
													_v36 = _t77;
													if(_t77 == 0) {
														goto L61;
													} else {
														_t121 = _t77 + _t77;
														_t108 = _t121 + 8;
														asm("sbb eax, eax");
														if((_t121 + 0x00000008 & _t77) == 0) {
															_t130 = _t126;
															goto L56;
														} else {
															asm("sbb eax, eax");
															_t81 = _t77 & _t121 + 0x00000008;
															_t108 = _t121 + 8;
															if((_t77 & _t121 + 0x00000008) > 0x400) {
																asm("sbb eax, eax");
																_t130 = E00AB46B0(_t108, _t81 & _t108);
																_pop(_t108);
																if(_t130 == 0) {
																	goto L59;
																} else {
																	 *_t130 = 0xdddd;
																	goto L54;
																}
															} else {
																asm("sbb eax, eax");
																E00ABBFA0();
																_t130 = _t133;
																if(_t130 == 0) {
																	L59:
																	_t100 = _v32;
																} else {
																	 *_t130 = 0xcccc;
																	L54:
																	_t130 =  &(_t130[4]);
																	L56:
																	if(_t130 == 0 || MultiByteToWideChar(_a32, 1, _v40, _t99, _t130, _v36) == 0) {
																		goto L59;
																	} else {
																		_t100 = _v32;
																		_t126 = E00AB6333(_t108, _t130, _v48, _a12, _v32, _v44, _t130, _v36, _t126, _t126, _t126);
																	}
																}
															}
														}
														E00AB6F6B(_t130);
													}
												}
											}
										}
									}
								}
								E00AB6F6B(_t100);
							}
						}
					}
				}
				L63:
				return E00AB29BB(_v8 ^ _t132);
			}

0x00ab9296
0x00ab929d
0x00ab92a5
0x00ab92a8
0x00ab92ae
0x00ab92b1
0x00ab92b4
0x00ab92b8
0x00ab92bb
0x00ab92c0
0x00ab92e7
0x00000000
0x00000000
0x00000000
0x00000000
0x00ab92c2
0x00ab92ca
0x00ab92cc
0x00ab92d0
0x00ab92d0
0x00ab92d5
0x00ab92f3
0x00000000
0x00000000
0x00000000
0x00000000
0x00ab92d7
0x00ab92e0
0x00ab92f5
0x00ab92f5
0x00ab92fa
0x00ab9301
0x00ab9304
0x00ab9304
0x00ab9309
0x00ab9315
0x00ab9322
0x00ab932f
0x00ab9342
0x00000000
0x00ab9344
0x00ab9346
0x00ab9379
0x00000000
0x00ab937b
0x00ab937d
0x00ab9381
0x00ab9387
0x00ab938a
0x00ab938c
0x00ab938f
0x00ab938f
0x00ab9394
0x00000000
0x00000000
0x00ab9396
0x00ab939a
0x00ab93a4
0x00ab93a9
0x00000000
0x00ab93ab
0x00000000
0x00ab93ab
0x00ab93a9
0x00000000
0x00ab939a
0x00ab938f
0x00ab938a
0x00000000
0x00ab9381
0x00ab9348
0x00ab934a
0x00ab934e
0x00ab9354
0x00ab9357
0x00ab9359
0x00ab9359
0x00ab935e
0x00000000
0x00000000
0x00ab9360
0x00ab9364
0x00ab936e
0x00ab9373
0x00000000
0x00ab9375
0x00000000
0x00ab9375
0x00ab9373
0x00000000
0x00ab9364
0x00ab9359
0x00ab9357
0x00000000
0x00ab934e
0x00ab9346
0x00ab9331
0x00ab9331
0x00ab9331
0x00000000
0x00ab9331
0x00ab9324
0x00ab9324
0x00ab9326
0x00ab9317
0x00ab9317
0x00ab9319
0x00ab9319
0x00ab93b0
0x00ab93b0
0x00ab93b0
0x00ab93bd
0x00ab93c3
0x00ab93c8
0x00ab92e9
0x00ab93ce
0x00ab93ce
0x00ab93d6
0x00ab93da
0x00ab9435
0x00ab9437
0x00000000
0x00ab93dc
0x00ab93e1
0x00ab93e3
0x00ab93e5
0x00ab93ed
0x00ab9411
0x00ab9416
0x00ab941b
0x00ab9421
0x00000000
0x00ab9427
0x00ab9427
0x00000000
0x00ab9427
0x00ab93ef
0x00ab93f1
0x00ab93f5
0x00ab93fa
0x00ab93fc
0x00ab9401
0x00ab9516
0x00ab9516
0x00ab9407
0x00ab9407
0x00ab942d
0x00ab942d
0x00ab9430
0x00ab943a
0x00ab943c
0x00000000
0x00ab9442
0x00ab944a
0x00ab9458
0x00000000
0x00ab945e
0x00ab9467
0x00ab946d
0x00ab9472
0x00000000
0x00ab9478
0x00ab9478
0x00ab947b
0x00ab9480
0x00ab9484
0x00ab94d0
0x00000000
0x00ab9486
0x00ab948b
0x00ab948d
0x00ab948f
0x00ab9497
0x00ab94b4
0x00ab94be
0x00ab94c0
0x00ab94c3
0x00000000
0x00ab94c5
0x00ab94c5
0x00000000
0x00ab94c5
0x00ab9499
0x00ab949b
0x00ab949f
0x00ab94a4
0x00ab94a8
0x00ab950a
0x00ab950a
0x00ab94aa
0x00ab94aa
0x00ab94cb
0x00ab94cb
0x00ab94d2
0x00ab94d4
0x00000000
0x00ab94ed
0x00ab94ed
0x00ab9506
0x00ab9506
0x00ab94d4
0x00ab94a8
0x00ab9497
0x00ab950e
0x00ab9513
0x00ab9472
0x00ab9458
0x00ab943c
0x00ab9401
0x00ab93ed
0x00ab951a
0x00ab9520
0x00ab93c8
0x00ab9309
0x00ab92d5
0x00ab9522
0x00ab9535

APIs

GetCPInfo.KERNEL32(00D6ED00,00D6ED00,?,7FFFFFFF,?,?,00AB9567,00D6ED00,00D6ED00,?,00D6ED00,?,?,?,?,00D6ED00), ref: 00AB933A
MultiByteToWideChar.KERNEL32(00D6ED00,00000009,00D6ED00,00D6ED00,00000000,00000000,?,00AB9567,00D6ED00,00D6ED00,?,00D6ED00,?,?,?,?), ref: 00AB93BD
__alloca_probe_16.LIBCMT ref: 00AB93F5
MultiByteToWideChar.KERNEL32(00D6ED00,00000001,00D6ED00,00D6ED00,00000000,00AB9567,?,00AB9567,00D6ED00,00D6ED00,?,00D6ED00,?,?,?,?), ref: 00AB9450
__alloca_probe_16.LIBCMT ref: 00AB949F
MultiByteToWideChar.KERNEL32(00D6ED00,00000009,00D6ED00,00D6ED00,00000000,00000000,?,00AB9567,00D6ED00,00D6ED00,?,00D6ED00,?,?,?,?), ref: 00AB9467

Part of subcall function 00AB46B0: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,00AB8CDE,?,00000000,?,00AB7370,?,00000004,00000000,?,?,?,00AB437B), ref: 00AB46E2

MultiByteToWideChar.KERNEL32(00D6ED00,00000001,00D6ED00,00D6ED00,00000000,00D6ED00,?,00AB9567,00D6ED00,00D6ED00,?,00D6ED00,?,?,?,?), ref: 00AB94E3
__freea.LIBCMT ref: 00AB950E
__freea.LIBCMT ref: 00AB951A

Strings

]iL, xrefs: 00AB9296

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
String ID: ]iL
API String ID: 201697637-4085116960
Opcode ID: 19fc53a6d0f502e714717bc35737a6539c30a0825055e71e76ac0dcc84fcb44a
Instruction ID: bde736908034529200627370a0500d310a3187072938e517bfbd422551347666
Opcode Fuzzy Hash: 19fc53a6d0f502e714717bc35737a6539c30a0825055e71e76ac0dcc84fcb44a
Instruction Fuzzy Hash: C991A171E00216ABDB258FA5C885AEF7BFDAF09710F184259EA05EB283D735DC45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00AB8853 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 216
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00AB8853(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char* _a16, int _a20, intOrPtr _a24, short* _a28, int _a32, intOrPtr _a36) {
				signed int _v8;
				int _v12;
				void* _v24;
				signed int _t49;
				signed int _t54;
				int _t58;
				signed int _t60;
				short* _t62;
				signed int _t66;
				short* _t70;
				int _t71;
				int _t78;
				short* _t81;
				signed int _t87;
				signed int _t90;
				void* _t95;
				void* _t96;
				int _t98;
				short* _t101;
				int _t103;
				signed int _t106;
				short* _t107;
				void* _t110;

				_push(__ecx);
				_push(__ecx);
				_t49 =  *0xac3018; // 0x4c695d09
				_v8 = _t49 ^ _t106;
				_push(__esi);
				_t103 = _a20;
				if(_t103 > 0) {
					_t78 = E00AB914F(_a16, _t103);
					_t110 = _t78 - _t103;
					_t4 = _t78 + 1; // 0x1
					_t103 = _t4;
					if(_t110 >= 0) {
						_t103 = _t78;
					}
				}
				_t98 = _a32;
				if(_t98 == 0) {
					_t98 =  *( *_a4 + 8);
					_a32 = _t98;
				}
				_t54 = MultiByteToWideChar(_t98, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t103, 0, 0);
				_v12 = _t54;
				if(_t54 == 0) {
					L38:
					return E00AB29BB(_v8 ^ _t106);
				} else {
					_t95 = _t54 + _t54;
					_t85 = _t95 + 8;
					asm("sbb eax, eax");
					if((_t95 + 0x00000008 & _t54) == 0) {
						_t81 = 0;
						__eflags = 0;
						L14:
						if(_t81 == 0) {
							L36:
							_t105 = 0;
							L37:
							E00AB6F6B(_t81);
							goto L38;
						}
						_t58 = MultiByteToWideChar(_t98, 1, _a16, _t103, _t81, _v12);
						_t121 = _t58;
						if(_t58 == 0) {
							goto L36;
						}
						_t100 = _v12;
						_t60 = E00AB6564(_t85, _t103, _t121, _a8, _a12, _t81, _v12, 0, 0, 0, 0, 0);
						_t105 = _t60;
						if(_t105 == 0) {
							goto L36;
						}
						if((_a12 & 0x00000400) == 0) {
							_t96 = _t105 + _t105;
							_t87 = _t96 + 8;
							__eflags = _t96 - _t87;
							asm("sbb eax, eax");
							__eflags = _t87 & _t60;
							if((_t87 & _t60) == 0) {
								_t101 = 0;
								__eflags = 0;
								L30:
								__eflags = _t101;
								if(__eflags == 0) {
									L35:
									E00AB6F6B(_t101);
									goto L36;
								}
								_t62 = E00AB6564(_t87, _t105, __eflags, _a8, _a12, _t81, _v12, _t101, _t105, 0, 0, 0);
								__eflags = _t62;
								if(_t62 == 0) {
									goto L35;
								}
								_push(0);
								_push(0);
								__eflags = _a28;
								if(_a28 != 0) {
									_push(_a28);
									_push(_a24);
								} else {
									_push(0);
									_push(0);
								}
								_t105 = WideCharToMultiByte(_a32, 0, _t101, _t105, ??, ??, ??, ??);
								__eflags = _t105;
								if(_t105 != 0) {
									E00AB6F6B(_t101);
									goto L37;
								} else {
									goto L35;
								}
							}
							_t90 = _t96 + 8;
							__eflags = _t96 - _t90;
							asm("sbb eax, eax");
							_t66 = _t60 & _t90;
							_t87 = _t96 + 8;
							__eflags = _t66 - 0x400;
							if(_t66 > 0x400) {
								__eflags = _t96 - _t87;
								asm("sbb eax, eax");
								_t101 = E00AB46B0(_t87, _t66 & _t87);
								_pop(_t87);
								__eflags = _t101;
								if(_t101 == 0) {
									goto L35;
								}
								 *_t101 = 0xdddd;
								L28:
								_t101 =  &(_t101[4]);
								goto L30;
							}
							__eflags = _t96 - _t87;
							asm("sbb eax, eax");
							E00ABBFA0();
							_t101 = _t107;
							__eflags = _t101;
							if(_t101 == 0) {
								goto L35;
							}
							 *_t101 = 0xcccc;
							goto L28;
						}
						_t70 = _a28;
						if(_t70 == 0) {
							goto L37;
						}
						_t125 = _t105 - _t70;
						if(_t105 > _t70) {
							goto L36;
						}
						_t71 = E00AB6564(0, _t105, _t125, _a8, _a12, _t81, _t100, _a24, _t70, 0, 0, 0);
						_t105 = _t71;
						if(_t71 != 0) {
							goto L37;
						}
						goto L36;
					}
					asm("sbb eax, eax");
					_t72 = _t54 & _t95 + 0x00000008;
					_t85 = _t95 + 8;
					if((_t54 & _t95 + 0x00000008) > 0x400) {
						__eflags = _t95 - _t85;
						asm("sbb eax, eax");
						_t81 = E00AB46B0(_t85, _t72 & _t85);
						_pop(_t85);
						__eflags = _t81;
						if(__eflags == 0) {
							goto L36;
						}
						 *_t81 = 0xdddd;
						L12:
						_t81 =  &(_t81[4]);
						goto L14;
					}
					asm("sbb eax, eax");
					E00ABBFA0();
					_t81 = _t107;
					if(_t81 == 0) {
						goto L36;
					}
					 *_t81 = 0xcccc;
					goto L12;
				}
			}

0x00ab8858
0x00ab8859
0x00ab885a
0x00ab8861
0x00ab8865
0x00ab8866
0x00ab886c
0x00ab8872
0x00ab8878
0x00ab887b
0x00ab887b
0x00ab887e
0x00ab8880
0x00ab8880
0x00ab887e
0x00ab8882
0x00ab8887
0x00ab888e
0x00ab8891
0x00ab8891
0x00ab88ad
0x00ab88b3
0x00ab88b8
0x00ab8a4b
0x00ab8a5e
0x00ab88be
0x00ab88be
0x00ab88c1
0x00ab88c6
0x00ab88ca
0x00ab891e
0x00ab891e
0x00ab8920
0x00ab8922
0x00ab8a40
0x00ab8a40
0x00ab8a42
0x00ab8a43
0x00000000
0x00ab8a49
0x00ab8933
0x00ab8939
0x00ab893b
0x00000000
0x00000000
0x00ab8941
0x00ab8953
0x00ab8958
0x00ab895c
0x00000000
0x00000000
0x00ab8969
0x00ab89a3
0x00ab89a6
0x00ab89a9
0x00ab89ab
0x00ab89ad
0x00ab89af
0x00ab89fb
0x00ab89fb
0x00ab89fd
0x00ab89fd
0x00ab89ff
0x00ab8a39
0x00ab8a3a
0x00000000
0x00ab8a3f
0x00ab8a13
0x00ab8a18
0x00ab8a1a
0x00000000
0x00000000
0x00ab8a1e
0x00ab8a1f
0x00ab8a20
0x00ab8a23
0x00ab8a5f
0x00ab8a62
0x00ab8a25
0x00ab8a25
0x00ab8a26
0x00ab8a26
0x00ab8a33
0x00ab8a35
0x00ab8a37
0x00ab8a68
0x00000000
0x00000000
0x00000000
0x00000000
0x00ab8a37
0x00ab89b1
0x00ab89b4
0x00ab89b6
0x00ab89b8
0x00ab89ba
0x00ab89bd
0x00ab89c2
0x00ab89dd
0x00ab89df
0x00ab89e9
0x00ab89eb
0x00ab89ec
0x00ab89ee
0x00000000
0x00000000
0x00ab89f0
0x00ab89f6
0x00ab89f6
0x00000000
0x00ab89f6
0x00ab89c4
0x00ab89c6
0x00ab89ca
0x00ab89cf
0x00ab89d1
0x00ab89d3
0x00000000
0x00000000
0x00ab89d5
0x00000000
0x00ab89d5
0x00ab896b
0x00ab8970
0x00000000
0x00000000
0x00ab8976
0x00ab8978
0x00000000
0x00000000
0x00ab898f
0x00ab8994
0x00ab8998
0x00000000
0x00000000
0x00000000
0x00ab899e
0x00ab88d1
0x00ab88d3
0x00ab88d5
0x00ab88dd
0x00ab88fc
0x00ab88fe
0x00ab8908
0x00ab890a
0x00ab890b
0x00ab890d
0x00000000
0x00000000
0x00ab8913
0x00ab8919
0x00ab8919
0x00000000
0x00ab8919
0x00ab88e1
0x00ab88e5
0x00ab88ea
0x00ab88ee
0x00000000
0x00000000
0x00ab88f4
0x00000000
0x00ab88f4

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,00AB5C57,00000000,?,?,?,00AB8AA4,?,?,00000100), ref: 00AB88AD
__alloca_probe_16.LIBCMT ref: 00AB88E5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,00AB8AA4,?,?,00000100,5EFC4D8B,?,?), ref: 00AB8933
__alloca_probe_16.LIBCMT ref: 00AB89CA
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,5EFC4D8B,00000100,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00AB8A2D
__freea.LIBCMT ref: 00AB8A3A

Part of subcall function 00AB46B0: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,00AB8CDE,?,00000000,?,00AB7370,?,00000004,00000000,?,?,?,00AB437B), ref: 00AB46E2

__freea.LIBCMT ref: 00AB8A43
__freea.LIBCMT ref: 00AB8A68

Strings

]iL, xrefs: 00AB885A

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
String ID: ]iL
API String ID: 3864826663-4085116960
Opcode ID: 9a4f6ce10222ee5c9348d91d957ecc4af210eae6873f0526a63f4cefb66e2d9b
Instruction ID: 90cc9d086417752cca285015a1420d043982fc9b2066483c8e7693a3766a40c9
Opcode Fuzzy Hash: 9a4f6ce10222ee5c9348d91d957ecc4af210eae6873f0526a63f4cefb66e2d9b
Instruction Fuzzy Hash: 4251D172610216ABDF258F68DC81EFB77ADEB44B90F19422AF805D6142EF38DC40D690

Uniqueness

Uniqueness Score: -1.00%

Function 00AB96AD Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 152
fileCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E00AB96AD(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				signed char _v15;
				char _v16;
				void _v24;
				short _v28;
				char _v31;
				void _v32;
				long _v36;
				intOrPtr _v40;
				void* _v44;
				signed int _v48;
				signed char* _v52;
				long _v56;
				int _v60;
				signed int _t78;
				signed int _t80;
				int _t86;
				void* _t94;
				long _t97;
				void _t105;
				void* _t112;
				signed int _t116;
				signed int _t118;
				signed char _t123;
				signed char _t128;
				intOrPtr _t129;
				signed int _t131;
				signed char* _t133;
				intOrPtr* _t135;
				signed int _t136;
				void* _t137;

				_t78 =  *0xac3018; // 0x4c695d09
				_v8 = _t78 ^ _t136;
				_t80 = _a8;
				_t118 = _t80 >> 6;
				_t116 = (_t80 & 0x0000003f) * 0x30;
				_t133 = _a12;
				_v52 = _t133;
				_v48 = _t118;
				_v44 =  *((intOrPtr*)( *((intOrPtr*)(0xac3f60 + _t118 * 4)) + _t116 + 0x18));
				_v40 = _a16 + _t133;
				_t86 = GetConsoleCP();
				_t135 = _a4;
				_v60 = _t86;
				 *_t135 = 0;
				 *((intOrPtr*)(_t135 + 4)) = 0;
				 *((intOrPtr*)(_t135 + 8)) = 0;
				while(_t133 < _v40) {
					_v28 = 0;
					_v31 =  *_t133;
					_t129 =  *((intOrPtr*)(0xac3f60 + _v48 * 4));
					_t123 =  *(_t129 + _t116 + 0x2d);
					if((_t123 & 0x00000004) == 0) {
						if(( *(E00AB6BA1(_t116, _t129) + ( *_t133 & 0x000000ff) * 2) & 0x00008000) == 0) {
							_push(1);
							_push(_t133);
							goto L8;
						} else {
							if(_t133 >= _v40) {
								_t131 = _v48;
								 *((char*)( *((intOrPtr*)(0xac3f60 + _t131 * 4)) + _t116 + 0x2e)) =  *_t133;
								 *( *((intOrPtr*)(0xac3f60 + _t131 * 4)) + _t116 + 0x2d) =  *( *((intOrPtr*)(0xac3f60 + _t131 * 4)) + _t116 + 0x2d) | 0x00000004;
								 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 4)) + 1;
							} else {
								_t112 = E00AB7F6A( &_v28, _t133, 2);
								_t137 = _t137 + 0xc;
								if(_t112 != 0xffffffff) {
									_t133 =  &(_t133[1]);
									goto L9;
								}
							}
						}
					} else {
						_t128 = _t123 & 0x000000fb;
						_v16 =  *((intOrPtr*)(_t129 + _t116 + 0x2e));
						_push(2);
						_v15 = _t128;
						 *(_t129 + _t116 + 0x2d) = _t128;
						_push( &_v16);
						L8:
						_push( &_v28);
						_t94 = E00AB7F6A();
						_t137 = _t137 + 0xc;
						if(_t94 != 0xffffffff) {
							L9:
							_t133 =  &(_t133[1]);
							_t97 = WideCharToMultiByte(_v60, 0,  &_v28, 1,  &_v24, 5, 0, 0);
							_v56 = _t97;
							if(_t97 != 0) {
								if(WriteFile(_v44,  &_v24, _t97,  &_v36, 0) == 0) {
									L19:
									 *_t135 = GetLastError();
								} else {
									 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 8)) - _v52 + _t133;
									if(_v36 >= _v56) {
										if(_v31 != 0xa) {
											goto L16;
										} else {
											_t105 = 0xd;
											_v32 = _t105;
											if(WriteFile(_v44,  &_v32, 1,  &_v36, 0) == 0) {
												goto L19;
											} else {
												if(_v36 >= 1) {
													 *((intOrPtr*)(_t135 + 8)) =  *((intOrPtr*)(_t135 + 8)) + 1;
													 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 4)) + 1;
													goto L16;
												}
											}
										}
									}
								}
							}
						}
					}
					goto L20;
					L16:
				}
				L20:
				return E00AB29BB(_v8 ^ _t136);
			}

0x00ab96b5
0x00ab96bc
0x00ab96bf
0x00ab96c7
0x00ab96cb
0x00ab96d7
0x00ab96da
0x00ab96dd
0x00ab96e4
0x00ab96ec
0x00ab96ef
0x00ab96f5
0x00ab96fb
0x00ab9700
0x00ab9702
0x00ab9705
0x00ab970a
0x00ab9714
0x00ab971b
0x00ab971e
0x00ab9725
0x00ab972c
0x00ab9758
0x00ab977e
0x00ab9780
0x00000000
0x00ab975a
0x00ab975d
0x00ab9824
0x00ab9830
0x00ab983b
0x00ab9840
0x00ab9763
0x00ab976a
0x00ab976f
0x00ab9775
0x00ab977b
0x00000000
0x00ab977b
0x00ab9775
0x00ab975d
0x00ab972e
0x00ab9732
0x00ab9735
0x00ab973b
0x00ab973d
0x00ab9740
0x00ab9744
0x00ab9781
0x00ab9784
0x00ab9785
0x00ab978a
0x00ab9790
0x00ab9796
0x00ab97a5
0x00ab97ab
0x00ab97b1
0x00ab97b6
0x00ab97d2
0x00ab9845
0x00ab984b
0x00ab97d4
0x00ab97dc
0x00ab97e5
0x00ab97eb
0x00000000
0x00ab97ed
0x00ab97ef
0x00ab97f2
0x00ab980b
0x00000000
0x00ab980d
0x00ab9811
0x00ab9813
0x00ab9816
0x00000000
0x00ab9816
0x00ab9811
0x00ab980b
0x00ab97eb
0x00ab97e5
0x00ab97d2
0x00ab97b6
0x00ab9790
0x00000000
0x00ab9819
0x00ab9819
0x00ab984d
0x00ab985f

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,00AB9E22,?,00000000,?,00000000,00000000), ref: 00AB96EF
__fassign.LIBCMT ref: 00AB976A
__fassign.LIBCMT ref: 00AB9785
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 00AB97AB
WriteFile.KERNEL32(?,?,00000000,00AB9E22,00000000,?,?,?,?,?,?,?,?,?,00AB9E22,?), ref: 00AB97CA
WriteFile.KERNEL32(?,?,00000001,00AB9E22,00000000,?,?,?,?,?,?,?,?,?,00AB9E22,?), ref: 00AB9803

Strings

]iL, xrefs: 00AB96B5

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID: ]iL
API String ID: 1324828854-4085116960
Opcode ID: 032ad9d89667bbec35f61f843c55e6bdb9585941bdecb35c29c1937912b38e99
Instruction ID: ff9e750598735ab538c20d7302039bacfa5b5fd34d9be379155d6637dd5a32e2
Opcode Fuzzy Hash: 032ad9d89667bbec35f61f843c55e6bdb9585941bdecb35c29c1937912b38e99
Instruction Fuzzy Hash: A8518375D00249DFDB10CFE8D885AEEBBF9EF09310F14455AEA56E7252E730A941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AB6E4E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00AB6E4E(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, int _a8, char* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28) {
				signed int _v8;
				int _v12;
				char _v16;
				intOrPtr _v24;
				char _v28;
				void* _v40;
				signed int _t34;
				signed int _t40;
				int _t46;
				int _t53;
				void* _t55;
				int _t57;
				signed int _t63;
				int _t67;
				short* _t69;
				signed int _t70;
				short* _t71;

				_t34 =  *0xac3018; // 0x4c695d09
				_v8 = _t34 ^ _t70;
				E00AB47F8(__ebx,  &_v28, __edx, _a4);
				_t57 = _a24;
				if(_t57 == 0) {
					_t53 =  *(_v24 + 8);
					_t57 = _t53;
					_a24 = _t53;
				}
				_t67 = 0;
				_t40 = MultiByteToWideChar(_t57, 1 + (0 | _a28 != 0x00000000) * 8, _a12, _a16, 0, 0);
				_v12 = _t40;
				if(_t40 == 0) {
					L15:
					if(_v16 != 0) {
						 *(_v28 + 0x350) =  *(_v28 + 0x350) & 0xfffffffd;
					}
					return E00AB29BB(_v8 ^ _t70);
				}
				_t55 = _t40 + _t40;
				_t17 = _t55 + 8; // 0x8
				asm("sbb eax, eax");
				if((_t17 & _t40) == 0) {
					_t69 = 0;
					L11:
					if(_t69 != 0) {
						E00AB2CE0(_t67, _t69, _t67, _t55);
						_t46 = MultiByteToWideChar(_a24, 1, _a12, _a16, _t69, _v12);
						if(_t46 != 0) {
							_t67 = GetStringTypeW(_a8, _t69, _t46, _a20);
						}
					}
					L14:
					E00AB6F6B(_t69);
					goto L15;
				}
				_t20 = _t55 + 8; // 0x8
				asm("sbb eax, eax");
				_t48 = _t40 & _t20;
				_t21 = _t55 + 8; // 0x8
				_t63 = _t21;
				if((_t40 & _t20) > 0x400) {
					asm("sbb eax, eax");
					_t69 = E00AB46B0(_t63, _t48 & _t63);
					if(_t69 == 0) {
						goto L14;
					}
					 *_t69 = 0xdddd;
					L9:
					_t69 =  &(_t69[4]);
					goto L11;
				}
				asm("sbb eax, eax");
				E00ABBFA0();
				_t69 = _t71;
				if(_t69 == 0) {
					goto L14;
				}
				 *_t69 = 0xcccc;
				goto L9;
			}

0x00ab6e56
0x00ab6e5d
0x00ab6e69
0x00ab6e6e
0x00ab6e73
0x00ab6e78
0x00ab6e7b
0x00ab6e7d
0x00ab6e7d
0x00ab6e82
0x00ab6e9b
0x00ab6ea1
0x00ab6ea6
0x00ab6f45
0x00ab6f49
0x00ab6f4e
0x00ab6f4e
0x00ab6f6a
0x00ab6f6a
0x00ab6eac
0x00ab6eaf
0x00ab6eb4
0x00ab6eb8
0x00ab6f04
0x00ab6f06
0x00ab6f08
0x00ab6f0d
0x00ab6f24
0x00ab6f2c
0x00ab6f3c
0x00ab6f3c
0x00ab6f2c
0x00ab6f3e
0x00ab6f3f
0x00000000
0x00ab6f44
0x00ab6eba
0x00ab6ebf
0x00ab6ec1
0x00ab6ec3
0x00ab6ec3
0x00ab6ecb
0x00ab6ee8
0x00ab6ef2
0x00ab6ef7
0x00000000
0x00000000
0x00ab6ef9
0x00ab6eff
0x00ab6eff
0x00000000
0x00ab6eff
0x00ab6ecf
0x00ab6ed3
0x00ab6ed8
0x00ab6edc
0x00000000
0x00000000
0x00ab6ede
0x00000000

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000100,00000020,00000000,00000000,5EFC4D8B,00000100,00AB5C57,00000000,00000001,00000020,00000100,?,5EFC4D8B,00000000), ref: 00AB6E9B
__alloca_probe_16.LIBCMT ref: 00AB6ED3
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00AB6F24
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00AB6F36
__freea.LIBCMT ref: 00AB6F3F

Part of subcall function 00AB46B0: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,00AB8CDE,?,00000000,?,00AB7370,?,00000004,00000000,?,?,?,00AB437B), ref: 00AB46E2

Strings

]iL, xrefs: 00AB6E56

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
String ID: ]iL
API String ID: 313313983-4085116960
Opcode ID: e82b57a51d2119ff523c7831b94055f3f3ceeb8f332dd6508494e7d8ee4b1603
Instruction ID: 78469a0cef44c8f56182e8b3dd55497a7283d6760a51c567aa092d7df6090c70
Opcode Fuzzy Hash: e82b57a51d2119ff523c7831b94055f3f3ceeb8f332dd6508494e7d8ee4b1603
Instruction Fuzzy Hash: DB31BD32A1020AABDB249F74EC45EFE7BA9EF40310F044129FC05D6252EB39CD51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AB3E82 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00AB3E77,00000003,?,00AB3E17,00000003,00AC1DE8,0000000C,00AB3F2A,00000003,00000002), ref: 00AB3EA2
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00AB3EB5
FreeLibrary.KERNEL32(00000000,?,?,?,00AB3E77,00000003,?,00AB3E17,00000003,00AC1DE8,0000000C,00AB3F2A,00000003,00000002,00000000), ref: 00AB3ED8

Strings

mscoree.dll, xrefs: 00AB3E9B
]iL, xrefs: 00AB3E89
CorExitProcess, xrefs: 00AB3EAD

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: ]iL$CorExitProcess$mscoree.dll
API String ID: 4061214504-3098782845
Opcode ID: 19e9a03ac136d47b53d3df79c99b8db0616c0195f725fb1f4e14c661886e180e
Instruction ID: 979111af1f75f3d913a794bcbbfe920a08ee2e10651d704b5160e5b4f0c1510d
Opcode Fuzzy Hash: 19e9a03ac136d47b53d3df79c99b8db0616c0195f725fb1f4e14c661886e180e
Instruction Fuzzy Hash: 60F04F31A0020DBBCB15AB95DD09BDEBFBDEB44711F010169F80AA2162EB318A52DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AB9D28 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00AB9D28(void* __ebx, void* __edi, void* __esi, signed int _a4, void* _a8, signed int _a12) {
				signed int _v8;
				long _v12;
				struct _OVERLAPPED* _v16;
				long _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				void* _v52;
				signed int _t62;
				intOrPtr _t66;
				signed char _t68;
				signed int _t69;
				signed int _t71;
				signed int _t73;
				signed int _t74;
				signed int _t77;
				intOrPtr _t79;
				signed int _t87;
				signed int _t90;
				signed int _t106;
				signed int _t107;
				signed int _t110;
				intOrPtr _t112;
				signed int _t117;
				signed int _t119;
				void* _t121;
				signed int _t124;
				signed int _t126;
				signed int _t128;
				void* _t129;

				_t62 =  *0xac3018; // 0x4c695d09
				_v8 = _t62 ^ _t128;
				_t110 = _a12;
				_v12 = _t110;
				_t124 = _a4;
				_t121 = _a8;
				_v52 = _t121;
				if(_t110 != 0) {
					__eflags = _t121;
					if(_t121 != 0) {
						_push(__ebx);
						_t106 = _t124 >> 6;
						_t119 = (_t124 & 0x0000003f) * 0x30;
						_v32 = _t106;
						_t66 =  *((intOrPtr*)(0xac3f60 + _t106 * 4));
						_v48 = _t66;
						_v28 = _t119;
						_t107 =  *((intOrPtr*)(_t66 + _t119 + 0x29));
						__eflags = _t107 - 2;
						if(_t107 == 2) {
							L6:
							_t68 =  !_t110;
							__eflags = _t68 & 0x00000001;
							if((_t68 & 0x00000001) != 0) {
								_t66 = _v48;
								L9:
								__eflags =  *(_t66 + _t119 + 0x28) & 0x00000020;
								if(__eflags != 0) {
									E00ABA22B(_t124, 0, 0, 2);
									_t129 = _t129 + 0x10;
								}
								_t69 = E00AB98CD(_t107, _t119, __eflags, _t124);
								__eflags = _t69;
								if(_t69 == 0) {
									_t112 =  *((intOrPtr*)(0xac3f60 + _v32 * 4));
									_t71 = _v28;
									__eflags =  *(_t112 + _t71 + 0x28) & 0x00000080;
									if(( *(_t112 + _t71 + 0x28) & 0x00000080) == 0) {
										_v24 = 0;
										_v20 = 0;
										_v16 = 0;
										_t73 = WriteFile( *(_t112 + _t71 + 0x18), _t121, _v12,  &_v20, 0);
										__eflags = _t73;
										if(_t73 == 0) {
											_v24 = GetLastError();
										}
										goto L28;
									}
									_t87 = _t107;
									__eflags = _t87;
									if(_t87 == 0) {
										E00AB9943(_t107, _t121, _t124,  &_v24, _t124, _t121, _v12);
										goto L17;
									}
									_t90 = _t87 - 1;
									__eflags = _t90;
									if(_t90 == 0) {
										_t89 = E00AB9B10(_t107, _t121, _t124,  &_v24, _t124, _t121, _v12);
										goto L17;
									}
									__eflags = _t90 != 1;
									if(_t90 != 1) {
										goto L34;
									}
									_t89 = E00AB9A22(_t107, _t121, _t124,  &_v24, _t124, _t121, _v12);
									goto L17;
								} else {
									__eflags = _t107;
									if(_t107 == 0) {
										_t89 = E00AB96AD(_t107, _t121, _t124,  &_v24, _t124, _t121, _v12);
										L17:
										L15:
										L28:
										asm("movsd");
										asm("movsd");
										asm("movsd");
										_t74 = _v40;
										__eflags = _t74;
										if(_t74 != 0) {
											__eflags = _t74 - _v36;
											L40:
											L41:
											return E00AB29BB(_v8 ^ _t128);
										}
										_t77 = _v44;
										__eflags = _t77;
										if(_t77 == 0) {
											_t121 = _v52;
											L34:
											_t117 = _v28;
											_t79 =  *((intOrPtr*)(0xac3f60 + _v32 * 4));
											__eflags =  *(_t79 + _t117 + 0x28) & 0x00000040;
											if(( *(_t79 + _t117 + 0x28) & 0x00000040) == 0) {
												L37:
												 *((intOrPtr*)(E00AB501F())) = 0x1c;
												_t81 = E00AB500C();
												 *_t81 =  *_t81 & 0x00000000;
												__eflags =  *_t81;
												L38:
												goto L40;
											}
											__eflags =  *_t121 - 0x1a;
											if( *_t121 != 0x1a) {
												goto L37;
											}
											goto L40;
										}
										_t126 = 5;
										__eflags = _t77 - _t126;
										if(_t77 != _t126) {
											_t81 = E00AB4FE9(_t77);
										} else {
											 *((intOrPtr*)(E00AB501F())) = 9;
											 *(E00AB500C()) = _t126;
										}
										goto L38;
									}
									__eflags = _t107 - 1 - 1;
									if(_t107 - 1 > 1) {
										goto L34;
									}
									E00AB9860( &_v24, _t121, _v12);
									goto L15;
								}
							}
							 *(E00AB500C()) =  *_t97 & 0x00000000;
							 *((intOrPtr*)(E00AB501F())) = 0x16;
							_t81 = E00AB4F63();
							goto L38;
						}
						__eflags = _t107 - 1;
						if(_t107 != 1) {
							goto L9;
						}
						goto L6;
					}
					 *(E00AB500C()) =  *_t99 & _t121;
					 *((intOrPtr*)(E00AB501F())) = 0x16;
					E00AB4F63();
					goto L41;
				}
				goto L41;
			}

0x00ab9d30
0x00ab9d37
0x00ab9d3a
0x00ab9d3d
0x00ab9d41
0x00ab9d45
0x00ab9d48
0x00ab9d4d
0x00ab9d56
0x00ab9d58
0x00ab9d79
0x00ab9d7e
0x00ab9d84
0x00ab9d87
0x00ab9d8a
0x00ab9d91
0x00ab9d94
0x00ab9d97
0x00ab9d9b
0x00ab9d9e
0x00ab9da5
0x00ab9da7
0x00ab9da9
0x00ab9dab
0x00ab9dca
0x00ab9dcd
0x00ab9dcd
0x00ab9dd2
0x00ab9ddb
0x00ab9de0
0x00ab9de0
0x00ab9de4
0x00ab9dea
0x00ab9dec
0x00ab9e2a
0x00ab9e31
0x00ab9e34
0x00ab9e39
0x00ab9e88
0x00ab9e8b
0x00ab9e8e
0x00ab9e9a
0x00ab9ea0
0x00ab9ea2
0x00ab9eaa
0x00ab9eaa
0x00000000
0x00ab9ead
0x00ab9e3e
0x00ab9e3e
0x00ab9e41
0x00ab9e7a
0x00000000
0x00ab9e7a
0x00ab9e43
0x00ab9e43
0x00ab9e46
0x00ab9e6a
0x00000000
0x00ab9e6a
0x00ab9e48
0x00ab9e4b
0x00000000
0x00000000
0x00ab9e5a
0x00000000
0x00ab9dee
0x00ab9dee
0x00ab9df0
0x00ab9e1d
0x00ab9e22
0x00ab9e0d
0x00ab9eb0
0x00ab9eb3
0x00ab9eb4
0x00ab9eb5
0x00ab9eb6
0x00ab9eb9
0x00ab9ebb
0x00ab9f20
0x00ab9f23
0x00ab9f24
0x00ab9f33
0x00ab9f33
0x00ab9ebd
0x00ab9ec0
0x00ab9ec2
0x00ab9ee8
0x00ab9eeb
0x00ab9eee
0x00ab9ef1
0x00ab9ef8
0x00ab9efd
0x00ab9f08
0x00ab9f0d
0x00ab9f13
0x00ab9f18
0x00ab9f18
0x00ab9f1b
0x00000000
0x00ab9f1b
0x00ab9eff
0x00ab9f02
0x00000000
0x00000000
0x00000000
0x00ab9f04
0x00ab9ec6
0x00ab9ec7
0x00ab9ec9
0x00ab9ee0
0x00ab9ecb
0x00ab9ed0
0x00ab9edb
0x00ab9edb
0x00000000
0x00ab9ec9
0x00ab9df4
0x00ab9df7
0x00000000
0x00000000
0x00ab9e05
0x00000000
0x00ab9e0a
0x00ab9dec
0x00ab9db2
0x00ab9dba
0x00ab9dc0
0x00000000
0x00ab9dc0
0x00ab9da0
0x00ab9da3
0x00000000
0x00000000
0x00000000
0x00ab9da3
0x00ab9d5f
0x00ab9d66
0x00ab9d6c
0x00000000
0x00ab9d71
0x00000000

Strings

]iL, xrefs: 00AB9D30

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID:
String ID: ]iL
API String ID: 0-4085116960
Opcode ID: c85bad27c3f82941b0e8200cddfec9ce43876a2e03ad6aba658ebe3e31b52ccb
Instruction ID: e0d9bfa0b663a1c242ad2219aeef55133c0ab3a6d446b9e2bcc600b0d1500c54
Opcode Fuzzy Hash: c85bad27c3f82941b0e8200cddfec9ce43876a2e03ad6aba658ebe3e31b52ccb
Instruction Fuzzy Hash: 52518B71D1020AABDB11EFB9C945BEFBBBCAF09320F140059F605A7293D7719A41DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AB42EE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 83%

			E00AB42EE(signed int* __ecx, signed int __edx) {
				signed int _v8;
				intOrPtr* _v12;
				signed int _v16;
				signed int _t28;
				signed int _t29;
				intOrPtr _t33;
				signed int _t37;
				signed int _t38;
				signed int _t40;
				void* _t50;
				signed int _t56;
				intOrPtr* _t57;
				signed int _t68;
				signed int _t71;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t78;
				signed int _t80;
				signed int* _t81;
				signed int _t85;
				void* _t86;

				_t72 = __edx;
				_v12 = __ecx;
				_t28 =  *__ecx;
				_t81 =  *_t28;
				if(_t81 != 0) {
					_t29 =  *0xac3018; // 0x4c695d09
					_t56 =  *_t81 ^ _t29;
					_t78 = _t81[1] ^ _t29;
					_t83 = _t81[2] ^ _t29;
					asm("ror edi, cl");
					asm("ror esi, cl");
					asm("ror ebx, cl");
					if(_t78 != _t83) {
						L14:
						 *_t78 = E00AB3CF6( *((intOrPtr*)( *((intOrPtr*)(_v12 + 4)))));
						_t33 = E00AB3074(_t56);
						_t57 = _v12;
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)))) = _t33;
						_t24 = _t78 + 4; // 0x4
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)) + 4)) = E00AB3074(_t24);
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)) + 8)) = E00AB3074(_t83);
						_t37 = 0;
						L15:
						return _t37;
					}
					_t38 = 0x200;
					_t85 = _t83 - _t56 >> 2;
					if(_t85 <= 0x200) {
						_t38 = _t85;
					}
					_t80 = _t38 + _t85;
					if(_t80 == 0) {
						_t80 = 0x20;
					}
					if(_t80 < _t85) {
						L9:
						_push(4);
						_t80 = _t85 + 4;
						_push(_t80);
						_v8 = E00AB731C(_t56);
						_t40 = E00AB4676(0);
						_t68 = _v8;
						_t86 = _t86 + 0x10;
						if(_t68 != 0) {
							goto L11;
						}
						_t37 = _t40 | 0xffffffff;
						goto L15;
					} else {
						_push(4);
						_push(_t80);
						_v8 = E00AB731C(_t56);
						E00AB4676(0);
						_t68 = _v8;
						_t86 = _t86 + 0x10;
						if(_t68 != 0) {
							L11:
							_t56 = _t68;
							_v8 = _t68 + _t85 * 4;
							_t83 = _t68 + _t80 * 4;
							_t78 = _v8;
							_push(0x20);
							asm("ror eax, cl");
							_t71 = _t78;
							_v16 = 0 ^  *0xac3018;
							asm("sbb edx, edx");
							_t74 =  !_t72 & _t68 + _t80 * 0x00000004 - _t78 + 0x00000003 >> 0x00000002;
							_v8 = _t74;
							if(_t74 == 0) {
								goto L14;
							}
							_t75 = _v16;
							_t50 = 0;
							do {
								_t50 = _t50 + 1;
								 *_t71 = _t75;
								_t71 = _t71 + 4;
							} while (_t50 != _v8);
							goto L14;
						}
						goto L9;
					}
				}
				return _t28 | 0xffffffff;
			}

0x00ab42ee
0x00ab42f8
0x00ab42fc
0x00ab42fe
0x00ab4302
0x00ab430c
0x00ab431d
0x00ab4322
0x00ab4324
0x00ab4326
0x00ab4328
0x00ab432a
0x00ab432e
0x00ab43e8
0x00ab43f6
0x00ab43f8
0x00ab43fd
0x00ab4404
0x00ab4406
0x00ab4414
0x00ab4423
0x00ab4426
0x00ab4428
0x00000000
0x00ab4429
0x00ab4336
0x00ab433b
0x00ab4340
0x00ab4342
0x00ab4342
0x00ab4344
0x00ab4349
0x00ab434d
0x00ab434d
0x00ab4350
0x00ab436f
0x00ab436f
0x00ab4371
0x00ab4374
0x00ab437d
0x00ab4380
0x00ab4385
0x00ab4388
0x00ab438d
0x00000000
0x00000000
0x00ab438f
0x00000000
0x00ab4352
0x00ab4352
0x00ab4354
0x00ab435d
0x00ab4360
0x00ab4365
0x00ab4368
0x00ab436d
0x00ab4397
0x00ab439a
0x00ab439c
0x00ab439f
0x00ab43a7
0x00ab43ad
0x00ab43b4
0x00ab43b6
0x00ab43be
0x00ab43cd
0x00ab43d1
0x00ab43d3
0x00ab43d6
0x00000000
0x00000000
0x00ab43d8
0x00ab43db
0x00ab43dd
0x00ab43dd
0x00ab43de
0x00ab43e0
0x00ab43e3
0x00000000
0x00ab43dd
0x00000000
0x00ab436d
0x00ab4350
0x00000000

Strings

]iL, xrefs: 00AB430C, 00AB43A2

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID:
String ID: ]iL
API String ID: 0-4085116960
Opcode ID: f83643daba645c6221c957788f6522e7a0d305e4ebedc4b7b729c2db6fd3bfa2
Instruction ID: f27e821ee05486096f77c67556160ab1f50fdfeff465c72d21233ba27aa4724c
Opcode Fuzzy Hash: f83643daba645c6221c957788f6522e7a0d305e4ebedc4b7b729c2db6fd3bfa2
Instruction Fuzzy Hash: 5741A376A002049BCF24DF78C981A9DB7E9EF89714F154569E515EF393D731AE01CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00AB9B10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101
fileCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00AB9B10(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, signed int _a8, signed short* _a12, intOrPtr _a16) {
				signed int _v8;
				char _v12;
				short _v1716;
				char _v5132;
				intOrPtr _v5136;
				long _v5140;
				void* _v5144;
				int _v5148;
				signed int _t31;
				intOrPtr _t38;
				signed int* _t41;
				int _t45;
				int _t54;
				signed short* _t59;
				signed int _t65;
				signed int _t67;
				signed short* _t69;
				intOrPtr* _t72;
				intOrPtr _t74;
				signed int _t75;

				E00ABC1B0();
				_t31 =  *0xac3018; // 0x4c695d09
				_v8 = _t31 ^ _t75;
				_t54 = 0;
				_t72 = _a4;
				_t59 = _a12;
				_t69 = _t59;
				_v5144 =  *((intOrPtr*)( *((intOrPtr*)(0xac3f60 + (_a8 >> 6) * 4)) + 0x18 + (_a8 & 0x0000003f) * 0x30));
				_t38 = _a16 + _t59;
				 *_t72 = 0;
				 *((intOrPtr*)(_t72 + 4)) = 0;
				_v5136 = _t38;
				 *((intOrPtr*)(_t72 + 8)) = 0;
				if(_t59 < _t38) {
					while(1) {
						L1:
						_t74 = _v5136;
						_t41 =  &_v1716;
						while(_t69 < _t74) {
							_t65 =  *_t69 & 0x0000ffff;
							_t69 =  &(_t69[1]);
							if(_t65 == 0xa) {
								_t67 = 0xd;
								 *_t41 = _t67;
								_t41 =  &(_t41[0]);
							}
							 *_t41 = _t65;
							_t41 =  &(_t41[0]);
							if(_t41 <  &_v12) {
								continue;
							}
							break;
						}
						_t45 = WideCharToMultiByte(0xfde9, _t54,  &_v1716, _t41 -  &_v1716 >> 1,  &_v5132, 0xd55, _t54, _t54);
						_t72 = _a4;
						_v5148 = _t45;
						if(_t45 == 0) {
							L11:
							 *_t72 = GetLastError();
						} else {
							while(WriteFile(_v5144,  &(( &_v5132)[_t54]), _t45 - _t54,  &_v5140, 0) != 0) {
								_t54 = _t54 + _v5140;
								_t45 = _v5148;
								if(_t54 < _t45) {
									continue;
								} else {
									 *((intOrPtr*)(_t72 + 4)) = _t69 - _a12;
									if(_t69 < _v5136) {
										_t54 = 0;
										goto L1;
									}
								}
								goto L12;
							}
							goto L11;
						}
						goto L12;
					}
				}
				L12:
				return E00AB29BB(_v8 ^ _t75);
			}

0x00ab9b1a
0x00ab9b1f
0x00ab9b26
0x00ab9b40
0x00ab9b42
0x00ab9b4a
0x00ab9b4d
0x00ab9b4f
0x00ab9b58
0x00ab9b5a
0x00ab9b5c
0x00ab9b5f
0x00ab9b65
0x00ab9b6a
0x00ab9b70
0x00ab9b70
0x00ab9b70
0x00ab9b76
0x00ab9b7c
0x00ab9b80
0x00ab9b83
0x00ab9b89
0x00ab9b8d
0x00ab9b8e
0x00ab9b91
0x00ab9b91
0x00ab9b94
0x00ab9b97
0x00ab9b9f
0x00000000
0x00000000
0x00000000
0x00ab9b9f
0x00ab9bc3
0x00ab9bc9
0x00ab9bcc
0x00ab9bd4
0x00ab9c22
0x00ab9c28
0x00ab9bd6
0x00ab9bd6
0x00ab9bfb
0x00ab9c01
0x00ab9c09
0x00000000
0x00ab9c0b
0x00ab9c10
0x00ab9c19
0x00ab9c1b
0x00000000
0x00ab9c1b
0x00ab9c19
0x00000000
0x00ab9c09
0x00000000
0x00ab9bd6
0x00000000
0x00ab9bd4
0x00ab9b70
0x00ab9c2a
0x00ab9c3c

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000D55,00000000,00000000,?,00000000,?,?,00AB9E6F,?,00000000,?), ref: 00AB9BC3
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00AB9E6F,?,00000000,?,00000000,00000000,?,00000000), ref: 00AB9BF1
GetLastError.KERNEL32(?,00AB9E6F,?,00000000,?,00000000,00000000,?,00000000), ref: 00AB9C22

Strings

]iL, xrefs: 00AB9B1F

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: ]iL
API String ID: 2456169464-4085116960
Opcode ID: d2dd44801dff05f3b67cd4dc3e51fde7733d07b1e696f8094642413328cf77da
Instruction ID: 96c90d60ce7e3afc71eb514ad10d7278c58a2a9d3bc1d92e354fbd4baa22e38c
Opcode Fuzzy Hash: d2dd44801dff05f3b67cd4dc3e51fde7733d07b1e696f8094642413328cf77da
Instruction Fuzzy Hash: 7B316175A002199FDB18DF59DC919EAB7B9EF08310F0445ADEA0AD7251D630AE81CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00AB62B8 Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E00AB62B8(signed int _a4) {
				signed int _t9;
				void* _t13;
				signed int _t15;
				WCHAR* _t22;
				signed int _t24;
				signed int* _t25;
				void* _t27;

				_t9 = _a4;
				_t25 = 0xac3e88 + _t9 * 4;
				_t24 =  *_t25;
				if(_t24 == 0) {
					_t22 =  *(0xabdd68 + _t9 * 4);
					_t27 = LoadLibraryExW(_t22, 0, 0x800);
					if(_t27 != 0) {
						L8:
						 *_t25 = _t27;
						if( *_t25 != 0) {
							FreeLibrary(_t27);
						}
						_t13 = _t27;
						L11:
						return _t13;
					}
					_t15 = GetLastError();
					if(_t15 != 0x57) {
						_t27 = 0;
					} else {
						_t15 = LoadLibraryExW(_t22, _t27, _t27);
						_t27 = _t15;
					}
					if(_t27 != 0) {
						goto L8;
					} else {
						 *_t25 = _t15 | 0xffffffff;
						_t13 = 0;
						goto L11;
					}
				}
				_t4 = _t24 + 1; // 0x4c695d0a
				asm("sbb eax, eax");
				return  ~_t4 & _t24;
			}

0x00ab62bd
0x00ab62c1
0x00ab62c8
0x00ab62cc
0x00ab62da
0x00ab62f0
0x00ab62f4
0x00ab631d
0x00ab631f
0x00ab6323
0x00ab6326
0x00ab6326
0x00ab632c
0x00ab632e
0x00000000
0x00ab632f
0x00ab62f6
0x00ab62ff
0x00ab630e
0x00ab6301
0x00ab6304
0x00ab630a
0x00ab630a
0x00ab6312
0x00000000
0x00ab6314
0x00ab6317
0x00ab6319
0x00000000
0x00ab6319
0x00ab6312
0x00ab62ce
0x00ab62d3
0x00000000

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,00AB625F,00000000,00000000,00000000,00000000,?,00AB64D0,00000006,FlsSetValue), ref: 00AB62EA
GetLastError.KERNEL32(?,00AB625F,00000000,00000000,00000000,00000000,?,00AB64D0,00000006,FlsSetValue,00ABE238,00ABE240,00000000,00000364,?,00AB4D1C), ref: 00AB62F6
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00AB625F,00000000,00000000,00000000,00000000,?,00AB64D0,00000006,FlsSetValue,00ABE238,00ABE240,00000000), ref: 00AB6304

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 77a16a289da485f1b61992a8b3dac55f4561072b77d3d469469337f2684ffc41
Instruction ID: c2a4ebb920dce991560ae0e801a9394c2eb63feaab0b6c451f69b2a4567d6e55
Opcode Fuzzy Hash: 77a16a289da485f1b61992a8b3dac55f4561072b77d3d469469337f2684ffc41
Instruction Fuzzy Hash: 15012B32706332ABCB219FB8AC44AD63BDCAF057A0B210620FD0ADB152D724D812C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00AB4C4A Relevance: 6.0, APIs: 4, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E00AB4C4A(void* __ebx, void* __ecx, void* __edx) {
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				void* _t3;
				void* _t4;
				intOrPtr _t9;
				void* _t11;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t31;
				void* _t32;
				long _t36;
				long _t37;
				void* _t40;

				_t29 = __edx;
				_t23 = __ecx;
				_t20 = __ebx;
				_t36 = GetLastError();
				_t2 =  *0xac3044; // 0x6
				_t42 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t3 = E00AB479B(_t23, 1, 0x364);
					_t31 = _t3;
					_pop(_t25);
					if(_t31 != 0) {
						_t4 = E00AB64A9(_t25, _t36, __eflags,  *0xac3044, _t31);
						__eflags = _t4;
						if(_t4 != 0) {
							E00AB4ABC(_t25, _t31, 0xac4164);
							E00AB4676(0);
							_t40 = _t40 + 0xc;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t31);
							goto L4;
						}
					} else {
						_push(_t3);
						L4:
						E00AB4676();
						_pop(_t25);
						L9:
						SetLastError(_t36);
						E00AB4758(_t20, _t29, _t31, _t36);
						asm("int3");
						_push(_t20);
						_push(_t36);
						_push(_t31);
						_t37 = GetLastError();
						_t21 = 0;
						_t9 =  *0xac3044; // 0x6
						_t45 = _t9 - 0xffffffff;
						if(_t9 == 0xffffffff) {
							L12:
							_t32 = E00AB479B(_t25, 1, 0x364);
							_pop(_t27);
							if(_t32 != 0) {
								_t11 = E00AB64A9(_t27, _t37, __eflags,  *0xac3044, _t32);
								__eflags = _t11;
								if(_t11 != 0) {
									E00AB4ABC(_t27, _t32, 0xac4164);
									E00AB4676(_t21);
									__eflags = _t32;
									if(_t32 != 0) {
										goto L19;
									} else {
										goto L18;
									}
								} else {
									_push(_t32);
									goto L14;
								}
							} else {
								_push(_t21);
								L14:
								E00AB4676();
								L18:
								SetLastError(_t37);
							}
						} else {
							_t32 = E00AB6453(_t25, _t37, _t45, _t9);
							if(_t32 != 0) {
								L19:
								SetLastError(_t37);
								_t21 = _t32;
							} else {
								goto L12;
							}
						}
						return _t21;
					}
				} else {
					_t31 = E00AB6453(_t23, _t36, _t42, _t2);
					if(_t31 != 0) {
						L8:
						SetLastError(_t36);
						return _t31;
					} else {
						goto L2;
					}
				}
			}

0x00ab4c4a
0x00ab4c4a
0x00ab4c4a
0x00ab4c54
0x00ab4c56
0x00ab4c5b
0x00ab4c5e
0x00ab4c6c
0x00ab4c73
0x00ab4c78
0x00ab4c7b
0x00ab4c7e
0x00ab4c90
0x00ab4c95
0x00ab4c97
0x00ab4ca2
0x00ab4ca9
0x00ab4cae
0x00ab4cb1
0x00ab4cb3
0x00000000
0x00000000
0x00000000
0x00000000
0x00ab4c99
0x00ab4c99
0x00000000
0x00ab4c99
0x00ab4c80
0x00ab4c80
0x00ab4c81
0x00ab4c81
0x00ab4c86
0x00ab4cc1
0x00ab4cc2
0x00ab4cc8
0x00ab4ccd
0x00ab4cd0
0x00ab4cd1
0x00ab4cd2
0x00ab4cd9
0x00ab4cdb
0x00ab4cdd
0x00ab4ce2
0x00ab4ce5
0x00ab4cf3
0x00ab4cff
0x00ab4d02
0x00ab4d05
0x00ab4d17
0x00ab4d1c
0x00ab4d1e
0x00ab4d29
0x00ab4d2f
0x00ab4d37
0x00ab4d39
0x00000000
0x00000000
0x00000000
0x00000000
0x00ab4d20
0x00ab4d20
0x00000000
0x00ab4d20
0x00ab4d07
0x00ab4d07
0x00ab4d08
0x00ab4d08
0x00ab4d3b
0x00ab4d3c
0x00ab4d3c
0x00ab4ce7
0x00ab4ced
0x00ab4cf1
0x00ab4d44
0x00ab4d45
0x00ab4d4b
0x00000000
0x00000000
0x00000000
0x00ab4cf1
0x00ab4d52
0x00ab4d52
0x00ab4c60
0x00ab4c66
0x00ab4c6a
0x00ab4cb5
0x00ab4cb6
0x00ab4cc0
0x00000000
0x00000000
0x00000000
0x00ab4c6a

APIs

GetLastError.KERNEL32(?,?,00AB464B,00AC1E70,0000000C,00AB2746), ref: 00AB4C4E
SetLastError.KERNEL32(00000000), ref: 00AB4CB6
SetLastError.KERNEL32(00000000), ref: 00AB4CC2
_abort.LIBCMT ref: 00AB4CC8

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: ErrorLast$_abort
String ID:
API String ID: 88804580-0
Opcode ID: 8ebf3028cbc929c269ea01d3bca9669f9725a04cc34bf9426630a8e165f4b99c
Instruction ID: a35b511e0197969b76eaa4ec13a15188ccab295f408cc735e0ba557627417b90
Opcode Fuzzy Hash: 8ebf3028cbc929c269ea01d3bca9669f9725a04cc34bf9426630a8e165f4b99c
Instruction Fuzzy Hash: 43F0283A1056007ACA12B3756F0AFEB2E6D8FCBF30F224218F915962A3FF25C8034060

Uniqueness

Uniqueness Score: -1.00%

Function 00AB2C96 Relevance: 6.0, APIs: 4, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00AB2C96() {
				void* _t4;
				void* _t8;

				E00AB3315();
				E00AB32A9();
				if(E00AB3009() != 0) {
					_t4 = E00AB2FBB(_t8, __eflags);
					__eflags = _t4;
					if(_t4 != 0) {
						return 1;
					} else {
						E00AB3045();
						goto L1;
					}
				} else {
					L1:
					return 0;
				}
			}

0x00ab2c96
0x00ab2c9b
0x00ab2ca7
0x00ab2cac
0x00ab2cb1
0x00ab2cb3
0x00ab2cbe
0x00ab2cb5
0x00ab2cb5
0x00000000
0x00ab2cb5
0x00ab2ca9
0x00ab2ca9
0x00ab2cab
0x00ab2cab

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00AB2C96
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00AB2C9B
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00AB2CA0

Part of subcall function 00AB3009: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 00AB301A

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00AB2CB5

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: b1b90c0d53e394bb07de617adf9d7015355adfa0c29a78e449e0bafd0537e884
Instruction ID: 8d4277f4a2f4a72fb870928ebd46e8bfab04a62e322e92ff7d39847fe4f90da0
Opcode Fuzzy Hash: b1b90c0d53e394bb07de617adf9d7015355adfa0c29a78e449e0bafd0537e884
Instruction Fuzzy Hash: AAC09226010289A42C603BB22B073FE2B6C0EA37C4B9015C7FD512B02BDD0B070A6333

Uniqueness

Uniqueness Score: -1.00%

Function 00AB5A7A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00AB5A7A(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				signed int _v32;
				signed int _v36;
				signed int _t48;
				int _t51;
				signed int _t54;
				signed int _t55;
				short _t58;
				signed char _t62;
				signed int _t63;
				signed char* _t72;
				signed char* _t73;
				int _t78;
				signed int _t81;
				signed char* _t82;
				short* _t83;
				int _t87;
				signed char _t88;
				signed int _t89;
				signed int _t91;
				signed int _t92;
				int _t94;
				int _t95;
				intOrPtr _t98;
				signed int _t99;

				_t48 =  *0xac3018; // 0x4c695d09
				_v8 = _t48 ^ _t99;
				_t98 = _a8;
				_t78 = E00AB564D(__eflags, _a4);
				if(_t78 != 0) {
					_t94 = 0;
					__eflags = 0;
					_t81 = 0;
					_t51 = 0;
					_v32 = 0;
					while(1) {
						__eflags =  *((intOrPtr*)(_t51 + 0xac3058)) - _t78;
						if( *((intOrPtr*)(_t51 + 0xac3058)) == _t78) {
							break;
						}
						_t81 = _t81 + 1;
						_t51 = _t51 + 0x30;
						_v32 = _t81;
						__eflags = _t51 - 0xf0;
						if(_t51 < 0xf0) {
							continue;
						} else {
							__eflags = _t78 - 0xfde8;
							if(_t78 == 0xfde8) {
								L23:
							} else {
								__eflags = _t78 - 0xfde9;
								if(_t78 == 0xfde9) {
									goto L23;
								} else {
									_t51 = IsValidCodePage(_t78 & 0x0000ffff);
									__eflags = _t51;
									if(_t51 == 0) {
										goto L23;
									} else {
										_t51 = GetCPInfo(_t78,  &_v28);
										__eflags = _t51;
										if(_t51 == 0) {
											__eflags =  *0xac3d3c - _t94; // 0x0
											if(__eflags == 0) {
												goto L23;
											} else {
												E00AB56C0(_t98);
												goto L37;
											}
										} else {
											E00AB2CE0(_t94, _t98 + 0x18, _t94, 0x101);
											 *(_t98 + 4) = _t78;
											 *(_t98 + 0x21c) = _t94;
											_t78 = 1;
											__eflags = _v28 - 1;
											if(_v28 <= 1) {
												 *(_t98 + 8) = _t94;
											} else {
												__eflags = _v22;
												_t72 =  &_v22;
												if(_v22 != 0) {
													while(1) {
														_t88 = _t72[1];
														__eflags = _t88;
														if(_t88 == 0) {
															goto L16;
														}
														_t91 = _t88 & 0x000000ff;
														_t89 =  *_t72 & 0x000000ff;
														while(1) {
															__eflags = _t89 - _t91;
															if(_t89 > _t91) {
																break;
															}
															 *(_t98 + _t89 + 0x19) =  *(_t98 + _t89 + 0x19) | 0x00000004;
															_t89 = _t89 + 1;
															__eflags = _t89;
														}
														_t72 =  &(_t72[2]);
														__eflags =  *_t72;
														if( *_t72 != 0) {
															continue;
														}
														goto L16;
													}
												}
												L16:
												_t73 = _t98 + 0x1a;
												_t87 = 0xfe;
												do {
													 *_t73 =  *_t73 | 0x00000008;
													_t73 =  &(_t73[1]);
													_t87 = _t87 - 1;
													__eflags = _t87;
												} while (_t87 != 0);
												 *(_t98 + 0x21c) = E00AB560F( *(_t98 + 4));
												 *(_t98 + 8) = _t78;
											}
											_t95 = _t98 + 0xc;
											asm("stosd");
											asm("stosd");
											asm("stosd");
											L36:
											E00AB5725(_t78, _t91, _t95, _t98, _t98);
											L37:
											__eflags = 0;
										}
									}
								}
							}
						}
						goto L39;
					}
					E00AB2CE0(_t94, _t98 + 0x18, _t94, 0x101);
					_t54 = _v32 * 0x30;
					__eflags = _t54;
					_v36 = _t54;
					_t55 = _t54 + 0xac3068;
					_v32 = _t55;
					do {
						__eflags =  *_t55;
						_t82 = _t55;
						if( *_t55 != 0) {
							while(1) {
								_t62 = _t82[1];
								__eflags = _t62;
								if(_t62 == 0) {
									break;
								}
								_t92 =  *_t82 & 0x000000ff;
								_t63 = _t62 & 0x000000ff;
								while(1) {
									__eflags = _t92 - _t63;
									if(_t92 > _t63) {
										break;
									}
									__eflags = _t92 - 0x100;
									if(_t92 < 0x100) {
										_t31 = _t94 + 0xac3050; // 0x8040201
										 *(_t98 + _t92 + 0x19) =  *(_t98 + _t92 + 0x19) |  *_t31;
										_t92 = _t92 + 1;
										__eflags = _t92;
										_t63 = _t82[1] & 0x000000ff;
										continue;
									}
									break;
								}
								_t82 =  &(_t82[2]);
								__eflags =  *_t82;
								if( *_t82 != 0) {
									continue;
								}
								break;
							}
							_t55 = _v32;
						}
						_t94 = _t94 + 1;
						_t55 = _t55 + 8;
						_v32 = _t55;
						__eflags = _t94 - 4;
					} while (_t94 < 4);
					 *(_t98 + 4) = _t78;
					 *(_t98 + 8) = 1;
					 *(_t98 + 0x21c) = E00AB560F(_t78);
					_t83 = _t98 + 0xc;
					_t91 = _v36 + 0xac305c;
					_t95 = 6;
					do {
						_t58 =  *_t91;
						_t91 = _t91 + 2;
						 *_t83 = _t58;
						_t83 = _t83 + 2;
						_t95 = _t95 - 1;
						__eflags = _t95;
					} while (_t95 != 0);
					goto L36;
				} else {
					E00AB56C0(_t98);
				}
				L39:
				return E00AB29BB(_v8 ^ _t99);
			}

0x00ab5a82
0x00ab5a89
0x00ab5a91
0x00ab5a99
0x00ab5a9e
0x00ab5aaf
0x00ab5aaf
0x00ab5ab1
0x00ab5ab3
0x00ab5ab5
0x00ab5ab8
0x00ab5ab8
0x00ab5abe
0x00000000
0x00000000
0x00ab5ac4
0x00ab5ac5
0x00ab5ac8
0x00ab5acb
0x00ab5ad0
0x00000000
0x00ab5ad2
0x00ab5ad2
0x00ab5ad8
0x00ab5ba6
0x00ab5ade
0x00ab5ade
0x00ab5ae4
0x00000000
0x00ab5aea
0x00ab5aee
0x00ab5af4
0x00ab5af6
0x00000000
0x00ab5afc
0x00ab5b01
0x00ab5b07
0x00ab5b09
0x00ab5b93
0x00ab5b99
0x00000000
0x00ab5b9b
0x00ab5b9c
0x00000000
0x00ab5b9c
0x00ab5b0f
0x00ab5b19
0x00ab5b1e
0x00ab5b26
0x00ab5b2c
0x00ab5b2d
0x00ab5b30
0x00ab5b83
0x00ab5b32
0x00ab5b32
0x00ab5b36
0x00ab5b39
0x00ab5b3b
0x00ab5b3b
0x00ab5b3e
0x00ab5b40
0x00000000
0x00000000
0x00ab5b42
0x00ab5b45
0x00ab5b50
0x00ab5b50
0x00ab5b52
0x00000000
0x00000000
0x00ab5b4a
0x00ab5b4f
0x00ab5b4f
0x00ab5b4f
0x00ab5b54
0x00ab5b57
0x00ab5b5a
0x00000000
0x00000000
0x00000000
0x00ab5b5a
0x00ab5b3b
0x00ab5b5c
0x00ab5b5c
0x00ab5b5f
0x00ab5b64
0x00ab5b64
0x00ab5b67
0x00ab5b68
0x00ab5b68
0x00ab5b68
0x00ab5b78
0x00ab5b7e
0x00ab5b7e
0x00ab5b88
0x00ab5b8b
0x00ab5b8c
0x00ab5b8d
0x00ab5c51
0x00ab5c52
0x00ab5c57
0x00ab5c58
0x00ab5c58
0x00ab5b09
0x00ab5af6
0x00ab5ae4
0x00ab5ad8
0x00000000
0x00ab5c5a
0x00ab5bb8
0x00ab5bc0
0x00ab5bc0
0x00ab5bc4
0x00ab5bc7
0x00ab5bcd
0x00ab5bd0
0x00ab5bd0
0x00ab5bd3
0x00ab5bd5
0x00ab5bd7
0x00ab5bd7
0x00ab5bda
0x00ab5bdc
0x00000000
0x00000000
0x00ab5bde
0x00ab5be1
0x00ab5bfd
0x00ab5bfd
0x00ab5bff
0x00000000
0x00000000
0x00ab5be6
0x00ab5bec
0x00ab5bee
0x00ab5bf4
0x00ab5bf8
0x00ab5bf8
0x00ab5bf9
0x00000000
0x00ab5bf9
0x00000000
0x00ab5bec
0x00ab5c01
0x00ab5c04
0x00ab5c07
0x00000000
0x00000000
0x00000000
0x00ab5c07
0x00ab5c09
0x00ab5c09
0x00ab5c0c
0x00ab5c0d
0x00ab5c10
0x00ab5c13
0x00ab5c13
0x00ab5c19
0x00ab5c1c
0x00ab5c2b
0x00ab5c34
0x00ab5c39
0x00ab5c3f
0x00ab5c40
0x00ab5c40
0x00ab5c43
0x00ab5c46
0x00ab5c49
0x00ab5c4c
0x00ab5c4c
0x00ab5c4c
0x00000000
0x00ab5aa0
0x00ab5aa1
0x00ab5aa7
0x00ab5c5b
0x00ab5c6a

APIs

Part of subcall function 00AB564D: GetOEMCP.KERNEL32(00000000,?,?,00AB58D6,?), ref: 00AB5678

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00AB591B,?,00000000), ref: 00AB5AEE
GetCPInfo.KERNEL32(00000000,00AB591B,?,?,?,00AB591B,?,00000000), ref: 00AB5B01

Strings

]iL, xrefs: 00AB5A82

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: ]iL
API String ID: 546120528-4085116960
Opcode ID: 5830399fa533155fb2a3f6973bcce9061dcf7f8e60001f0dcf9cbda83ae631ef
Instruction ID: 7835ab562b1ea8f809c0e6db0978697d506f7e8e4c8ecdf323a375747eafef03
Opcode Fuzzy Hash: 5830399fa533155fb2a3f6973bcce9061dcf7f8e60001f0dcf9cbda83ae631ef
Instruction Fuzzy Hash: 56513271E00B459EDB259F71C891BFABBFDEF42300F18446ED0868B253E6359942CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AB5725 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00AB5725(void* __ebx, signed int __edx, void* __edi, void* __esi, intOrPtr _a4) {
				signed int _v8;
				char _v264;
				char _v520;
				char _v776;
				char _v1800;
				char _v1814;
				struct _cpinfo _v1820;
				intOrPtr _v1824;
				signed int _v1828;
				signed int _t63;
				void* _t67;
				signed int _t68;
				intOrPtr _t69;
				void* _t72;
				char _t73;
				char _t74;
				signed char _t75;
				signed int _t76;
				signed char _t86;
				char _t87;
				char _t90;
				signed int _t93;
				signed int _t94;
				signed int _t95;
				void* _t96;
				char* _t97;
				intOrPtr _t101;
				signed int _t102;

				_t95 = __edx;
				_t63 =  *0xac3018; // 0x4c695d09
				_v8 = _t63 ^ _t102;
				_t101 = _a4;
				_t4 = _t101 + 4; // 0x5efc4d8b
				if(GetCPInfo( *_t4,  &_v1820) == 0) {
					_t47 = _t101 + 0x119; // 0xab5d70
					_t96 = _t47;
					_t90 = 0;
					_t67 = 0xffffff9f;
					_t68 = _t67 - _t96;
					__eflags = _t68;
					_v1828 = _t68;
					do {
						_t97 = _t96 + _t90;
						_t69 = _t68 + _t97;
						_v1824 = _t69;
						__eflags = _t69 + 0x20 - 0x19;
						if(_t69 + 0x20 > 0x19) {
							__eflags = _v1824 - 0x19;
							if(_v1824 > 0x19) {
								 *_t97 = 0;
							} else {
								_t72 = _t101 + _t90;
								_t57 = _t72 + 0x19;
								 *_t57 =  *(_t72 + 0x19) | 0x00000020;
								__eflags =  *_t57;
								_t59 = _t90 - 0x20; // -32
								_t73 = _t59;
								goto L24;
							}
						} else {
							 *(_t101 + _t90 + 0x19) =  *(_t101 + _t90 + 0x19) | 0x00000010;
							_t54 = _t90 + 0x20; // 0x20
							_t73 = _t54;
							L24:
							 *_t97 = _t73;
						}
						_t68 = _v1828;
						_t61 = _t101 + 0x119; // 0xab5d70
						_t96 = _t61;
						_t90 = _t90 + 1;
						__eflags = _t90 - 0x100;
					} while (_t90 < 0x100);
				} else {
					_t74 = 0;
					do {
						 *((char*)(_t102 + _t74 - 0x104)) = _t74;
						_t74 = _t74 + 1;
					} while (_t74 < 0x100);
					_t75 = _v1814;
					_t93 =  &_v1814;
					_v264 = 0x20;
					while(1) {
						_t108 = _t75;
						if(_t75 == 0) {
							break;
						}
						_t95 =  *(_t93 + 1) & 0x000000ff;
						_t76 = _t75 & 0x000000ff;
						while(1) {
							__eflags = _t76 - _t95;
							if(_t76 > _t95) {
								break;
							}
							__eflags = _t76 - 0x100;
							if(_t76 < 0x100) {
								 *((char*)(_t102 + _t76 - 0x104)) = 0x20;
								_t76 = _t76 + 1;
								__eflags = _t76;
								continue;
							}
							break;
						}
						_t93 = _t93 + 2;
						__eflags = _t93;
						_t75 =  *_t93;
					}
					_t13 = _t101 + 4; // 0x5efc4d8b
					E00AB6E4E(0, _t95, 0x100, _t101, _t108, 0, 1,  &_v264, 0x100,  &_v1800,  *_t13, 0);
					_t16 = _t101 + 4; // 0x5efc4d8b
					_t19 = _t101 + 0x21c; // 0xc8358959
					E00AB8A70(0x100, _t101, _t108, 0,  *_t19, 0x100,  &_v264, 0x100,  &_v520, 0x100,  *_t16, 0);
					_t21 = _t101 + 4; // 0x5efc4d8b
					_t23 = _t101 + 0x21c; // 0xc8358959
					E00AB8A70(0x100, _t101, _t108, 0,  *_t23, 0x200,  &_v264, 0x100,  &_v776, 0x100,  *_t21, 0);
					_t94 = 0;
					do {
						_t86 =  *(_t102 + _t94 * 2 - 0x704) & 0x0000ffff;
						if((_t86 & 0x00000001) == 0) {
							__eflags = _t86 & 0x00000002;
							if((_t86 & 0x00000002) == 0) {
								 *((char*)(_t101 + _t94 + 0x119)) = 0;
							} else {
								_t37 = _t101 + _t94 + 0x19;
								 *_t37 =  *(_t101 + _t94 + 0x19) | 0x00000020;
								__eflags =  *_t37;
								_t87 =  *((intOrPtr*)(_t102 + _t94 - 0x304));
								goto L15;
							}
						} else {
							 *(_t101 + _t94 + 0x19) =  *(_t101 + _t94 + 0x19) | 0x00000010;
							_t87 =  *((intOrPtr*)(_t102 + _t94 - 0x204));
							L15:
							 *((char*)(_t101 + _t94 + 0x119)) = _t87;
						}
						_t94 = _t94 + 1;
					} while (_t94 < 0x100);
				}
				return E00AB29BB(_v8 ^ _t102);
			}

0x00ab5725
0x00ab5730
0x00ab5737
0x00ab573c
0x00ab5747
0x00ab5759
0x00ab5851
0x00ab5851
0x00ab5857
0x00ab5859
0x00ab585a
0x00ab585a
0x00ab585c
0x00ab5862
0x00ab5862
0x00ab5864
0x00ab5866
0x00ab586f
0x00ab5872
0x00ab587e
0x00ab5885
0x00ab5895
0x00ab5887
0x00ab5887
0x00ab588a
0x00ab588a
0x00ab588a
0x00ab588e
0x00ab588e
0x00000000
0x00ab588e
0x00ab5874
0x00ab5874
0x00ab5879
0x00ab5879
0x00ab5891
0x00ab5891
0x00ab5891
0x00ab5897
0x00ab589d
0x00ab589d
0x00ab58a3
0x00ab58a4
0x00ab58a4
0x00ab575f
0x00ab575f
0x00ab5761
0x00ab5761
0x00ab5768
0x00ab5769
0x00ab576d
0x00ab5773
0x00ab5779
0x00ab57a1
0x00ab57a1
0x00ab57a3
0x00000000
0x00000000
0x00ab5782
0x00ab5786
0x00ab5798
0x00ab5798
0x00ab579a
0x00000000
0x00000000
0x00ab578b
0x00ab578d
0x00ab578f
0x00ab5797
0x00ab5797
0x00000000
0x00ab5797
0x00000000
0x00ab578d
0x00ab579c
0x00ab579c
0x00ab579f
0x00ab579f
0x00ab57a6
0x00ab57bb
0x00ab57c1
0x00ab57d5
0x00ab57dc
0x00ab57eb
0x00ab57fd
0x00ab5804
0x00ab580c
0x00ab580e
0x00ab580e
0x00ab5818
0x00ab5828
0x00ab582a
0x00ab5841
0x00ab582c
0x00ab582c
0x00ab582c
0x00ab582c
0x00ab5831
0x00000000
0x00ab5831
0x00ab581a
0x00ab581a
0x00ab581f
0x00ab5838
0x00ab5838
0x00ab5838
0x00ab5848
0x00ab5849
0x00ab584d
0x00ab58b8

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00AB574A

Strings

, xrefs: 00AB578F
]iL, xrefs: 00AB5730

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: Info
String ID: ]iL$
API String ID: 1807457897-2741433938
Opcode ID: 6008e244ac3ab8894b28efba6d9eff838f5d1ef8f25661665fe2ce6324800a45
Instruction ID: db97b2880ecd199d012e5b12de3cd7ae48ac851ab3af6dda2caabd15d31279e0
Opcode Fuzzy Hash: 6008e244ac3ab8894b28efba6d9eff838f5d1ef8f25661665fe2ce6324800a45
Instruction Fuzzy Hash: 7641F9709046989FDF228B75CC84BFABBBDEB45308F1408EDE58A86143D2359A45DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00AB9A22 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81
fileCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00AB9A22(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, signed int _a8, signed short* _a12, intOrPtr _a16) {
				signed int _v8;
				char _v10;
				void _v5128;
				intOrPtr _v5132;
				long _v5136;
				void* _v5140;
				signed int _t29;
				intOrPtr _t35;
				long _t43;
				signed int _t44;
				signed short* _t47;
				void* _t52;
				signed int _t56;
				signed int* _t58;
				long _t60;
				intOrPtr* _t63;
				signed int _t65;

				E00ABC1B0();
				_t29 =  *0xac3018; // 0x4c695d09
				_v8 = _t29 ^ _t65;
				_t49 = _a8;
				_t47 = _a12;
				_t63 = _a4;
				_t52 =  *( *((intOrPtr*)(0xac3f60 + (_a8 >> 6) * 4)) + 0x18 + (_t49 & 0x0000003f) * 0x30);
				_t35 = _a16 + _t47;
				_v5140 = _t52;
				_v5132 = _t35;
				 *_t63 = 0;
				 *((intOrPtr*)(_t63 + 4)) = 0;
				 *((intOrPtr*)(_t63 + 8)) = 0;
				while(_t47 < _t35) {
					_t58 =  &_v5128;
					while(_t47 < _t35) {
						_t44 =  *_t47 & 0x0000ffff;
						_t47 =  &(_t47[1]);
						if(_t44 == 0xa) {
							 *((intOrPtr*)(_t63 + 8)) =  *((intOrPtr*)(_t63 + 8)) + 2;
							_t56 = 0xd;
							 *_t58 = _t56;
							_t58 =  &(_t58[0]);
						}
						 *_t58 = _t44;
						_t58 =  &(_t58[0]);
						_t35 = _v5132;
						if(_t58 <  &_v10) {
							continue;
						}
						break;
					}
					_t60 = _t58 -  &_v5128 & 0xfffffffe;
					if(WriteFile(_t52,  &_v5128, _t60,  &_v5136, 0) == 0) {
						 *_t63 = GetLastError();
					} else {
						_t43 = _v5136;
						 *((intOrPtr*)(_t63 + 4)) =  *((intOrPtr*)(_t63 + 4)) + _t43;
						if(_t43 >= _t60) {
							_t35 = _v5132;
							_t52 = _v5140;
							continue;
						}
					}
					L12:
					return E00AB29BB(_v8 ^ _t65);
				}
				goto L12;
			}

0x00ab9a2c
0x00ab9a31
0x00ab9a38
0x00ab9a3b
0x00ab9a4a
0x00ab9a55
0x00ab9a59
0x00ab9a60
0x00ab9a62
0x00ab9a6a
0x00ab9a70
0x00ab9a72
0x00ab9a75
0x00ab9aef
0x00ab9a7a
0x00ab9a80
0x00ab9a84
0x00ab9a87
0x00ab9a8d
0x00ab9a8f
0x00ab9a95
0x00ab9a96
0x00ab9a99
0x00ab9a99
0x00ab9a9c
0x00ab9aa2
0x00ab9aa7
0x00ab9aad
0x00000000
0x00000000
0x00000000
0x00ab9aad
0x00ab9ac0
0x00ab9ad4
0x00ab9afb
0x00ab9ad6
0x00ab9ad6
0x00ab9adc
0x00ab9ae1
0x00ab9ae3
0x00ab9ae9
0x00000000
0x00ab9ae9
0x00ab9ae1
0x00ab9afd
0x00ab9b0f
0x00ab9b0f
0x00000000

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,00AB9E5F,?,00000000,?,00000000,00000000), ref: 00AB9ACC
GetLastError.KERNEL32(?,00AB9E5F,?,00000000,?,00000000,00000000,?,00000000), ref: 00AB9AF5

Strings

]iL, xrefs: 00AB9A31

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: ]iL
API String ID: 442123175-4085116960
Opcode ID: c2e3571628eb9a93032e64d0c4b7d6b40a1e2f54a29eba5c1faaf350467d06c0
Instruction ID: 88c4f1a824381f83444cb31ecfbb8dafd7a0dbef36c287799d225329e0d964d7
Opcode Fuzzy Hash: c2e3571628eb9a93032e64d0c4b7d6b40a1e2f54a29eba5c1faaf350467d06c0
Instruction Fuzzy Hash: 06318771A00215DBCB24CF5ACD80ADAB3F9FF48350F2085AEE50AD7251E730AD82CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00AB9943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77
fileCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00AB9943(void* __ebx, void* __edi, void* __esi, signed int* _a4, signed int _a8, intOrPtr* _a12, intOrPtr _a16) {
				signed int _v8;
				char _v9;
				void _v5128;
				intOrPtr _v5132;
				long _v5136;
				void* _v5140;
				signed int _t31;
				intOrPtr _t37;
				long _t45;
				char _t46;
				intOrPtr* _t49;
				void* _t54;
				char* _t58;
				long _t59;
				signed int* _t62;
				signed int _t64;

				E00ABC1B0();
				_t31 =  *0xac3018; // 0x4c695d09
				_v8 = _t31 ^ _t64;
				_t51 = _a8;
				_t49 = _a12;
				_t62 = _a4;
				_t54 =  *( *((intOrPtr*)(0xac3f60 + (_a8 >> 6) * 4)) + 0x18 + (_t51 & 0x0000003f) * 0x30);
				 *_t62 =  *_t62 & 0x00000000;
				_t37 = _a16 + _t49;
				_t62[1] = _t62[1] & 0x00000000;
				_t62[2] = _t62[2] & 0x00000000;
				_v5140 = _t54;
				_v5132 = _t37;
				while(_t49 < _t37) {
					_t58 =  &_v5128;
					while(_t49 < _t37) {
						_t46 =  *_t49;
						_t49 = _t49 + 1;
						if(_t46 == 0xa) {
							_t62[2] = _t62[2] + 1;
							 *_t58 = 0xd;
							_t58 = _t58 + 1;
						}
						 *_t58 = _t46;
						_t58 = _t58 + 1;
						_t37 = _v5132;
						if(_t58 <  &_v9) {
							continue;
						}
						break;
					}
					_t59 = _t58 -  &_v5128;
					if(WriteFile(_t54,  &_v5128, _t59,  &_v5136, 0) == 0) {
						 *_t62 = GetLastError();
					} else {
						_t45 = _v5136;
						_t62[1] = _t62[1] + _t45;
						if(_t45 >= _t59) {
							_t37 = _v5132;
							_t54 = _v5140;
							continue;
						}
					}
					L12:
					return E00AB29BB(_v8 ^ _t64);
				}
				goto L12;
			}

0x00ab994d
0x00ab9952
0x00ab9959
0x00ab995c
0x00ab996b
0x00ab9976
0x00ab997a
0x00ab9981
0x00ab9984
0x00ab9986
0x00ab998a
0x00ab998e
0x00ab9994
0x00ab9a01
0x00ab999c
0x00ab99a2
0x00ab99a6
0x00ab99a8
0x00ab99ab
0x00ab99ad
0x00ab99b0
0x00ab99b3
0x00ab99b3
0x00ab99b4
0x00ab99b9
0x00ab99bc
0x00ab99c2
0x00000000
0x00000000
0x00000000
0x00ab99c2
0x00ab99ca
0x00ab99e6
0x00ab9a0d
0x00ab99e8
0x00ab99e8
0x00ab99ee
0x00ab99f3
0x00ab99f5
0x00ab99fb
0x00000000
0x00ab99fb
0x00ab99f3
0x00ab9a0f
0x00ab9a21
0x00ab9a21
0x00000000

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,00AB9E7F,?,00000000,?,00000000,00000000), ref: 00AB99DE
GetLastError.KERNEL32(?,00AB9E7F,?,00000000,?,00000000,00000000,?,00000000), ref: 00AB9A07

Strings

]iL, xrefs: 00AB9952

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: ]iL
API String ID: 442123175-4085116960
Opcode ID: 28d8347c2fca788608365d7c8eb0588a85bed847a73390eadd24a731566eab42
Instruction ID: 1e6d7de4bc232ae4b90a0590ce9bfb4fd4dc0096d3a0cf55a6b3f9d2d4f78e6d
Opcode Fuzzy Hash: 28d8347c2fca788608365d7c8eb0588a85bed847a73390eadd24a731566eab42
Instruction Fuzzy Hash: E4219475A002199FCB15CF59DC80BEAB3F9FB48351F1044AEE64AD7252D730AE86CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00AB621C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00AB621C(signed int _a4, CHAR* _a8, intOrPtr* _a12, intOrPtr _a16) {
				struct HINSTANCE__* _t13;
				signed int* _t20;
				signed int _t27;
				signed int _t28;
				signed int _t29;
				signed int _t33;
				intOrPtr* _t34;

				_t20 = 0xac3ed8 + _a4 * 4;
				_t27 =  *0xac3018; // 0x4c695d09
				_t29 = _t28 | 0xffffffff;
				_t33 = _t27 ^  *_t20;
				asm("ror esi, cl");
				if(_t33 == _t29) {
					L14:
					return 0;
				}
				if(_t33 == 0) {
					_t34 = _a12;
					if(_t34 == _a16) {
						L7:
						_t13 = 0;
						L8:
						if(_t13 == 0) {
							L13:
							_push(0x20);
							asm("ror edi, cl");
							 *_t20 = _t29 ^ _t27;
							goto L14;
						}
						_t33 = GetProcAddress(_t13, _a8);
						if(_t33 == 0) {
							_t27 =  *0xac3018; // 0x4c695d09
							goto L13;
						}
						 *_t20 = E00AB3074(_t33);
						goto L2;
					} else {
						goto L4;
					}
					while(1) {
						L4:
						_t13 = E00AB62B8( *_t34);
						if(_t13 != 0) {
							break;
						}
						_t34 = _t34 + 4;
						if(_t34 != _a16) {
							continue;
						}
						_t27 =  *0xac3018; // 0x4c695d09
						goto L7;
					}
					_t27 =  *0xac3018; // 0x4c695d09
					goto L8;
				}
				L2:
				return _t33;
			}

0x00ab6227
0x00ab6230
0x00ab6236
0x00ab6240
0x00ab6242
0x00ab6246
0x00ab62b1
0x00000000
0x00ab62b1
0x00ab624a
0x00ab6250
0x00ab6256
0x00ab6272
0x00ab6272
0x00ab6274
0x00ab6276
0x00ab62a1
0x00ab62a3
0x00ab62ab
0x00ab62af
0x00000000
0x00ab62af
0x00ab6282
0x00ab6286
0x00ab629b
0x00000000
0x00ab629b
0x00ab628f
0x00000000
0x00000000
0x00000000
0x00000000
0x00ab6258
0x00ab6258
0x00ab625a
0x00ab6262
0x00000000
0x00000000
0x00ab6264
0x00ab626a
0x00000000
0x00000000
0x00ab626c
0x00000000
0x00ab626c
0x00ab6293
0x00000000
0x00ab6293
0x00ab624c
0x00000000

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00AB627C
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00AB6289

Strings

]iL, xrefs: 00AB6230, 00AB626C, 00AB6293, 00AB629B

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID: ]iL
API String ID: 2279764990-4085116960
Opcode ID: 03e30ba603b1a1f5449c1a468b5313ddfa93089470661de3dcab7d4add67a4da
Instruction ID: 10673eeaf327e87ffa1608a4c54df9824993c6115c582d630a00a9ccc19388cd
Opcode Fuzzy Hash: 03e30ba603b1a1f5449c1a468b5313ddfa93089470661de3dcab7d4add67a4da
Instruction Fuzzy Hash: 0211E937E005259BAF35DFA8DC409EA73ADABC43207164220FD19AB256DA35ED4297D0

Uniqueness

Uniqueness Score: -1.00%

Function 00AB29BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E00AB29BB(void* __ecx, struct _EXCEPTION_POINTERS* _a4) {

				asm("repne jnz 0x5");
				asm("repne ret");
				asm("repne jmp 0x2e");
				SetUnhandledExceptionFilter(0);
				UnhandledExceptionFilter(_a4);
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00ab29c1
0x00ab29c4
0x00ab29c6
0x00ab29d1
0x00ab29da
0x00ab29f3

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00AB29FF
___raise_securityfailure.LIBCMT ref: 00AB2AE6

Strings

]iL, xrefs: 00AB29BB, 00AB2AC7

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: ]iL
API String ID: 3761405300-4085116960
Opcode ID: 8f3def2b4404eaf3c3714ab354f515e0a1c9f81bc51f6293855593f63384f99b
Instruction ID: 24dbc901ebb02f6703e61090915f37b98acaf3323e9628ec008a9a1c68832295
Opcode Fuzzy Hash: 8f3def2b4404eaf3c3714ab354f515e0a1c9f81bc51f6293855593f63384f99b
Instruction Fuzzy Hash: 2621E2FB500201AEDB14DF95F946E947BF8FB08314F12806AF9188B3A1E3B196828B44

Uniqueness

Uniqueness Score: -1.00%

Function 00AB6564 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E00AB6564(void* __ecx, void* __esi, void* __eflags, intOrPtr _a4, int _a8, short* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _t18;
				intOrPtr* _t31;
				signed int _t33;

				_t26 = __ecx;
				_push(__ecx);
				_t18 =  *0xac3018; // 0x4c695d09
				_v8 = _t18 ^ _t33;
				_push(__esi);
				_t31 = E00AB621C(0x16, "LCMapStringEx", 0xabe264, "LCMapStringEx");
				if(_t31 == 0) {
					LCMapStringW(E00AB65EC(_t26, _t31, __eflags, _a4, 0), _a8, _a12, _a16, _a20, _a24);
				} else {
					 *0xabd1b8(_a4, _a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
					 *_t31();
				}
				return E00AB29BB(_v8 ^ _t33);
			}

0x00ab6564
0x00ab6569
0x00ab656a
0x00ab6571
0x00ab6574
0x00ab658b
0x00ab6592
0x00ab65d5
0x00ab6594
0x00ab65b1
0x00ab65b7
0x00ab65b7
0x00ab65e9

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,5EFC4D8B,00000100,?,5EFC4D8B,00000000), ref: 00AB65D5

Strings

LCMapStringEx, xrefs: 00AB6575, 00AB657F
]iL, xrefs: 00AB656A

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: String
String ID: ]iL$LCMapStringEx
API String ID: 2568140703-2670345515
Opcode ID: 90296d6683e05fe2b22d7a3bf4785f120887dc6546665973259b54bfd5548b68
Instruction ID: 4d9a67a91ef78993ce33e6555794450622c1efdc2559e458c1b4775eb28124a1
Opcode Fuzzy Hash: 90296d6683e05fe2b22d7a3bf4785f120887dc6546665973259b54bfd5548b68
Instruction Fuzzy Hash: E401E932540109BBCF12AF90DD06DEE7F6AFF08750F054614FE1965162CA768A31EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AB6502 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E00AB6502(void* __ecx, void* __esi, void* __eflags, struct _CRITICAL_SECTION* _a4, long _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _t8;
				intOrPtr* _t20;
				signed int _t22;

				_push(__ecx);
				_t8 =  *0xac3018; // 0x4c695d09
				_v8 = _t8 ^ _t22;
				_t20 = E00AB621C(0x14, "InitializeCriticalSectionEx", 0xabe25c, 0xabe264);
				if(_t20 == 0) {
					InitializeCriticalSectionAndSpinCount(_a4, _a8);
				} else {
					 *0xabd1b8(_a4, _a8, _a12);
					 *_t20();
				}
				return E00AB29BB(_v8 ^ _t22);
			}

0x00ab6507
0x00ab6508
0x00ab650f
0x00ab6529
0x00ab6530
0x00ab654d
0x00ab6532
0x00ab653d
0x00ab6543
0x00ab6543
0x00ab6561

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 00AB654D

Strings

InitializeCriticalSectionEx, xrefs: 00AB651D
]iL, xrefs: 00AB6508

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: ]iL$InitializeCriticalSectionEx
API String ID: 2593887523-1193642208
Opcode ID: 21d5792640d6ec951290b14261fb03e416517f2777addf90fde6514cf6893873
Instruction ID: 06945d7e5217d8f7a373162316a46f24338dfcbee2346023d2a94ecf87d7f668
Opcode Fuzzy Hash: 21d5792640d6ec951290b14261fb03e416517f2777addf90fde6514cf6893873
Instruction Fuzzy Hash: 06F0B435640208BBCF11AF95DD05DEE7F69EF04720F004255FD091A262DA764A21ABD1

Uniqueness

Uniqueness Score: -1.00%

Function 00AB3F2F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E00AB3F2F(void* __ebx, void* __edx, void* __edi, void* __esi, intOrPtr _a4) {
				void* _v0;
				signed int _v8;
				void* __ebp;
				signed int _t8;
				int _t14;
				intOrPtr* _t15;
				intOrPtr _t17;
				intOrPtr _t20;
				void* _t22;
				void* _t23;
				void* _t27;
				intOrPtr* _t30;
				void* _t37;

				_t28 = __edi;
				_t27 = __edx;
				_t21 = __ebx;
				_t8 =  *0xac3018; // 0x4c695d09
				_t22 = 0x20;
				_t23 = _t22 - (_t8 & 0x0000001f);
				asm("ror eax, cl");
				_t37 =  *0xac3cdc - (0 ^  *0xac3018); // 0x4c695d09
				if(_t37 != 0) {
					_push(0xc);
					_push(0xac1e70);
					E00ABBF00(__edi, __esi);
					_t30 =  *((intOrPtr*)(E00AB4C4A(__ebx, _t23, _t27) + 0xc));
					if(_t30 != 0) {
						_v8 = _v8 & 0x00000000;
						 *0xabd1b8();
						 *_t30();
						_v8 = 0xfffffffe;
					}
					_t14 = E00AB4758(_t21, _t27, _t28, _t30);
					asm("int3");
					if(_v8 != 0) {
						_t14 = HeapFree( *0xac4170, 0, _v0);
						if(_t14 == 0) {
							_push(_t30);
							_t15 = E00AB501F();
							_t17 = E00AB4FA6(GetLastError());
							 *_t15 = _t17;
							return _t17;
						}
					}
					return _t14;
				} else {
					_t20 = E00AB3CF6(_a4);
					 *0xac3cdc = _t20;
					return _t20;
				}
			}

0x00ab3f2f
0x00ab3f2f
0x00ab3f2f
0x00ab3f34
0x00ab3f3e
0x00ab3f3f
0x00ab3f43
0x00ab3f4b
0x00ab3f51
0x00ab463a
0x00ab463c
0x00ab4641
0x00ab464b
0x00ab4650
0x00ab4652
0x00ab4658
0x00ab465e
0x00ab4669
0x00ab4669
0x00ab4670
0x00ab4675
0x00ab467f
0x00ab468c
0x00ab4694
0x00ab4696
0x00ab4697
0x00ab46a5
0x00ab46ab
0x00000000
0x00ab46ad
0x00ab4694
0x00ab46af
0x00ab3f57
0x00ab3f5a
0x00ab3f60
0x00ab3f66
0x00ab3f66

APIs

_abort.LIBCMT ref: 00AB4670

Strings

]iL, xrefs: 00AB3F4B, 00AB3F60
]iL, xrefs: 00AB3F34

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: _abort
String ID: ]iL$]iL
API String ID: 1888311480-71639355
Opcode ID: cd6bc306de73f18178fa7cd9fcf2323c0bbd628986b4bcfb978ed77c102902ef
Instruction ID: e8ab7ea2e1f8dc8152d1b00e64c9a15628cbec33ec90cdca8c5faacff2fc9406
Opcode Fuzzy Hash: cd6bc306de73f18178fa7cd9fcf2323c0bbd628986b4bcfb978ed77c102902ef
Instruction Fuzzy Hash: 3FF0B433614204ABDF14FFB8ED15A9D37A5A705B20F12C115F5049F1A3CB308A459A80

Uniqueness

Uniqueness Score: -1.00%

Function 00AB63A7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
memoryCOMMON

Download Yara Rule

C-Code - Quality: 15%

			E00AB63A7(void* __ecx, void* __esi, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				signed int _t4;
				intOrPtr* _t16;
				signed int _t18;

				_push(__ecx);
				_t4 =  *0xac3018; // 0x4c695d09
				_v8 = _t4 ^ _t18;
				_t16 = E00AB621C(3, "FlsAlloc", 0xabe220, 0xabe228);
				if(_t16 == 0) {
					TlsAlloc();
				} else {
					 *0xabd1b8(_a4);
					 *_t16();
				}
				return E00AB29BB(_v8 ^ _t18);
			}

0x00ab63ac
0x00ab63ad
0x00ab63b4
0x00ab63ce
0x00ab63d5
0x00ab63e6
0x00ab63d7
0x00ab63dc
0x00ab63e2
0x00ab63e2
0x00ab63fa

APIs

TlsAlloc.KERNEL32 ref: 00AB63E6

Strings

]iL, xrefs: 00AB63AD
FlsAlloc, xrefs: 00AB63C2

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: Alloc
String ID: ]iL$FlsAlloc
API String ID: 2773662609-387274156
Opcode ID: 831ca6d907d715d1d688f4dcc29f79dbd7fb71765842c8fb5768df0238e23aa7
Instruction ID: c8c7dc84918bf4ebcd23f7788380fecaf951daf54610ea41480708e6435f8f9a
Opcode Fuzzy Hash: 831ca6d907d715d1d688f4dcc29f79dbd7fb71765842c8fb5768df0238e23aa7
Instruction Fuzzy Hash: 8DE02B31B40218B78714EF95ED06EED7BACEB08B20F040665FC0A57393DE769E0296E5

Uniqueness

Uniqueness Score: -1.00%

Function 00AB63FD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32(?), ref: 00AB643C

Strings

FlsFree, xrefs: 00AB6418
]iL, xrefs: 00AB6403

Memory Dump Source

Source File: 00000007.00000002.300579400.0000000000AB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000007.00000002.300572827.0000000000AB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300602504.0000000000ABD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300614103.0000000000AC3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.300620117.0000000000AC5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab0000_ople.jbxd

Similarity

API ID: Free
String ID: ]iL$FlsFree
API String ID: 3978063606-402225999
Opcode ID: 7a2a3aab9062fec5af04eb170229de71dd58d0af73ac5206a2320342d5d5e82e
Instruction ID: fff53efff5b0276efdda518bf8763fe0d9e66ef7edfde1d1ba3ea7003f17d839
Opcode Fuzzy Hash: 7a2a3aab9062fec5af04eb170229de71dd58d0af73ac5206a2320342d5d5e82e
Instruction Fuzzy Hash: 23E0E531B40218BB8A14EB959D06DEEBB6CEB04B10B410659FC0A57293DD325E1296D9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 1428, Parent PID: 1796COMMON

Executed Functions

Function 011ED4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.318290334.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_11ed000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9290293dd2cf6ba8c8f5330a0ff089a7f99f77baff58162fa38ff7670f55bc5e
Instruction ID: e28870d31fe47ceb856f1782e3f31bddf9a0c134124dbef686a825ae840901e0
Opcode Fuzzy Hash: 9290293dd2cf6ba8c8f5330a0ff089a7f99f77baff58162fa38ff7670f55bc5e
Instruction Fuzzy Hash: F421F4B1604640DFDF09CF94E9C8B26BBB1FB88318F24C569E9054A206C336D855CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 011ED49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.318290334.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_11ed000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5150f7a57a8d53df84542f52b091e2a3c21df0421a9b8367837477cfcd62eb91
Instruction ID: 7fc1b24ce9cd0b7409fc7061df4b6115d1f11581a6efbc97cdbe4e0f596496d1
Opcode Fuzzy Hash: 5150f7a57a8d53df84542f52b091e2a3c21df0421a9b8367837477cfcd62eb91
Instruction Fuzzy Hash: E711AF76904680CFDF16CF94D9C4B16BFB1FB84324F24C6A9D9054B256C33AD456CBA2

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 692BB93169319EBA2F556174D781A8636D610A67E6838.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: NanoCore

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

AV Detection

E-Banking Fraud

Data Obfuscation

Stealing of Sensitive Information

Remote Access Functionality

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ople.exe.vbs

C:\Users\user\AppData\Roaming\etwa\ople.exe.exe

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
692BB93169319EBA2F556174D781A8636D610A67E6838.exe

Function 00261000 Relevance: 32.3, APIs: 3, Strings: 15, Instructions: 845
memoryCOMMON

Function 002626FA Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Function 00D01FB5 Relevance: 14.6, APIs: 9, Instructions: 1075
memoryCOMMON

Function 00D046C5 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 212
memoryCOMMON

Function 00D03345 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 00D01985 Relevance: 7.9, APIs: 5, Instructions: 416
processthreadCOMMON

Function 00266A69 Relevance: 3.1, APIs: 2, Instructions: 67
COMMON

Function 0026479B Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Function 00264D99 Relevance: 4.6, APIs: 3, Instructions: 78
COMMONLIBRARYCODE

Function 00263E41 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Function 0026280B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134
COMMON

Function 002651DA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114
COMMON

Function 0026B735 Relevance: 1.8, APIs: 1, Instructions: 269
COMMONLIBRARYCODECrypto

Function 00267394 Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre