Edit tour

Windows Analysis Report
ORDINE.exe

Overview

General Information

Sample Name:	ORDINE.exe
Analysis ID:	679294
MD5:	30e619eed663b6696ba1269dec11e1a9
SHA1:	04ad1454bb163c8e1c5820ba591ae613dd6f6d45
SHA256:	faaddcf1294c8358fc6ccc4c36ecdc9fccd03ac345b3d022db144798d611397d
Tags:	AsyncRATexeRAT
Infos:

Detection

AsyncRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Yara detected AsyncRAT

Antivirus detection for dropped file

Snort IDS alert for network traffic

Injects files into Windows application

Writes to foreign memory regions

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Binary or sample is protected by dotNetProtector

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Yara detected Generic Downloader

Machine Learning detection for dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Potential browser exploit detected (process start blacklist hit)

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

PE file contains strange resources

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

ORDINE.exe (PID: 5760 cmdline: "C:\Users\user\Desktop\ORDINE.exe" MD5: 30E619EED663B6696BA1269DEC11E1A9)

vbc.exe (PID: 1164 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe MD5: B3A917344F5610BEEC562556F11300FA)

cmd.exe (PID: 3472 cmdline: cmd" /c mkdir "C:\Users\user\AppData\Local\Temp\iexplore MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5416 cmdline: "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe'" /f MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 6000 cmdline: schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe'" /f MD5: 15FF7D8324231381BAD48A052F85DF04)

cmd.exe (PID: 5736 cmdline: cmd" /c copy "C:\Users\user\Desktop\ORDINE.exe" "C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

iexplore.exe (PID: 2848 cmdline: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe MD5: 30E619EED663B6696BA1269DEC11E1A9)

vbc.exe (PID: 5660 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe MD5: B3A917344F5610BEEC562556F11300FA)

cmd.exe (PID: 4976 cmdline: cmd" /c mkdir "C:\Users\user\AppData\Local\Temp\iexplore MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 2432 cmdline: "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe'" /f MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5348 cmdline: schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe'" /f MD5: 15FF7D8324231381BAD48A052F85DF04)

cmd.exe (PID: 4448 cmdline: cmd" /c copy "C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe" "C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

BackgroundTransferHost.exe (PID: 2432 cmdline: "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 MD5: 02BA81746B929ECC9DB6665589B68335)

iexplore.exe (PID: 4604 cmdline: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe MD5: 30E619EED663B6696BA1269DEC11E1A9)

cleanup

Malware Configuration

Threatname: AsyncRAT

{"Server": "191.101.130.243", "Ports": "7707", "Version": "0.5.7B", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "F37wL6kU6d1ln0ZzFzD1Z61sP0kXqYbm", "Mutex": "AsyncMutex_6SI8OkPnk", "Certificate": "MIIE8jCCAtqgAwIBAgIQALjgwS++igAkwAOyv5bgMTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjIwODAzMDYwMjIyWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAILRFbpKGfwFx25WYYuVCgXl7TdoxRlXM7zcKGvdFLIDy1Bwzp0Y99L/Yy/oseRDrfihrsyph3Ms454cgfjFob5XtBvoXtPAO32uamRVh+1y+C67eBmRe/MTSmTHmQsttSmFFVBwfl5rSS3q2lhTvhPSyQlNn2Y9TAvIIqrg0gIYOW65cTGikiV1+8P+sOoCH9JWRcNUKSrTDX0O+6ZCTOc3UKBW5oj//FcsGreSZw7E2mMTX5WHJNIB5zXB6cfpPdQBwpvJWnpWfCaMgEuJdRC6EznuC0ZFfxQSSCiH8ZkS+JC/MtA/WGWHggqPo/dywuLNygPleYVxK0tVPSZTFEH7Mpo7Z+TiVL6xno7y3LtuaAUvP+yddJ/rhQOmHbs6Qn9zpV39WXz4K3JBp+OYhHUCWpPfjnE9eR4xLzwK2RfwPGhbboIj7TgAdl3YHa9R+sSM19PXHNQjXRMxoZ32Em8EmdSqzbN0lW+I+7/hc+42J22p+fKOnuC2CiBUBNk5ODph27qZ65UYRywRJIkZnCz6K9VDSeDTmF8BrlxdC89mtidHBe9s+ZmBrK4hsJ7VigYXN1J5s9aiaEmfLIGfG1mzv2f9/9Dly4k0tAx9K0PgZmpHBw6HWFjj/88CKy954G2Lb9KJNRyOLLPNs9e4eh8jWEinryjA+0RG0bxlqfdJAgMBAAGjMjAwMB0GA1UdDgQWBBSTNFdMcn6A/QRYYvQpa7SIp9dQQDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAEhlXRdBaUw7zIzKsy1KHQ5goP0TMTkmw+cP2ufXJGYE1rMRHCz9CTAPCd+OSjjzljF8sVUY403LxZdaAI0wB+6RG/3gLcMhljO83Xegx0uONr50r1VAWYwbQU/qQdzsX2epdgqt3S6d0DFzfXE68V0lXL7Plw/Bc3qlrborgVfSHpdWCTCgcJ4a8YDsA+6wi3uADUlm52ztAveJ9f7IYUk7XzevOKqsqmHt+xmWFqgiw1DWvdAx+qDYfXnko8ypz1OuffTNahU82eUiD96TBJt0Gr+d5tfPLmt1yTYa0XzxWy0r9dvYZWEbV5r03Ce2cw26V3z77OX6ZvckR1/qG0tIL06V8nXhmhV0zGGK1i9by9vivfBFQxD2EcVUyPL4URLpDoCqipskOo4bt2TLqUzssOkH41l8n6yZJl8/xYFyzH/2hfY1VS6NnLd9J2w0+ToHxXlhpwZb58JOVXSavCF6d/767aBg8v+Y+MH17RTjBuB+gk7qoJLKGqyTAhag3GvQ9aMVLBxNT99JBcmyUO/3NMTDt4ckAUpEuImvo1zvPdRZV+VnmQbfTBynoWXfw1cDPc+afE2gS55hMhk/vitY9h4fy/AbcXtwb4+Diok6tOMQ32aHVws9ForCAGEKldMlus0/+WTTpqwwgmO38oegF56GzWA3PpYUedJXTE2g==", "ServerSignature": "LnD03k7cpYYvIPzVlgkFIKRQeIVSCNDslUHUMdlARBBMyw1TZMPHK9AU16GUATrv8GN6kBdJLY0QW7A/k2nEAOJPZxlNYr02XeXsdcOs4sqLfeKPYe2250zmeejLRoK8Ycov9Eks1PKGHs4jCsX/nVTmoUjPMCjEav/y5ZWKHhMYlq0kYRdgpJdRJ1kFNqoq+OhbbizKo/z+3HCVLhI3vtIqg7opzzqCrVELXFDiwRMHKt5QNjXoyKd7jvjcmDIHbNfO05ZTmF8P624rLX1x7/Z4eZEorwOSwHqTbY9t05liSFDY0xzY8Iwjx2ci6+kKP/u3Gu9jqX4lPEulNxweH+pNLpuSzxcKhLr13jkK4Gh/jz3B4L3XB2qOzo8p6Ct/Yos3DaKUHvswTfBRY7yCyHxnvWL8bxgInaQ5nXzhqTz0EcbngcX6tJYI+pRb+db/HJeF2HsiqwFHv+074+iDOan6/yyoyjaQybCmfggxaFtknvnJW8oU+aiBZAsH8ONvOVhG3wKs/fwBrND+5MPyALU61tvQK9/KY1/JC5mTD/wtUiAyXUmp3nfZ+Wc5ZSH+D39TOMVFv0u47JE0gDFoP23TyGvBBGPc2cyH86dCznzrIfqsIxOh6IQ6Fj4u9E7Mf7CHVIBjSGw//UzjI5r9DhyATGXHGkyFoHquvUk+soc=", "BDOS": "false", "Startup_Delay": "3", "Group": "Alibaba"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x102bf2:$x1: AsyncRAT 0x102c30:$x1: AsyncRAT

Memory Dumps

Source	Rule	Description	Author	Strings
00000014.00000002.534970060.0000000008E76000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8243:$x1: AsyncRAT 0x8281:$x1: AsyncRAT
00000026.00000002.692124542.00000000035F2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000026.00000002.692124542.00000000035F2000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa65d:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000006.00000002.681364140.00000000051A3000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x35f93:$x1: AsyncRAT 0x35fd1:$x1: AsyncRAT 0x56ef7:$x1: AsyncRAT 0x56f35:$x1: AsyncRAT
0000000E.00000002.522558294.0000000002AD4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.454482675.0000000002A86000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.454482675.0000000002A86000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x97bd:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000006.00000000.438076644.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000006.00000000.438076644.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x97c1:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000006.00000002.683833759.0000000006BD4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000006.00000002.683833759.0000000006BD4000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x27cd7:$x1: AsyncRAT 0x27d15:$x1: AsyncRAT
00000014.00000002.527812189.00000000069C1000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x14137:$x1: AsyncRAT 0x14175:$x1: AsyncRAT
Process Memory Space: ORDINE.exe PID: 5760	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: ORDINE.exe PID: 5760	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x35ea2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: vbc.exe PID: 1164	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: vbc.exe PID: 1164	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x3d1e3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: vbc.exe PID: 1164	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8207:$x1: AsyncRAT 0x8239:$x1: AsyncRAT 0x37229:$x1: AsyncRAT 0x3725b:$x1: AsyncRAT 0x3728b:$x1: AsyncRAT 0x3d2a9:$s6: VirtualBox 0x3d25c:$s8: Win32_ComputerSystem
Process Memory Space: iexplore.exe PID: 2848	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: iexplore.exe PID: 2848	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa427:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: vbc.exe PID: 5660	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1646:$x1: AsyncRAT 0x1678:$x1: AsyncRAT 0x76a5:$x1: AsyncRAT 0x76d7:$x1: AsyncRAT
Process Memory Space: iexplore.exe PID: 4604	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: iexplore.exe PID: 4604	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x8d18:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.0.vbc.exe.400000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
6.0.vbc.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
6.0.vbc.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99c1:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM

Snort Signatures

ET TROJAN Generic AsyncRAT Style SSL Cert - Source IP: 191.101.130.243 - Destination IP: 192.168.2.5

Timestamp:	191.101.130.243192.168.2.57707497642035595 08/05/22-14:47:38.477674
SID:	2035595
Source Port:	7707
Destination Port:	49764
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Malicious SSL Cert (AsyncRAT Server) - Source IP: 191.101.130.243 - Destination IP: 192.168.2.5

Timestamp:	191.101.130.243192.168.2.57707497642030673 08/05/22-14:47:38.477674
SID:	2030673
Source Port:	7707
Destination Port:	49764
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ORDINE.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe

Avira: detection malicious, Label: TR/Dropper.Gen

Machine Learning detection for sample

Source: ORDINE.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe

Joe Sandbox ML: detected

Source: 0000000E.00000002.522558294.0000000002AD4000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: AsyncRAT {"Server": "191.101.130.243", "Ports": "7707", "Version": "0.5.7B", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "F37wL6kU6d1ln0ZzFzD1Z61sP0kXqYbm", "Mutex": "AsyncMutex_6SI8OkPnk", "Certificate": "MIIE8jCCAtqgAwIBAgIQALjgwS++igAkwAOyv5bgMTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjIwODAzMDYwMjIyWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAILRFbpKGfwFx25WYYuVCgXl7TdoxRlXM7zcKGvdFLIDy1Bwzp0Y99L/Yy/oseRDrfihrsyph3Ms454cgfjFob5XtBvoXtPAO32uamRVh+1y+C67eBmRe/MTSmTHmQsttSmFFVBwfl5rSS3q2lhTvhPSyQlNn2Y9TAvIIqrg0gIYOW65cTGikiV1+8P+sOoCH9JWRcNUKSrTDX0O+6ZCTOc3UKBW5oj//FcsGreSZw7E2mMTX5WHJNIB5zXB6cfpPdQBwpvJWnpWfCaMgEuJdRC6EznuC0ZFfxQSSCiH8ZkS+JC/MtA/WGWHggqPo/dywuLNygPleYVxK0tVPSZTFEH7Mpo7Z+TiVL6xno7y3LtuaAUvP+yddJ/rhQOmHbs6Qn9zpV39WXz4K3JBp+OYhHUCWpPfjnE9eR4xLzwK2RfwPGhbboIj7TgAdl3YHa9R+sSM19PXHNQjXRMxoZ32Em8EmdSqzbN0lW+I+7/hc+42J22p+fKOnuC2CiBUBNk5ODph27qZ65UYRywRJIkZnCz6K9VDSeDTmF8BrlxdC89mtidHBe9s+ZmBrK4hsJ7VigYXN1J5s9aiaEmfLIGfG1mzv2f9/9Dly4k0tAx9K0PgZmpHBw6HWFjj/88CKy954G2Lb9KJNRyOLLPNs9e4eh8jWEinryjA+0RG0bxlqfdJAgMBAAGjMjAwMB0GA1UdDgQWBBSTNFdMcn6A/QRYYvQpa7SIp9dQQDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAEhlXRdBaUw7zIzKsy1KHQ5goP0TMTkmw+cP2ufXJGYE1rMRHCz9CTAPCd+OSjjzljF8sVUY403LxZdaAI0wB+6RG/3gLcMhljO83Xegx0uONr50r1VAWYwbQU/qQdzsX2epdgqt3S6d0DFzfXE68V0lXL7Plw/Bc3qlrborgVfSHpdWCTCgcJ4a8YDsA+6wi3uADUlm52ztAveJ9f7IYUk7XzevOKqsqmHt+xmWFqgiw1DWvdAx+qDYfXnko8ypz1OuffTNahU82eUiD96TBJt0Gr+d5tfPLmt1yTYa0XzxWy0r9dvYZWEbV5r03Ce2cw26V3z77OX6ZvckR1/qG0tIL06V8nXhmhV0zGGK1i9by9vivfBFQxD2EcVUyPL4URLpDoCqipskOo4bt2TLqUzssOkH41l8n6yZJl8/xYFyzH/2hfY1VS6NnLd9J2w0+ToHxXlhpwZb58JOVXSavCF6d/767aBg8v+Y+MH17RTjBuB+gk7qoJLKGqyTAhag3GvQ9aMVLBxNT99JBcmyUO/3NMTDt4ckAUpEuImvo1zvPdRZV+VnmQbfTBynoWXfw1cDPc+afE2gS55hMhk/vitY9h4fy/AbcXtwb4+Diok6tOMQ32aHVws9ForCAGEKldMlus0/+WTTpqwwgmO38oegF56GzWA3PpYUedJXTE2g==", "ServerSignature": "LnD03k7cpYYvIPzVlgkFIKRQeIVSCNDslUHUMdlARBBMyw1TZMPHK9AU16GUATrv8GN6kBdJLY0QW7A/k2nEAOJPZxlNYr02XeXsdcOs4sqLfeKPYe2250zmeejLRoK8Ycov9Eks1PKGHs4jCsX/nVTmoUjPMCjEav/y5ZWKHhMYlq0kYRdgpJdRJ1kFNqoq+OhbbizKo/z+3HCVLhI3vtIqg7opzzqCrVELXFDiwRMHKt5QNjXoyKd7jvjcmDIHbNfO05ZTmF8P624rLX1x7/Z4eZEorwOSwHqTbY9t05liSFDY0xzY8Iwjx2ci6+kKP/u3Gu9jqX4lPEulNxweH+pNLpuSzxcKhLr13jkK4Gh/jz3B4L3XB2qOzo8p6Ct/Yos3DaKUHvswTfBRY7yCyHxnvWL8bxgInaQ5nXzhqTz0EcbngcX6tJYI+pRb+db/HJeF2HsiqwFHv+074+iDOan6/yyoyjaQybCmfggxaFtknvnJW8oU+aiBZAsH8ONvOVhG3wKs/fwBrND+5MPyALU61tvQK9/KY1/JC5mTD/wtUiAyXUmp3nfZ+Wc5ZSH+D39TOMVFv0u47JE0gDFoP23TyGvBBGPc2cyH86dCznzrIfqsIxOh6IQ6Fj4u9E7Mf7CHVIBjSGw//UzjI5r9DhyATGXHGkyFoHquvUk+soc=", "BDOS": "false", "Startup_Delay": "3", "Group": "Alibaba"}

Source: ORDINE.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ORDINE.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: ORDINE.exe, iexplore.exe.11.dr
Source:	Binary string: YrEscapeAsciiCharBuildNumberGet_ParamNumberRevisionNumbercolumnReaderIFormatProviderMethodBuilderModuleBuilderTypeBuilderInitCustomAttributeBuilderEventBuilderAssemblyBuilderSpecialFolderBufferResourceManagerAppDomainManagerDebuggerdnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandlerSignatureEqualityComparerget_NotAfterSyncTextWriterPositionPointerget_IsPointerBitConverterMemberMDInitializerM_hrGetTokenForFloorSetLastWin32ErrorDynamicILGenerator.ctor.cctordotNetProtectorget_IsConstructorCreateDecryptorIntPtrHasEventPtrAbsDllCharacteristicsSystem.DiagnosticsgsadshdsPreserveParamRidsFieldsGetMethodsAddDateWordsadsdsAesSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesSystem.ResourcesdebugResourcesehgIkSibci.resources_nameHashesGetDirectoriesSet_AllFilesMonthNamesPrimesS_systemTimeZonesGetSortedTypesEmptyTypesNeedFatExceptionClausesAssignAssociatesGetAssociatesMethodAttributesTypeAttributesMethodImplAttributesGetCustomAttributesM_attributesGet_MinutesRfc2898DeriveBytesGetBytesNumberOfRvaAndSizesGet_NumberGroupSizesfhfsBindingFlagsGetMethodImplementationFlagsSetImplementationFlagsjfddggsshgsEncodingsfhddsdshfddfhhsagshsGetModuleSearchPathsModifiersEqualshotHeapStreamsM_iterationsCallingConventionsCompareOptionsPushOptionsCos_writePosCurPoseventDefInfosGetTokenFixupsget_CharsInitMembersGetOptionalCustomModifiersRuntimeHelpersJitHelpersGetParametersget_IsClassAssemblyBuilderAccessSuczdvssedrtrsvfcdsdasdcessSuczdvsdsdvfctesdsdrdsasdcessSuczdvsdsdvfctesdsrdsasdcessGetCurrentProcessVirtualAddressCompressgfssReadNamedArgumentsUriComponentsExists source: ORDINE.exe, iexplore.exe.11.dr

Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2035595 ET TROJAN Generic AsyncRAT Style SSL Cert 191.101.130.243:7707 -> 192.168.2.5:49764
Source: Traffic	Snort IDS: 2030673 ET TROJAN Observed Malicious SSL Cert (AsyncRAT Server) 191.101.130.243:7707 -> 192.168.2.5:49764

Yara detected Generic Downloader

Source: Yara match

File source: 6.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE

Source: Joe Sandbox View

ASN Name: MAJESTIC-HOSTING-01US MAJESTIC-HOSTING-01US

Source: global traffic

TCP traffic: 192.168.2.5:49764 -> 191.101.130.243:7707

Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243
Source: unknown	TCP traffic detected without corresponding DNS query: 191.101.130.243

Source: vbc.exe, 00000006.00000002.681364140.00000000051A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: vbc.exe, 00000006.00000002.681364140.00000000051A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en-
Source: vbc.exe, 00000006.00000002.681364140.00000000051A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: vbc.exe, 00000006.00000002.683833759.0000000006BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 6.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000026.00000002.692124542.00000000035F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.522558294.0000000002AD4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.454482675.0000000002A86000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.438076644.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.683833759.0000000006BD4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ORDINE.exe PID: 5760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 1164, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: iexplore.exe PID: 2848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: iexplore.exe PID: 4604, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 6.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000014.00000002.534970060.0000000008E76000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000026.00000002.692124542.00000000035F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000006.00000002.681364140.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.454482675.0000000002A86000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000006.00000000.438076644.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000006.00000002.683833759.0000000006BD4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000014.00000002.527812189.00000000069C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: ORDINE.exe PID: 5760, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: vbc.exe PID: 1164, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: vbc.exe PID: 1164, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: iexplore.exe PID: 2848, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: vbc.exe PID: 5660, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: iexplore.exe PID: 4604, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen

Source: ORDINE.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: dump.pcap, type: PCAP	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 6.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000014.00000002.534970060.0000000008E76000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000026.00000002.692124542.00000000035F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000006.00000002.681364140.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.454482675.0000000002A86000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000006.00000000.438076644.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000006.00000002.683833759.0000000006BD4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000014.00000002.527812189.00000000069C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: ORDINE.exe PID: 5760, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: vbc.exe PID: 1164, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: vbc.exe PID: 1164, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: iexplore.exe PID: 2848, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: vbc.exe PID: 5660, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: iexplore.exe PID: 4604, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys

Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_00B72CA9	0_2_00B72CA9
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_00B78F50	0_2_00B78F50
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04BC18DB	0_2_04BC18DB
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04BCAEC8	0_2_04BCAEC8
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04BD5720	0_2_04BD5720
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04BD0040	0_2_04BD0040
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04BF5D40	0_2_04BF5D40
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04BF0040	0_2_04BF0040
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04C00007	0_2_04C00007
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04C15CE8	0_2_04C15CE8
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04BF5D31	0_2_04BF5D31
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04BF0006	0_2_04BF0006
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04BD56BE	0_2_04BD56BE
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04BD5710	0_2_04BD5710
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04BD0006	0_2_04BD0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 6_2_05159530	6_2_05159530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 6_2_0515D5E0	6_2_0515D5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 6_2_05154668	6_2_05154668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 6_2_05158C60	6_2_05158C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 6_2_05154661	6_2_05154661
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 6_2_0515F298	6_2_0515F298
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 6_2_05158918	6_2_05158918
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_028C2CA9	14_2_028C2CA9
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_028C8F50	14_2_028C8F50
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_0506188E	14_2_0506188E
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_0506AEC8	14_2_0506AEC8
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_05075720	14_2_05075720
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_05070040	14_2_05070040
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_05095D40	14_2_05095D40
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_05090040	14_2_05090040
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_050A003F	14_2_050A003F
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_05090007	14_2_05090007
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_05095D3F	14_2_05095D3F
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_0507003F	14_2_0507003F
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_050756BE	14_2_050756BE

Source: C:\Users\user\Desktop\ORDINE.exe

Code function: 0_2_00B7F140 CreateProcessAsUserA,

0_2_00B7F140

Source: ORDINE.exe, 00000000.00000002.447997854.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs ORDINE.exe
Source: ORDINE.exe, 00000000.00000002.454482675.0000000002A86000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamechrome_exe< vs ORDINE.exe

Source: ORDINE.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe.11.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: ORDINE.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ORDINE.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ORDINE.exe "C:\Users\user\Desktop\ORDINE.exe"
Source: C:\Users\user\Desktop\ORDINE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Source: C:\Users\user\Desktop\ORDINE.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Local\Temp\iexplore
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ORDINE.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ORDINE.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\Desktop\ORDINE.exe" "C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Local\Temp\iexplore
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe" "C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process created: C:\Windows\System32\BackgroundTransferHost.exe "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe
Source: C:\Users\user\Desktop\ORDINE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Local\Temp\iexplore	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe'" /f	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\Desktop\ORDINE.exe" "C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Local\Temp\iexplore	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe" "C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe'" /f	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\ORDINE.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ORDINE.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\ORDINE.exe

File created: C:\Users\user\AppData\Local\Temp\iexplore

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@30/5@0/1

Source: ORDINE.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\ORDINE.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: ORDINE.exe, ToFileTimeUtc.cs	Base64 encoded string: 'nGkmPzup9QPT/suqCXzXd8p+N6CXtoylwVLH56TLSIhDmKvHzxbCciqmJ2fGkZ36', 'p5KZGN3BLyS03tPbahDvetnv8F426EZU1ptA0iZnCTzXvpEMxKAAu7RSCbYTrJs4', 'kSmkMwMgyTwojGjYVLQ9/m4UNBC2d1oEqLMCx18bqsCbogcZ8S7194vmqs0dbe32', 'nKugDFAAnu4KUw1dLafRGjOfRKT15LRh7pxu6CjDt6zLAN1H5Q6VR9HjUM46/xZm', 'nKzsyl0VNiKFg8zv8vJuX4FsE+zYuTdZQzxZg5stitFoLDpvibLCfmcE8lGnNYDT'
Source: 0.0.ORDINE.exe.960000.0.unpack, ToFileTimeUtc.cs	Base64 encoded string: 'nGkmPzup9QPT/suqCXzXd8p+N6CXtoylwVLH56TLSIhDmKvHzxbCciqmJ2fGkZ36', 'p5KZGN3BLyS03tPbahDvetnv8F426EZU1ptA0iZnCTzXvpEMxKAAu7RSCbYTrJs4', 'kSmkMwMgyTwojGjYVLQ9/m4UNBC2d1oEqLMCx18bqsCbogcZ8S7194vmqs0dbe32', 'nKugDFAAnu4KUw1dLafRGjOfRKT15LRh7pxu6CjDt6zLAN1H5Q6VR9HjUM46/xZm', 'nKzsyl0VNiKFg8zv8vJuX4FsE+zYuTdZQzxZg5stitFoLDpvibLCfmcE8lGnNYDT'
Source: 6.0.vbc.exe.400000.0.unpack, Client/Settings.cs	Base64 encoded string: 'MNO2Tfg03nxzwqpVgSyI/33z2xcuT7PfxueDhgv77bJLJ2QdHhStgX+CYFeiWREdns2MdlCanW0H0InAG4PkbA==', 'ZDC0fJzzQ9plOv1j5GXtPsGJMGPVDbpxPUhIMJKxXIQriOSH+DCPiVhdymVLsCVZAKHKnlz1XlY3lKsLP+ADbA==', 'xc3lrU/reoebtYPa5JoSpcJVnaTRsn/raQHWysdervWVGzzOn2lZLtDi+cBEutmb2Ws7VtDmGO/9TYgrVhEsSA==', 'vwRGgWYaVnV3Tt/zgXDAvdAosQzIU/JMmj41i95SoOcBpF47tiLu73Kdsvw6bWKYkcpCrEJfbfkziWhDZIqQNvf6AyVZtDo7YLMcpOoHzNEToB6hOxhLWdpfbd/iTT2pOl0MOBJJvt8E/2ANPg4FtAi5/UV7+iwCmUWOx2LT/Co0oF7qm3MbMsL5m0TbJyG5nNQNAGVeAZdO/pl98iCat3gg7NV79gHAlFs/oMvm3FHMs0sL+Kp3Hx+FPbqvjBCKCOm01WjWXjh3LGvgrg7AYAk6gCqzGvHIlQKSKDfQWpFwit/CUrnX9rjuBNDK1AX42JpErXNnhehoJiEQLLargunzGPp/ic3rKmh0ytwwkM2e/RsfQ2BBCJfAySs7GgWENsgCZnI4AvYwnrxoIS5c9PieP8z5wa7/hUEgMDzzzCXEUXm6yOwk9CDJUe9OQAMxVoEbCITLLy4WppVC8HkW1AWQCi2og7XGxh4sGdtc/P8FEAmp9KcCprtzdM6+SXsKy64d83/P8bG0Ds6PeDqcyiAcyWbSlqQ+hM/KpkjQ2hP4a8FktGejSHhKw0OuVLRV3aliXcoYUPMeO2GnRJ2qph6uTPzmGPE+xQ5bSwqAd4VVTwLRFSOBXOd8rZryQTIr6Yj71FDULFdepVEuGbjSVRRX7HMi6A6lncoWqkjf9f++7KfRJIeD+/bM8sFcLbdVeOFKwiGqjjjnD4SllkcCnncMfspbpAhp9ilqXwbeBTOuDQVy4p6vQhC6vGJoNpbPHCHGgozqIBVnOwKpFsTVYxWyTLkXGAFo+uBpSCxFqQ3b3SoYJYMuaOJ122Uh+myyNv++JBmcsvw6pq81pbsBqixmRPn7H+iOL1ViMHGMTIJTfw6TFD34s9Rag7qvBMSL/pA8fcxHlbEAXogkAL00+wqbY/a4HA7z42Y1tQUefYKf1QTuAk0bN+qejEhu9UGq/Z73dBDEFHiYIBbAKQk/ruKPV5R3nw7j4qxPlwPGyWqCw0s2CWx/GON98lpqr4wu0yhvZMspAI/WeK1GGTBJX5XfvWJz921CvfzIZZ/0yXafUw5BntVLWIKxhbeLmgDGgVr/yvQfgZ5IFVwl5BEzr8Zra+GcFuvNteMaaV3S3OpqfTc/b8sFL7UpX0qbYXEYHHZ9YRlwZf34CYzOVorAoFpeibHXuitEye2s/HE+x/bP1INgoSJkKkaRqXVZftgldxVNUFqTP5SYlGm1UaJyZc6osW5Di/d9v9U86OEZ4/G2PoAS8s1mH/NKQTnYuV3MRPrpPxTPs13kzAQKpDNTS+AjnmQfg7nVubbQn+RA4XXks+2wc2A+3H0ZhKu6WaXHPRyPGp3Yk3l64V3zHfdMUWHC+8ZUNwWgO59spNV5g6tihtVgDrPM+MaV8QwbugeO5es3O+WY61FpagqypsdF9/b7DBzdEdX6ZPDbqfuifZIWygYKVoHOJLa88Qv/wH54rC+rj2cOTnwdkDZA3NFEvqpIx6bhSuVvX9n1a0Palsx8zET0D4K2jNx7kh5EzDf9LMGVWY+kO9qWzOnKBm3yCSyaJgaMLnSvPwcbaKZf3R6nr9nCJPB+f9+zPJ847tSkl/XXYB9cuJfs0vPgc+VzpVJ4RGdGTdFXkxWizSEpq4PjgltwF8sPr4lAn7k0PLjt44CcgvrUknpMPw5m9+4b3NVjh97I3HC6jTIBFekilXXr9c0WC/s7/3GW2i2ruaTfGNwGYG0bxmjLobsAhgeenxHBsPwqPMFwhTEhUB/wnxlF8KQYWgqpW8ORnyq3e6KZtuIgCt1wkpTA+O2xiMQdfLiOjINoZ1UsSMb6CGWW8S62OxqzSpa0V4Hsxfwrp7eRO1uVrFFswIFsuTo7rm7cpR+RMANzbNtCzKtqJ2/fTXAvsPENwkdXnOckdlISrc6LYz5CyX9gyttHlpxB4OHbyUAvKvBRzfsXLQXhRsEIG9p95cvJEXbp93HacMaXdyUJm1aNDU3oOSlc9XapxGUgNqsiAnBsxLxbp9rBGYeiEawZI8or6t8lNl9P5wKtad4Ewn0mgCDuolsI+PgcmmnsHBgGSoN07GXgEWO343atuKnmDIdUiNJv9VHrlWDuy5WSQ7IwgC+pMK/PJ0SLma8d+Gy+72CIHwNeU+36y0ZOCUZ8u//cNBijQdu2fFViV9WDq5fd4YiLDA/bO18xoLrb5NtVQ9bDdpYuaICA4JsAVC8t/Aa43q3liHbfnwXxd0FVPe6cgfC6ccVnKi8M+FQMKvL6dsqAa2mOmSaWGUECVE/Z5WzElkL12BKZHD7NNp+qyX5GNZsHFBzXhxHArYRNKCYU6mQdj61dx3KrJuZtnME=', 'ydZqq1YhtqKCG4NjjeqNoIlJfBAgSONldmjlGLuftDCs+us7J5cx9NLfk5yat1y72M3NOcIcFW2UCvEwqit5Qg==', 'V0UW6o6hK8fIoHg027mAgerhquyDb27aKYrTh4U1scs72neC5oNo9A0Vxsh2mTUQ80uJJVQTH4ct5F0bGixtqw==', 'mzAEJafT5yxGpL8rfOe4t2Igrf9atyXT3SF3THcuGt9tD2iGhN918ZFQk84V54i6KRC+gF4eH/2gqcRVxt4P1w=='
Source: iexplore.exe.11.dr, ToFileTimeUtc.cs	Base64 encoded string: 'nGkmPzup9QPT/suqCXzXd8p+N6CXtoylwVLH56TLSIhDmKvHzxbCciqmJ2fGkZ36', 'p5KZGN3BLyS03tPbahDvetnv8F426EZU1ptA0iZnCTzXvpEMxKAAu7RSCbYTrJs4', 'kSmkMwMgyTwojGjYVLQ9/m4UNBC2d1oEqLMCx18bqsCbogcZ8S7194vmqs0dbe32', 'nKugDFAAnu4KUw1dLafRGjOfRKT15LRh7pxu6CjDt6zLAN1H5Q6VR9HjUM46/xZm', 'nKzsyl0VNiKFg8zv8vJuX4FsE+zYuTdZQzxZg5stitFoLDpvibLCfmcE8lGnNYDT'

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3408:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5408:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Mutant created: \Sessions\1\BaseNamedObjects\AsyncMutex_6SI8OkPnk
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4512:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5496:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5748:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5400:120:WilError_01

Source: C:\Users\user\Desktop\ORDINE.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: ORDINE.exe

Static file information: File size 3145728 > 1048576

Source: ORDINE.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: ORDINE.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: ORDINE.exe, iexplore.exe.11.dr
Source:	Binary string: YrEscapeAsciiCharBuildNumberGet_ParamNumberRevisionNumbercolumnReaderIFormatProviderMethodBuilderModuleBuilderTypeBuilderInitCustomAttributeBuilderEventBuilderAssemblyBuilderSpecialFolderBufferResourceManagerAppDomainManagerDebuggerdnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandlerSignatureEqualityComparerget_NotAfterSyncTextWriterPositionPointerget_IsPointerBitConverterMemberMDInitializerM_hrGetTokenForFloorSetLastWin32ErrorDynamicILGenerator.ctor.cctordotNetProtectorget_IsConstructorCreateDecryptorIntPtrHasEventPtrAbsDllCharacteristicsSystem.DiagnosticsgsadshdsPreserveParamRidsFieldsGetMethodsAddDateWordsadsdsAesSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesSystem.ResourcesdebugResourcesehgIkSibci.resources_nameHashesGetDirectoriesSet_AllFilesMonthNamesPrimesS_systemTimeZonesGetSortedTypesEmptyTypesNeedFatExceptionClausesAssignAssociatesGetAssociatesMethodAttributesTypeAttributesMethodImplAttributesGetCustomAttributesM_attributesGet_MinutesRfc2898DeriveBytesGetBytesNumberOfRvaAndSizesGet_NumberGroupSizesfhfsBindingFlagsGetMethodImplementationFlagsSetImplementationFlagsjfddggsshgsEncodingsfhddsdshfddfhhsagshsGetModuleSearchPathsModifiersEqualshotHeapStreamsM_iterationsCallingConventionsCompareOptionsPushOptionsCos_writePosCurPoseventDefInfosGetTokenFixupsget_CharsInitMembersGetOptionalCustomModifiersRuntimeHelpersJitHelpersGetParametersget_IsClassAssemblyBuilderAccessSuczdvssedrtrsvfcdsdasdcessSuczdvsdsdvfctesdsdrdsasdcessSuczdvsdsdvfctesdsrdsasdcessGetCurrentProcessVirtualAddressCompressgfssReadNamedArgumentsUriComponentsExists source: ORDINE.exe, iexplore.exe.11.dr

Data Obfuscation

Binary or sample is protected by dotNetProtector

Source: ORDINE.exe, 00000000.00000000.411404596.0000000000962000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: dotNetProtector
Source: ORDINE.exe, 00000000.00000000.411404596.0000000000962000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: YrEscapeAsciiCharBuildNumberGet_ParamNumberRevisionNumbercolumnReaderIFormatProviderMethodBuilderModuleBuilderTypeBuilderInitCustomAttributeBuilderEventBuilderAssemblyBuilderSpecialFolderBufferResourceManagerAppDomainManagerDebuggerdnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandlerSignatureEqualityComparerget_NotAfterSyncTextWriterPositionPointerget_IsPointerBitConverterMemberMDInitializerM_hrGetTokenForFloorSetLastWin32ErrorDynamicILGenerator.ctor.cctordotNetProtectorget_IsConstructorCreateDecryptorIntPtrHasEventPtrAbsDllCharacteristicsSystem.DiagnosticsgsadshdsPreserveParamRidsFieldsGetMethodsAddDateWordsadsdsAesSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesSystem.ResourcesdebugResourcesehgIkSibci.resources_nameHashesGetDirectoriesSet_AllFilesMonthNamesPrimesS_systemTimeZonesGetSortedTypesEmptyTypesNeedFatExceptionClausesAssignAssociatesGetAssociatesMethodAttributesTypeAttributesMethodImplAttributesGetCustomAttributesM_attributesGet_MinutesRfc2898DeriveBytesGetBytesNumberOfRvaAndSizesGet_NumberGroupSizesfhfsBindingFlagsGetMethodImplementationFlagsSetImplementationFlagsjfddggsshgsEncodingsfhddsdshfddfhhsagshsGetModuleSearchPathsModifiersEqualshotHeapStreamsM_iterationsCallingConventionsCompareOptionsPushOptionsCos_writePosCurPoseventDefInfosGetTokenFixupsget_CharsInitMembersGetOptionalCustomModifiersRuntimeHelpersJitHelpersGetParametersget_IsClassAssemblyBuilderAccessSuczdvssedrtrsvfcdsdasdcessSuczdvsdsdvfctesdsdrdsasdcessSuczdvsdsdvfctesdsrdsasdcessGetCurrentProcessVirtualAddressCompressgfssReadNamedArgumentsUriComponentsExists
Source: ORDINE.exe	String found in binary or memory: dotNetProtector
Source: ORDINE.exe	String found in binary or memory: YrEscapeAsciiCharBuildNumberGet_ParamNumberRevisionNumbercolumnReaderIFormatProviderMethodBuilderModuleBuilderTypeBuilderInitCustomAttributeBuilderEventBuilderAssemblyBuilderSpecialFolderBufferResourceManagerAppDomainManagerDebuggerdnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandlerSignatureEqualityComparerget_NotAfterSyncTextWriterPositionPointerget_IsPointerBitConverterMemberMDInitializerM_hrGetTokenForFloorSetLastWin32ErrorDynamicILGenerator.ctor.cctordotNetProtectorget_IsConstructorCreateDecryptorIntPtrHasEventPtrAbsDllCharacteristicsSystem.DiagnosticsgsadshdsPreserveParamRidsFieldsGetMethodsAddDateWordsadsdsAesSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesSystem.ResourcesdebugResourcesehgIkSibci.resources_nameHashesGetDirectoriesSet_AllFilesMonthNamesPrimesS_systemTimeZonesGetSortedTypesEmptyTypesNeedFatExceptionClausesAssignAssociatesGetAssociatesMethodAttributesTypeAttributesMethodImplAttributesGetCustomAttributesM_attributesGet_MinutesRfc2898DeriveBytesGetBytesNumberOfRvaAndSizesGet_NumberGroupSizesfhfsBindingFlagsGetMethodImplementationFlagsSetImplementationFlagsjfddggsshgsEncodingsfhddsdshfddfhhsagshsGetModuleSearchPathsModifiersEqualshotHeapStreamsM_iterationsCallingConventionsCompareOptionsPushOptionsCos_writePosCurPoseventDefInfosGetTokenFixupsget_CharsInitMembersGetOptionalCustomModifiersRuntimeHelpersJitHelpersGetParametersget_IsClassAssemblyBuilderAccessSuczdvssedrtrsvfcdsdasdcessSuczdvsdsdvfctesdsdrdsasdcessSuczdvsdsdvfctesdsrdsasdcessGetCurrentProcessVirtualAddressCompressgfssReadNamedArgumentsUriComponentsExists
Source: iexplore.exe.11.dr	String found in binary or memory: dotNetProtector
Source: iexplore.exe.11.dr	String found in binary or memory: YrEscapeAsciiCharBuildNumberGet_ParamNumberRevisionNumbercolumnReaderIFormatProviderMethodBuilderModuleBuilderTypeBuilderInitCustomAttributeBuilderEventBuilderAssemblyBuilderSpecialFolderBufferResourceManagerAppDomainManagerDebuggerdnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandlerSignatureEqualityComparerget_NotAfterSyncTextWriterPositionPointerget_IsPointerBitConverterMemberMDInitializerM_hrGetTokenForFloorSetLastWin32ErrorDynamicILGenerator.ctor.cctordotNetProtectorget_IsConstructorCreateDecryptorIntPtrHasEventPtrAbsDllCharacteristicsSystem.DiagnosticsgsadshdsPreserveParamRidsFieldsGetMethodsAddDateWordsadsdsAesSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesSystem.ResourcesdebugResourcesehgIkSibci.resources_nameHashesGetDirectoriesSet_AllFilesMonthNamesPrimesS_systemTimeZonesGetSortedTypesEmptyTypesNeedFatExceptionClausesAssignAssociatesGetAssociatesMethodAttributesTypeAttributesMethodImplAttributesGetCustomAttributesM_attributesGet_MinutesRfc2898DeriveBytesGetBytesNumberOfRvaAndSizesGet_NumberGroupSizesfhfsBindingFlagsGetMethodImplementationFlagsSetImplementationFlagsjfddggsshgsEncodingsfhddsdshfddfhhsagshsGetModuleSearchPathsModifiersEqualshotHeapStreamsM_iterationsCallingConventionsCompareOptionsPushOptionsCos_writePosCurPoseventDefInfosGetTokenFixupsget_CharsInitMembersGetOptionalCustomModifiersRuntimeHelpersJitHelpersGetParametersget_IsClassAssemblyBuilderAccessSuczdvssedrtrsvfcdsdasdcessSuczdvsdsdvfctesdsdrdsasdcessSuczdvsdsdvfctesdsrdsasdcessGetCurrentProcessVirtualAddressCompressgfssReadNamedArgumentsUriComponentsExists

.NET source code contains potential unpacker

Source: 6.0.vbc.exe.400000.0.unpack, Client/Handle_Packet/Packet.cs

.Net Code: Invoke System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_00B7E1DD push B15446CAh; retf	0_2_00B7E1E2
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04BC0F24 push ds; iretd	0_2_04BC0F28
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04BC0E8C push edx; ret	0_2_04BC0E8F
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04BC0289 push ebp; iretd	0_2_04BC028C
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04BC02C8 push ss; iretd	0_2_04BC02CB
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04BD4C65 push es; ret	0_2_04BD4C66
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04BF54A1 push edi; retf 0047h	0_2_04BF54A2
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04BF5345 push esi; retf	0_2_04BF5346
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04C053A3 push ebp; ret	0_2_04C053A4
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04C05D13 pushad ; ret	0_2_04C05D25
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04C10EC8 push ss; ret	0_2_04C10ECB
Source: C:\Users\user\Desktop\ORDINE.exe	Code function: 0_2_04C118D9 push cs; iretd	0_2_04C118DF
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_028CE1DD push B15446CAh; retf	14_2_028CE1E2
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_05060E8C push edx; ret	14_2_05060E8F
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_05060289 push ebp; iretd	14_2_0506028C
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_050602C8 push ss; iretd	14_2_050602CB
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_05074C65 push es; ret	14_2_05074C66
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_05095A02 push E803D85Eh; ret	14_2_05095A09
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_05095345 push esi; retf	14_2_05095346
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_050954A1 push edi; retf 0047h	14_2_050954A2
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_050959E3 push E804CF5Eh; retf	14_2_05095A01
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_050A5D13 pushad ; ret	14_2_050A5D25
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_050A53A3 push ebp; ret	14_2_050A53A4
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_050C3194 push esi; iretd	14_2_050C3197
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Code function: 14_2_050C02D8 push es; iretd	14_2_050C02DB

Source: ORDINE.exe	Static PE information: real checksum: 0x7d9b9 should be: 0x308bb9
Source: iexplore.exe.11.dr	Static PE information: real checksum: 0x7d9b9 should be: 0x308bb9

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe

Jump to dropped file

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 6.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000026.00000002.692124542.00000000035F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.522558294.0000000002AD4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.454482675.0000000002A86000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.438076644.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.683833759.0000000006BD4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ORDINE.exe PID: 5760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 1164, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: iexplore.exe PID: 2848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: iexplore.exe PID: 4604, type: MEMORYSTR

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe'" /f

Source: C:\Users\user\Desktop\ORDINE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 6.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000026.00000002.692124542.00000000035F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.522558294.0000000002AD4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.454482675.0000000002A86000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.438076644.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.683833759.0000000006BD4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ORDINE.exe PID: 5760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 1164, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: iexplore.exe PID: 2848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: iexplore.exe PID: 4604, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: ORDINE.exe, 00000000.00000002.454482675.0000000002A86000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000006.00000000.438076644.0000000000402000.00000040.00000400.00020000.00000000.sdmp, iexplore.exe, 0000000E.00000002.522558294.0000000002AD4000.00000004.00000800.00020000.00000000.sdmp, iexplore.exe, 00000026.00000002.692124542.00000000035F2000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\ORDINE.exe TID: 5780	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 4224	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 4224	Thread sleep count: 102 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 5304	Thread sleep count: 9790 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe TID: 5480	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 3928	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\ORDINE.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Window / User API: threadDelayed 9790

Jump to behavior

Source: C:\Users\user\Desktop\ORDINE.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: vbc.exe, 00000006.00000002.681364140.00000000051A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllU
Source: iexplore.exe, 00000026.00000002.692124542.00000000035F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\ORDINE.exe

Code function: 0_2_04C1B854 CheckRemoteDebuggerPresent,

0_2_04C1B854

Source: C:\Users\user\Desktop\ORDINE.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\ORDINE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\ORDINE.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects files into Windows application

Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Injected file: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe was created by C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Injected file: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe was created by C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Injected file: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe was created by C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Injected file: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe was created by C:\Windows\SysWOW64\cmd.exe	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\ORDINE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 40E000	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 410000	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 851008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 340000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 342000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 34E000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 350000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 464008	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\ORDINE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 340000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\ORDINE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Local\Temp\iexplore	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe'" /f	Jump to behavior
Source: C:\Users\user\Desktop\ORDINE.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\Desktop\ORDINE.exe" "C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Local\Temp\iexplore	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe" "C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe'" /f	Jump to behavior

Source: vbc.exe, 00000006.00000002.684777573.0000000006C5B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000006.00000003.457645035.0000000009121000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000006.00000002.684581194.0000000006C31000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\ORDINE.exe	Queries volume information: C:\Users\user\Desktop\ORDINE.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ORDINE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 6.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000026.00000002.692124542.00000000035F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.522558294.0000000002AD4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.454482675.0000000002A86000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.438076644.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.683833759.0000000006BD4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ORDINE.exe PID: 5760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 1164, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: iexplore.exe PID: 2848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: iexplore.exe PID: 4604, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Valid Accounts	1 Windows Management Instrumentation	1 Valid Accounts	1 Valid Accounts	1 Masquerading	OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Scheduled Task/Job	2 Scheduled Task/Job	1 Access Token Manipulation	1 Valid Accounts	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Shared Modules	Logon Script (Windows)	312 Process Injection	1 Access Token Manipulation	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 Exploitation for Client Execution	Logon Script (Mac)	2 Scheduled Task/Job	1 Disable or Modify Tools	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	31 Virtualization/Sandbox Evasion	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	312 Process Injection	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	111 Obfuscated Files or Information	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Software Packing	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ORDINE.exe	100%	Avira	TR/Dropper.Gen
ORDINE.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe	100%	Joe Sandbox ML

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
6.0.vbc.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1202836		Download File
14.0.iexplore.exe.3c0000.0.unpack	100%	Avira	HEUR/AGEN.1230579		Download File

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	vbc.exe, 00000006.00000002.683833759.0000000006BD4000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
191.101.130.243	unknown	Chile		396073	MAJESTIC-HOSTING-01US	true

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	679294
Start date and time: 05/08/202214:46:13	2022-08-05 14:46:13 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	ORDINE.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@30/5@0/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 97% Number of executed functions: 107 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 23.211.6.115
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, licensing.mp.microsoft.com, login.live.com, store-images.s-microsoft.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:47:36	Task Scheduler	Run new task: Nafifas path: "C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe"

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
MAJESTIC-HOSTING-01US	SecuriteInfo.com.W32.AIDetectNet.01.24135.exe	Get hash	malicious	Browse	191.101.130.162
	SOA.exe	Get hash	malicious	Browse	191.101.130.59
	SecuriteInfo.com.W32.AIDetect.malware2.18700.exe	Get hash	malicious	Browse	191.101.130.52
	FbEgLaQAtS.exe	Get hash	malicious	Browse	191.101.130.52
	Delivery report.exe	Get hash	malicious	Browse	191.101.130.52
	Delivery report.exe.exe	Get hash	malicious	Browse	191.101.130.52
	REPORT.EXE	Get hash	malicious	Browse	191.101.130.52
	2.exe	Get hash	malicious	Browse	191.101.130.240
	2020ka2305.doc	Get hash	malicious	Browse	191.101.130.240
	2020ka2305.doc	Get hash	malicious	Browse	191.101.130.240
	3.exe	Get hash	malicious	Browse	191.101.130.240
	Suvhviwivhrjbykcqcwltjbuuplxoiafsc.exe	Get hash	malicious	Browse	104.37.175.247
	percarm7	Get hash	malicious	Browse	191.96.140.169
	SecuriteInfo.com.Scr.MalPbsgen1.26772.exe	Get hash	malicious	Browse	191.101.130.52
	SecuriteInfo.com.Trojan.GenericKD.49030156.343.exe	Get hash	malicious	Browse	191.101.130.52
	QaADfQdjK6.exe	Get hash	malicious	Browse	45.90.222.157
	q4Xn6vuQ0S	Get hash	malicious	Browse	38.68.46.106
	New Order for April.xlsx	Get hash	malicious	Browse	45.90.222.207
	PO90381.exe	Get hash	malicious	Browse	104.37.172.204
	95669046.exe	Get hash	malicious	Browse	191.101.130.122

Process:	C:\Users\user\Desktop\ORDINE.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.340009400190196
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhav:ML9E4Ks2wKDE4KhK3VZ9pKhk
MD5:	CC144808DBAF00E03294347EADC8E779
SHA1:	A3434FC71BA82B7512C813840427C687ADDB5AEA
SHA-256:	3FC7B9771439E777A8F8B8579DD499F3EB90859AD30EFD8A765F341403FC7101
SHA-512:	A4F9EB98200BCAF388F89AABAF7EA57661473687265597B13192C24F06638C6339A3BD581DF4E002F26EE1BA09410F6A2BBDB4DA0CD40B59D63A09BAA1AADD3D
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\iexplore.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.340009400190196
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhav:ML9E4Ks2wKDE4KhK3VZ9pKhk
MD5:	CC144808DBAF00E03294347EADC8E779
SHA1:	A3434FC71BA82B7512C813840427C687ADDB5AEA
SHA-256:	3FC7B9771439E777A8F8B8579DD499F3EB90859AD30EFD8A765F341403FC7101
SHA-512:	A4F9EB98200BCAF388F89AABAF7EA57661473687265597B13192C24F06638C6339A3BD581DF4E002F26EE1BA09410F6A2BBDB4DA0CD40B59D63A09BAA1AADD3D
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.340009400190196
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhav:ML9E4Ks2wKDE4KhK3VZ9pKhk
MD5:	CC144808DBAF00E03294347EADC8E779
SHA1:	A3434FC71BA82B7512C813840427C687ADDB5AEA
SHA-256:	3FC7B9771439E777A8F8B8579DD499F3EB90859AD30EFD8A765F341403FC7101
SHA-512:	A4F9EB98200BCAF388F89AABAF7EA57661473687265597B13192C24F06638C6339A3BD581DF4E002F26EE1BA09410F6A2BBDB4DA0CD40B59D63A09BAA1AADD3D
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3145728
Entropy (8bit):	1.1807463156564255
Encrypted:	false
SSDEEP:	6144:Pnsnxlpl/4MgsaffkOiBxqwuhiowOskDnlat1JLfwyTeiB0PJo3zzn:fs3pZ4MgzffDwsbikcJpnfn
MD5:	30E619EED663B6696BA1269DEC11E1A9
SHA1:	04AD1454BB163C8E1C5820BA591AE613DD6F6D45
SHA-256:	FAADDCF1294C8358FC6CCC4C36ECDC9FCCD03AC345B3D022DB144798D611397D
SHA-512:	2C7FF7B8658137E4C1CE494B2944E41C51BE8C5D163DF07CC3B16736D3ABF591EA530D2B4B5FCA212FC96D72383A4E65BFE42491A938DC12B42E78B764439BB3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... ..b............................~.... ........@.. ....................................@.................................0...K.......r............................................................................ ............... ..H............text........ ...................... ..`.rsrc...r...........................@..@.reloc...............L..............@..B................`.......H...........<.......3....4.............................................Ivan Meedev...(......-.(....&2~.....(......(.......{......{....:~.......(......{......{....:~.......(....6~......(......{......{......{......{......{......{.....~....(.....~S...(......{......{.....~....(......{......{......{.....~8...(......{....6~H.....(....6~I.....(....*..0..?............#E...v.c@#..... S@(o...Y(p...(.........#......t@#......[@(q...Y(p...($........#....

C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe:Zone.Identifier

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	1.1807463156564255
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	ORDINE.exe
File size:	3145728
MD5:	30e619eed663b6696ba1269dec11e1a9
SHA1:	04ad1454bb163c8e1c5820ba591ae613dd6f6d45
SHA256:	faaddcf1294c8358fc6ccc4c36ecdc9fccd03ac345b3d022db144798d611397d
SHA512:	2c7ff7b8658137e4c1ce494b2944e41c51be8c5d163df07cc3b16736d3abf591ea530d2b4b5fca212fc96d72383a4e65bfe42491a938dc12b42e78b764439bb3
SSDEEP:	6144:Pnsnxlpl/4MgsaffkOiBxqwuhiowOskDnlat1JLfwyTeiB0PJo3zzn:fs3pZ4MgzffDwsbikcJpnfn
TLSH:	C3E5DE3C37F13B61EC9DC831468165246BEA0FA7DEA186D1D3EA19C7930D8F52D44A8B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... ..b............................~.... ........@.. ....................................@................................

File Icon


Icon Hash:	74f4d8cccaccdce4

Static PE Info

General

Entrypoint:	0x44a87e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x62ECB720 [Fri Aug 5 06:22:24 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4a830	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4c000	0x2bf72	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x78000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x48884	0x48a00	False	0.42609052280550774	data	5.630156495500773	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4c000	0x2bf72	0x2c000	False	0.217041015625	data	4.522066472641785	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x78000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x4c2c4	0x3b4b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0x4fe10	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0
RT_ICON	0x60638	0x94a8	data
RT_ICON	0x69ae0	0x5488	data
RT_ICON	0x6ef68	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 49407, next used block 4294902528
RT_ICON	0x73190	0x25a8	data
RT_ICON	0x75738	0x10a8	data
RT_ICON	0x767e0	0x988	data
RT_ICON	0x77168	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x775d0	0x84	data
RT_VERSION	0x77654	0x1f8	data	English	United States
RT_MANIFEST	0x7784c	0x726	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
191.101.130.243192.168.2.57707497642035595 08/05/22-14:47:38.477674	TCP	2035595	ET TROJAN Generic AsyncRAT Style SSL Cert	7707	49764	191.101.130.243	192.168.2.5
191.101.130.243192.168.2.57707497642030673 08/05/22-14:47:38.477674	TCP	2030673	ET TROJAN Observed Malicious SSL Cert (AsyncRAT Server)	7707	49764	191.101.130.243	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2022 14:47:38.127145052 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:47:38.269309998 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:47:38.269445896 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:47:38.318298101 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:47:38.477674007 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:47:38.477732897 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:47:38.477982998 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:47:38.487781048 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:47:38.640578032 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:47:38.751085043 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:47:40.419425011 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:47:40.615670919 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:47:40.618067026 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:47:40.809494972 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:47:50.430208921 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:47:50.623672009 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:47:50.623825073 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:47:50.766381025 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:47:50.970876932 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:47:51.112742901 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:47:51.252288103 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:47:51.692173004 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:47:51.884382963 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:47:51.884573936 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:47:52.077028036 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:00.474582911 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:00.666841030 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:00.667256117 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:00.810467958 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:00.956156969 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:01.098112106 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:01.102432966 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:01.294476986 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:01.295002937 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:01.487618923 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:06.666898012 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:06.753413916 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:06.895541906 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:06.956677914 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:10.521596909 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:10.714154959 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:10.714251041 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:10.857007980 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:10.960084915 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:11.105015039 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:11.109167099 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:11.300544977 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:11.300617933 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:11.492717028 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:20.573885918 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:20.766634941 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:20.766736031 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:20.909015894 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:20.957745075 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:21.099809885 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:21.107994080 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:21.299247980 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:21.299333096 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:21.491667986 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:30.627182961 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:30.819617033 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:30.824776888 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:31.017733097 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:31.100992918 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:31.144403934 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:31.286057949 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:31.294070005 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:31.486768007 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:31.489630938 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:31.681834936 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:36.670231104 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:36.858855009 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:36.996824026 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:37.014642954 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:37.014746904 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:40.674314976 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:40.865524054 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:40.865680933 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:41.007802010 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:41.156017065 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:41.297467947 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:41.303443909 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:41.495160103 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:41.495237112 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:41.687614918 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:50.721977949 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:50.913625956 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:50.913796902 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:51.106523037 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:51.119471073 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:51.360080004 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:51.501856089 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:51.512048006 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:51.704071045 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:48:51.705694914 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:48:51.899034023 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:49:00.770054102 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:49:00.962053061 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:49:00.964544058 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:49:01.107496977 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:49:01.157732964 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:49:01.299637079 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:49:01.303498983 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:49:01.496954918 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:49:01.500613928 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:49:01.691972017 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:49:06.675004005 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:49:06.720757008 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:49:06.862704992 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:49:06.908261061 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:49:10.833259106 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:49:11.025088072 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:49:11.025204897 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:49:11.167483091 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:49:11.221127987 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:49:11.362684965 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:49:11.366894007 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:49:11.560379028 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:49:11.560462952 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:49:11.752779007 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:49:20.922787905 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:49:21.115556955 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:49:21.115643978 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:49:21.293649912 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:49:21.487680912 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:49:21.617325068 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:49:21.629530907 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:49:21.629695892 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:49:22.189565897 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:49:22.382327080 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:49:22.382452011 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:49:22.580148935 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:49:30.879983902 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:49:31.072783947 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:49:31.072985888 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:49:31.215612888 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:49:31.394804001 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:49:31.536561966 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:49:31.538902044 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:49:31.731264114 CEST	7707	49764	191.101.130.243	192.168.2.5
Aug 5, 2022 14:49:31.733195066 CEST	49764	7707	192.168.2.5	191.101.130.243
Aug 5, 2022 14:49:31.928631067 CEST	7707	49764	191.101.130.243	192.168.2.5

Target ID:	0
Start time:	14:47:18
Start date:	05/08/2022
Path:	C:\Users\user\Desktop\ORDINE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ORDINE.exe"
Imagebase:	0x960000
File size:	3145728 bytes
MD5 hash:	30E619EED663B6696BA1269DEC11E1A9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.454482675.0000000002A86000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000002.454482675.0000000002A86000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low

Show Windows behavior

Target ID:	6
Start time:	14:47:30
Start date:	05/08/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Imagebase:	0xd90000
File size:	2688096 bytes
MD5 hash:	B3A917344F5610BEEC562556F11300FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000006.00000002.681364140.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000006.00000000.438076644.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000006.00000000.438076644.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000006.00000002.683833759.0000000006BD4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000006.00000002.683833759.0000000006BD4000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	moderate

Show Windows behavior

Target ID:	7
Start time:	14:47:32
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd" /c mkdir "C:\Users\user\AppData\Local\Temp\iexplore
Imagebase:	0x1100000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	8
Start time:	14:47:33
Start date:	05/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	9
Start time:	14:47:33
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe'" /f
Imagebase:	0x1100000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	10
Start time:	14:47:34
Start date:	05/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	11
Start time:	14:47:34
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd" /c copy "C:\Users\user\Desktop\ORDINE.exe" "C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe
Imagebase:	0x1100000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	12
Start time:	14:47:34
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe'" /f
Imagebase:	0x320000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	13
Start time:	14:47:35
Start date:	05/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	14
Start time:	14:47:36
Start date:	05/08/2022
Path:	C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe
Imagebase:	0x3c0000
File size:	3145728 bytes
MD5 hash:	30E619EED663B6696BA1269DEC11E1A9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 0000000E.00000002.522558294.0000000002AD4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Target ID:	20
Start time:	14:48:00
Start date:	05/08/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Imagebase:	0xd90000
File size:	2688096 bytes
MD5 hash:	B3A917344F5610BEEC562556F11300FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000014.00000002.534970060.0000000008E76000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000014.00000002.527812189.00000000069C1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	moderate

Show Windows behavior

Target ID:	21
Start time:	14:48:02
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd" /c mkdir "C:\Users\user\AppData\Local\Temp\iexplore
Imagebase:	0x1100000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	22
Start time:	14:48:03
Start date:	05/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	23
Start time:	14:48:03
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe'" /f
Imagebase:	0x1100000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	24
Start time:	14:48:04
Start date:	05/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	25
Start time:	14:48:04
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd" /c copy "C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe" "C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe
Imagebase:	0x1100000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	26
Start time:	14:48:05
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe'" /f
Imagebase:	0x320000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	27
Start time:	14:48:05
Start date:	05/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	34
Start time:	14:48:34
Start date:	05/08/2022
Path:	C:\Windows\System32\BackgroundTransferHost.exe
Wow64 process (32bit):	false
Commandline:	"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
Imagebase:	0x7ff6e0560000
File size:	36864 bytes
MD5 hash:	02BA81746B929ECC9DB6665589B68335
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	38
Start time:	14:49:01
Start date:	05/08/2022
Path:	C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe
Imagebase:	0x3c0000
File size:	3145728 bytes
MD5 hash:	30E619EED663B6696BA1269DEC11E1A9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000026.00000002.692124542.00000000035F2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000026.00000002.692124542.00000000035F2000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen

Show Windows behavior

Execution Graph

Execution Coverage:	27%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	62.5%
Total number of Nodes:	56
Total number of Limit Nodes:	2

Executed Functions

Function 00B72CA9 Relevance: 10.3, Strings: 4, Instructions: 5275
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

B, xrefs: 00B72E4D
G, xrefs: 00B781E8
hj@, xrefs: 00B72F24
Kmk@, xrefs: 00B72CEB

Memory Dump Source

Source File: 00000000.00000002.447780798.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_ORDINE.jbxd

Similarity

API ID:
String ID: B$G$Kmk@$hj@
API String ID: 0-381675553
Opcode ID: 046e24262b06508755ebbecdf6769af34ae7101f09e1d466d71d9bc19ae8d6b2
Instruction ID: ee28850ab7e8bc9dfef438f82c3adff369a7c8526220aeec87c6de4b42135978
Opcode Fuzzy Hash: 046e24262b06508755ebbecdf6769af34ae7101f09e1d466d71d9bc19ae8d6b2
Instruction Fuzzy Hash: 3FB328709192188FCB55EF29DC8969DBBB1FB49204F0045EAD44CA3B64DF346E89CF1A

Uniqueness

Uniqueness Score: -1.00%

Function 00B78F50 Relevance: 4.5, Instructions: 4541
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.447780798.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50256aed99e1ade7f45252af39da31cdcb99f83b303b83b29da882ab70509fef
Instruction ID: 3de7593e6a5034110b7d3af26a5016aa8d020dfb01e863c9e470cf6831a58375
Opcode Fuzzy Hash: 50256aed99e1ade7f45252af39da31cdcb99f83b303b83b29da882ab70509fef
Instruction Fuzzy Hash: 96A31970A046288FCB59EF28ED85698BBB1FF49205F0049EAD44CA3761DF346E88DF55

Uniqueness

Uniqueness Score: -1.00%

Function 04BD5720 Relevance: 4.4, Instructions: 4432
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.455147888.0000000004BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bd0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 953969c73d597618a87c390a9fcb28881b1990cc918e30ddf7d738189bd4962f
Instruction ID: ef408332533e2e8de30c0d290037d01167b1649e22c8efe0da1c473d1fe8e7bb
Opcode Fuzzy Hash: 953969c73d597618a87c390a9fcb28881b1990cc918e30ddf7d738189bd4962f
Instruction Fuzzy Hash: 0B935D70E056288FCB14EF28DD9569CBBB2FF89205F0049EAD448A3751DB386E98CF55

Uniqueness

Uniqueness Score: -1.00%

Function 04BD0040 Relevance: 4.4, Instructions: 4412
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.455147888.0000000004BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bd0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60f30037d08a6724cc40e481833ccea2fe49b571d8292a1919a5160116a0f093
Instruction ID: 4e5cff95738751e44760e0a67c080523fce465658243ae33fc8ec5aa9685b310
Opcode Fuzzy Hash: 60f30037d08a6724cc40e481833ccea2fe49b571d8292a1919a5160116a0f093
Instruction Fuzzy Hash: 13934D70E056288FCB58EF28E995698BBF2FF49305F0049EAD448A3751DB346E88CF55

Uniqueness

Uniqueness Score: -1.00%

Function 04BF5D40 Relevance: 4.4, Instructions: 4403
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.455232420.0000000004BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bf0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc4b0cf92089fa95db7f983ee5e3567781f80b209c4eef01270bb73998391737
Instruction ID: 88f16e189b14de41d7ea1dde94e3225bd13e3c3bb082aa595df54971eca4e8b6
Opcode Fuzzy Hash: fc4b0cf92089fa95db7f983ee5e3567781f80b209c4eef01270bb73998391737
Instruction Fuzzy Hash: 48935C70E146288FCB19EF29D98569CBBB2FB49305F0089EAD44CA3751DB346E88CF55

Uniqueness

Uniqueness Score: -1.00%

Function 04BCAEC8 Relevance: 4.1, Instructions: 4149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.455059350.0000000004BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bc0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4782974a9e274f1a8a80117317334b7363017b4a255702b678d8e37c51a3869
Instruction ID: 65319029c80d96037bb20c64b2fd8ed787e21480849be61362c1d995c954493f
Opcode Fuzzy Hash: b4782974a9e274f1a8a80117317334b7363017b4a255702b678d8e37c51a3869
Instruction Fuzzy Hash: B8835D70A105188FCB18EF79DD88BAEB7B2FB49205F0044EAD448A3754DB386E49DF59

Uniqueness

Uniqueness Score: -1.00%

Function 04BC18DB Relevance: 3.1, Instructions: 3145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.455059350.0000000004BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bc0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27308b2045242e106966fa134e2c5ae7ab6e33d197f99882e061535eedbca43d
Instruction ID: 26e1d48a02b7ad73ab5742afff4748db811874e1f902a691fc6527dcaccb7f2a
Opcode Fuzzy Hash: 27308b2045242e106966fa134e2c5ae7ab6e33d197f99882e061535eedbca43d
Instruction Fuzzy Hash: A2638370E046288FCB15EF28DD8569DBBB1FF89205F0085EAD488A3751DB386E89CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00B7F140 Relevance: 1.8, APIs: 1, Instructions: 261
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 00B7F3D0

Memory Dump Source

Source File: 00000000.00000002.447780798.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_ORDINE.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: a3e221874310d53380f00afdf7a951db5b40769c17058a7c299defbd2819cd26
Instruction ID: e3d55435d3e197ac445b8d2c48972085164f6b6e67fd7b1ffa168076c0f76ceb
Opcode Fuzzy Hash: a3e221874310d53380f00afdf7a951db5b40769c17058a7c299defbd2819cd26
Instruction Fuzzy Hash: F5A14A71E002199FDB10CF69D9817EEBBF2FF48314F0081A9E819A7291DB749985CF95

Uniqueness

Uniqueness Score: -1.00%

Function 04C00007 Relevance: 1.7, Instructions: 1722COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.455273835.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c00000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e41a12ba6b3299ce64ccebbb8526686a92c453e1bac3edc776d67f3ca2e8a921
Instruction ID: b83b6b42b0e1e2c18d3302caf125b3305184a31c328b00854ab313dcad9ee2b8
Opcode Fuzzy Hash: e41a12ba6b3299ce64ccebbb8526686a92c453e1bac3edc776d67f3ca2e8a921
Instruction Fuzzy Hash: 80F22870D19218CFCB14EF29D889B99B7B1FB49304F0189AAD44CA3B54DB386D89CF59

Uniqueness

Uniqueness Score: -1.00%

Function 04BD5710 Relevance: 1.6, Instructions: 1594COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.455147888.0000000004BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bd0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2376c65884ec811dd91a0299e2df8fe39e7bd8947af3e2690dd1ec25f04bf67
Instruction ID: aadb28c46754f21b47287e6927163136539c4a48068eaf688fbd165162eb8a86
Opcode Fuzzy Hash: c2376c65884ec811dd91a0299e2df8fe39e7bd8947af3e2690dd1ec25f04bf67
Instruction Fuzzy Hash: 17F21870E052288FCB58EF28D99969CBBB2FF49304F0049EAD448A3751DB346E98DF55

Uniqueness

Uniqueness Score: -1.00%

Function 04C1B854 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(00000000,?), ref: 04C1D667

Memory Dump Source

Source File: 00000000.00000002.455321625.0000000004C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c10000_ORDINE.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 4c420ecd44a4cbef377bc3ab44f6c5a0f7d7982f842509391f68566ea318871f
Instruction ID: 6fe2b87ce4a66ec3ed342e2e31fb188a18a1d6b16698333168973f98b26caf18
Opcode Fuzzy Hash: 4c420ecd44a4cbef377bc3ab44f6c5a0f7d7982f842509391f68566ea318871f
Instruction Fuzzy Hash: 24214AB1904219CFCB00CF9AD884BEEFBF4AF49324F15846AE459B7250D778A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04BD0006 Relevance: 1.5, Instructions: 1506COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.455147888.0000000004BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bd0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65e2745f5f6a82a185a6e0bf03f0363aff342fcfc6c56112d3313aa3e88d8407
Instruction ID: 5de5eee4853909d0078dee9228b2714bc9a64ec59546686f2bf8e01dd539e4d0
Opcode Fuzzy Hash: 65e2745f5f6a82a185a6e0bf03f0363aff342fcfc6c56112d3313aa3e88d8407
Instruction Fuzzy Hash: C7E22A70A052288FCB58EF28E99569CBBF1FF49304F1049EAD488A3751DB346E88DF55

Uniqueness

Uniqueness Score: -1.00%

Function 04BD56BE Relevance: 1.5, Instructions: 1502COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.455147888.0000000004BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bd0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e1b711768ff8921ab25750d19854d8320aa6c37d53d1adacf48b422ee955af4
Instruction ID: ea8e8e329bf113b492115097c12bdaee122426dc7b102696c821efdb9e75b05f
Opcode Fuzzy Hash: 5e1b711768ff8921ab25750d19854d8320aa6c37d53d1adacf48b422ee955af4
Instruction Fuzzy Hash: 5DE21870A052288FCB58EF28D99569CBBB2FF49304F0049EAD448A3B51DB346E88DF55

Uniqueness

Uniqueness Score: -1.00%

Function 04BF5D31 Relevance: 1.5, Instructions: 1453COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.455232420.0000000004BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bf0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e27058f4e03c247893266caf83d080703f7ed6155a4d5a635f9a4f8539ef2601
Instruction ID: 055037d08d7b2b248b7c37b07b929f0fc070c8fbcab6627b73b1520cda64180a
Opcode Fuzzy Hash: e27058f4e03c247893266caf83d080703f7ed6155a4d5a635f9a4f8539ef2601
Instruction Fuzzy Hash: 64E22970E142288FCB19EF29D98969CBBB1FB49304F0089EAD44CA3751DB346E89DF55

Uniqueness

Uniqueness Score: -1.00%

Function 025A0393 Relevance: 3.8, Strings: 3, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xql, xrefs: 025A0369
xql, xrefs: 025A03C4
xql, xrefs: 025A03BA

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID: xql$xql$xql
API String ID: 0-1985204717
Opcode ID: 6fd8c5cebdde77f4651e511df9e42e2d402dbb0c1a7c0603e7001da108187979
Instruction ID: 5d35742f1449d2907536465ebb57264c21b0d5dc77da6fc70f53dcba9cda89d4
Opcode Fuzzy Hash: 6fd8c5cebdde77f4651e511df9e42e2d402dbb0c1a7c0603e7001da108187979
Instruction Fuzzy Hash: F6118421A2D3D14FD7274628983236D7F612F93014B1E85E7C084CF6E7D6248C86C3AB

Uniqueness

Uniqueness Score: -1.00%

Function 025A024B Relevance: 2.5, Strings: 2, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xql, xrefs: 025A0272
xql, xrefs: 025A027C

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID: xql$xql
API String ID: 0-2396326202
Opcode ID: 897bdeb358ae8d9b3887262091c5197f51476b7b9f8af7d9587a340e9509ba6e
Instruction ID: e7929c1119c24e48aa0d3bb4817305fd4f3a6f4fb5eccb3d90d45b9264b7db86
Opcode Fuzzy Hash: 897bdeb358ae8d9b3887262091c5197f51476b7b9f8af7d9587a340e9509ba6e
Instruction Fuzzy Hash: D4F0C821B1D3A10FC767026C993623E7FA11E8312031E83E7C481CB6E6DA20CC86C39B

Uniqueness

Uniqueness Score: -1.00%

Function 04C0C100 Relevance: 2.2, Strings: 1, Instructions: 909
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,Hyl, xrefs: 04C0C511

Memory Dump Source

Source File: 00000000.00000002.455273835.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c00000_ORDINE.jbxd

Similarity

API ID:
String ID: ,Hyl
API String ID: 0-265354286
Opcode ID: 3127df096ce88beac04709f546dbaa41bf49eb3c4b61e374176a63bdbb4df435
Instruction ID: e2415d7bd8dd413d2dec4a50c387412b6b03100b600f1c4ff1dbfd736f053a3a
Opcode Fuzzy Hash: 3127df096ce88beac04709f546dbaa41bf49eb3c4b61e374176a63bdbb4df435
Instruction Fuzzy Hash: ED82BD70A10118CFCB58EF69D884B9DB7B2FB49308F0085A9D44DA3764DB34AD8ADF59

Uniqueness

Uniqueness Score: -1.00%

Function 00B7F13E Relevance: 1.8, APIs: 1, Instructions: 262
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 00B7F3D0

Memory Dump Source

Source File: 00000000.00000002.447780798.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_ORDINE.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 913d2f6b2491fbe8d07193e66a1e99c6b21b64fff61890df138086050e2ac933
Instruction ID: 1e220196283e602f1f8ffd348cf8548e6c3669955f4a7b022181b0dc617c8dbb
Opcode Fuzzy Hash: 913d2f6b2491fbe8d07193e66a1e99c6b21b64fff61890df138086050e2ac933
Instruction Fuzzy Hash: F8A13A71E002199FDB10CF69D9817EEBBF2FF48314F0081A9E819A7291DB749985CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00B7F731 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 00B7F7C5

Memory Dump Source

Source File: 00000000.00000002.447780798.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_ORDINE.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 308ace0b369e15be309b6fc58fc490c08e8cede8d325b56e11008bcfe0b8286e
Instruction ID: 471c87911a65e90bb63aec6c307e4ccf835dc9c9113b4a628e31cbb08b225d49
Opcode Fuzzy Hash: 308ace0b369e15be309b6fc58fc490c08e8cede8d325b56e11008bcfe0b8286e
Instruction Fuzzy Hash: 9C2127B59002599FDF14CFA9D884BEEBBF4FB48324F00842AE819A3340D778A945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00B7F738 Relevance: 1.6, APIs: 1, Instructions: 65injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 00B7F7C5

Memory Dump Source

Source File: 00000000.00000002.447780798.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_ORDINE.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 21851c1698cb9f3adfab6a844a7f7aad16500cc9cf7a07860b6219e4f439ea4d
Instruction ID: aea50e09a8b737d1b888aadf6d0d10a8f3092350d5ec9e1570305546b5e9dc1d
Opcode Fuzzy Hash: 21851c1698cb9f3adfab6a844a7f7aad16500cc9cf7a07860b6219e4f439ea4d
Instruction Fuzzy Hash: 0E2125B1900259DFDB10CF9AC884BDEFBF4FB48324F00842AE918A3240D778A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00B7F5C8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00B7F646

Memory Dump Source

Source File: 00000000.00000002.447780798.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_ORDINE.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 67c5d6d4c0fc2986660340a595eddb5efaea2521fe63a28792dd4a48c3fba120
Instruction ID: 27e7ac1544d955b154965a95f47a1adca837602138bf649d8a1f1b4edf7f6323
Opcode Fuzzy Hash: 67c5d6d4c0fc2986660340a595eddb5efaea2521fe63a28792dd4a48c3fba120
Instruction Fuzzy Hash: 97214CB19002499FDB10CFA9C484BEEFBF4FF48324F148029E469A3250C3349945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00B7F508 Relevance: 1.6, APIs: 1, Instructions: 62threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 00B7F587

Memory Dump Source

Source File: 00000000.00000002.447780798.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_ORDINE.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 5c702bb5a3839903c26b3a4a6311b39529fe6345ea17745b7e60d3ed2ef08c08
Instruction ID: 4862f3d1555b2ead62a6568f213462d1995e52f2d49e440d881378ded2f59a7b
Opcode Fuzzy Hash: 5c702bb5a3839903c26b3a4a6311b39529fe6345ea17745b7e60d3ed2ef08c08
Instruction Fuzzy Hash: CF2138B1D0021A8FCB10CF9AC8857EEFBF4FB48724F00816AD429A3240D778A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B7F510 Relevance: 1.6, APIs: 1, Instructions: 58threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 00B7F587

Memory Dump Source

Source File: 00000000.00000002.447780798.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_ORDINE.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 7c3cf0995fc921b53f64378fae4de198d44ad71423e45edf713e4e99216af999
Instruction ID: cc89015f913e0952173a941066a890e419857f176d7be608c291fe112c51ab23
Opcode Fuzzy Hash: 7c3cf0995fc921b53f64378fae4de198d44ad71423e45edf713e4e99216af999
Instruction Fuzzy Hash: 052138B1D0021A9FCB00CF9AC8847EEFBF4FB48724F00812AD418B3240D778A9448FA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B7F688 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00B7F6FB

Memory Dump Source

Source File: 00000000.00000002.447780798.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_ORDINE.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6386cd0d41924130eecf55cf70e2bd8bf18874602837df04f8f23378d3430e5a
Instruction ID: 35954a01fdd601ceae3720c36a8d2ce817912c4d6272bcccec10fa73504eda34
Opcode Fuzzy Hash: 6386cd0d41924130eecf55cf70e2bd8bf18874602837df04f8f23378d3430e5a
Instruction Fuzzy Hash: 41216AB28002898FCB11CFA9C884BDEBFF4EF49324F208459D569A7251C339A845CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B7F5D0 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00B7F646

Memory Dump Source

Source File: 00000000.00000002.447780798.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_ORDINE.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: fc48d1756e13c33147f11acd4181490a98053e6fb4c0c3c16f5c4b184c3ac0d3
Instruction ID: 3f17f2ffd3784c3f8034b28e05f912356dfc788b82c04b41ee503039008a61d7
Opcode Fuzzy Hash: fc48d1756e13c33147f11acd4181490a98053e6fb4c0c3c16f5c4b184c3ac0d3
Instruction Fuzzy Hash: 872117B19002499FCB10CF9AC884BDEFBF4FB48324F10842AE528A3250D378A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04C1B86C Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNELBASE(00000000), ref: 04C1D810

Memory Dump Source

Source File: 00000000.00000002.455321625.0000000004C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c10000_ORDINE.jbxd

Similarity

API ID: DebugOutputString
String ID:
API String ID: 1166629820-0
Opcode ID: 29f23878c5620ffc81e9bfd405df26fc75a43d85f4c3cb99e34b0de061dd31f1
Instruction ID: 40ed1acdfaab38e6a7bb14e3a710e85f4396134d7be5bb2db73be91654b9eb41
Opcode Fuzzy Hash: 29f23878c5620ffc81e9bfd405df26fc75a43d85f4c3cb99e34b0de061dd31f1
Instruction Fuzzy Hash: 991144B1D006599BCB10CF9AD584B9EFBF4FB49324F00812AE819A3240C774A904CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 00B7F690 Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00B7F6FB

Memory Dump Source

Source File: 00000000.00000002.447780798.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_ORDINE.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 38d648af407452f4172755ab4f3f657160c7070af7b5cfad78cfd65f2b9ebbc2
Instruction ID: afdf1cea25e9ec499184aa0db24c732b8e078702daadcde9faf19daf742a6fc3
Opcode Fuzzy Hash: 38d648af407452f4172755ab4f3f657160c7070af7b5cfad78cfd65f2b9ebbc2
Instruction Fuzzy Hash: 6D11F5B59002499FCB10CF9AD888BDFFBF4FB48324F108419E529A7250C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00B7F80E Relevance: 1.5, APIs: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 00B7F86F

Memory Dump Source

Source File: 00000000.00000002.447780798.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_ORDINE.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f7aa42c8a606848cf7561b3d3ee5bdd8dd5f7c317c7465c49b29203de4573d46
Instruction ID: 5c0a111b44d260ff8b394bc48cd4cca42d7f3a277f815d48eddbfedc237f4426
Opcode Fuzzy Hash: f7aa42c8a606848cf7561b3d3ee5bdd8dd5f7c317c7465c49b29203de4573d46
Instruction Fuzzy Hash: A71115B1800249CFDB20CF99D488BEEFBF4EB48324F20855AD469A7240C778A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00B7F810 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 00B7F86F

Memory Dump Source

Source File: 00000000.00000002.447780798.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_ORDINE.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: dc7bc50c47e0d6cdffdc00b342fe8578b530d0d443c4604de8d56ae7813dc2e6
Instruction ID: 357a74ae2b5f727c8400660493a3844bf7c395b5b476adc0718aec873fd38e08
Opcode Fuzzy Hash: dc7bc50c47e0d6cdffdc00b342fe8578b530d0d443c4604de8d56ae7813dc2e6
Instruction Fuzzy Hash: 9E1123B1800249CFCB10CF9AC888BDEFBF4EB48324F10856AD529A7240C774A944CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 025A055F Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

xql, xrefs: 025A0590

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID: xql
API String ID: 0-109062218
Opcode ID: ee5bbd0675c3c8171ed5e3f5b4d3266c01e47469fffe09525ff6452134ed49c7
Instruction ID: 3af678482442b3b0897dfe566b86c2a0e89eef79dad463348b4019b17e6fe5ae
Opcode Fuzzy Hash: ee5bbd0675c3c8171ed5e3f5b4d3266c01e47469fffe09525ff6452134ed49c7
Instruction Fuzzy Hash: 7821A2747083808FCB169B78886566E7FF1BF8A218F5945EAC445CB7A2CA34CC05C792

Uniqueness

Uniqueness Score: -1.00%

Function 025A0F70 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5e67e8d25bba3eb5d7a887babe4dca00533708c1c2cb7743eee1b2dccb43d17
Instruction ID: ca7aa8339ed15aa512abf56c27a190ca9f1c03d7747887bbc014233546a6509d
Opcode Fuzzy Hash: d5e67e8d25bba3eb5d7a887babe4dca00533708c1c2cb7743eee1b2dccb43d17
Instruction Fuzzy Hash: 8D213831708256AFDB208E858D63B6F7B66BF95264F184029FD056B7C0CB31DC11C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 0095D3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.447473035.000000000095D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0095D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_95d000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71297153166f0dbd11edbfdef55dd22ac6ff4b08cbea4fabdc59a0823bc9eb83
Instruction ID: 6a80711fec0c0b2fecc93457b72c7fbb26f994de66159f472ed3afe347f423e3
Opcode Fuzzy Hash: 71297153166f0dbd11edbfdef55dd22ac6ff4b08cbea4fabdc59a0823bc9eb83
Instruction Fuzzy Hash: CA216AB1504200DFDF14DF11C9C0B26BB66FB94325F24C969DD094B296C33AE84ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 025A05A7 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6db182c303ca988a624a0342d2ac5497e2800f8704eb3361c2e9be392d1447e8
Instruction ID: 273904a2be0d306608d02c7c115f341a4e2b22c99046a8f37f4fa7ba7fd66fbe
Opcode Fuzzy Hash: 6db182c303ca988a624a0342d2ac5497e2800f8704eb3361c2e9be392d1447e8
Instruction Fuzzy Hash: E821B870B083944FC712DB78886566E7FF1AF8A214F0505AAD845DB7A2D6349D09C7A3

Uniqueness

Uniqueness Score: -1.00%

Function 025A0F53 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abbf45e99e042158ff9c1078280f2213f27b1453bf8b9159a98cb9b88d5ddcab
Instruction ID: 2cf4d9bc5d310b12a1defd7c6f914b13e4763a47c9100aae61b84c37175fdbe5
Opcode Fuzzy Hash: abbf45e99e042158ff9c1078280f2213f27b1453bf8b9159a98cb9b88d5ddcab
Instruction Fuzzy Hash: 6821D83161C3D59FEF228E444863BAE7F31BF56214F15409AF9446B1D2C7319852C769

Uniqueness

Uniqueness Score: -1.00%

Function 025A05C8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 676b0ae4ef492f6950c237deac3e51d4b75919bae15414c32c6895a2d2739f33
Instruction ID: ccc0549f523c0f425b82f6b0e3f7d72ebaa422e29fc72b5823009d519facc220
Opcode Fuzzy Hash: 676b0ae4ef492f6950c237deac3e51d4b75919bae15414c32c6895a2d2739f33
Instruction Fuzzy Hash: BE11E430B002548FC720DBACC85666EBBE5AF89214F04416AD809DB791CB70EC048792

Uniqueness

Uniqueness Score: -1.00%

Function 0095D3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.447473035.000000000095D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0095D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_95d000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75ad921a90c5a80d0e06afb818f831ed5976852882da7f26f8f1702c903aed74
Instruction ID: 17619b95fd61eb6effe720e42cd7871203172e28084bb7eab3e73dc8a1145212
Opcode Fuzzy Hash: 75ad921a90c5a80d0e06afb818f831ed5976852882da7f26f8f1702c903aed74
Instruction Fuzzy Hash: 9D11A276405280DFDB11CF10D9C4B16BF72FB94325F24C5A9DC080B666C336D85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 025A04CF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d957c97d7acc25b5500d365bab98d33d8940a290bc88b1cdedf3b8a6adab7d06
Instruction ID: fe92edfc2f92e9657421a4c5869ac939ffb172bc32207073c7e5174e60ab4e38
Opcode Fuzzy Hash: d957c97d7acc25b5500d365bab98d33d8940a290bc88b1cdedf3b8a6adab7d06
Instruction Fuzzy Hash: A811496060D3D18FDB278B7408362A97F71BD93118B4E45EBC4C08F1E7D628884ACB1A

Uniqueness

Uniqueness Score: -1.00%

Function 025A0B7B Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62a1c0858dc05e61858ff1a7acc46c6ff802963d12718ac144c608d25504651b
Instruction ID: 84552091ad00e00db08b6c3e61a85349bf55670d98d5f09ec21bfa0b7bc2ddd5
Opcode Fuzzy Hash: 62a1c0858dc05e61858ff1a7acc46c6ff802963d12718ac144c608d25504651b
Instruction Fuzzy Hash: 0301282171E3904FC32656650D6221FBB926F8611870E85AB8848CF292DE20C801C366

Uniqueness

Uniqueness Score: -1.00%

Function 025A00A7 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c464937de540c6c2dfc49217043886415a7880033f172db6fce4abae05c8bc7
Instruction ID: c520eeb3d809dcd1a7773d67ab7d95245e5be7fc0da710e837f5ec367bb1cfa6
Opcode Fuzzy Hash: 1c464937de540c6c2dfc49217043886415a7880033f172db6fce4abae05c8bc7
Instruction Fuzzy Hash: 7001D43160D3805FC7224A188873BAB7F617F82610F2980E7D8808F6E3DA218C02C3A5

Uniqueness

Uniqueness Score: -1.00%

Function 025A00C8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 431e870748953439ea90bf00838dd55cee3c4fddde001ea8071fce5c91017561
Instruction ID: a992f79c5cb11759ee3348ed2c4d6dac4c9b90a0855d6a0c413158991eacb605
Opcode Fuzzy Hash: 431e870748953439ea90bf00838dd55cee3c4fddde001ea8071fce5c91017561
Instruction Fuzzy Hash: 33F0CD31B142009FC324491D8933B3FB696BFD5A20F69802AAA418B794EA71CC0187EA

Uniqueness

Uniqueness Score: -1.00%

Function 025A117D Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2e91a1bf0c74ab2550a76defb5dce15dd99b4a28e4bcb43dbdadd1d54d467fd
Instruction ID: 0e01bc740a4780c3cc5b36dc04247febdf7f27200b4301d8a1e65f88b17ac709
Opcode Fuzzy Hash: b2e91a1bf0c74ab2550a76defb5dce15dd99b4a28e4bcb43dbdadd1d54d467fd
Instruction Fuzzy Hash: EA01D622B0DBE14FC7260368583109C6FA27F9705075EC2EBC489CF656DB248842C356

Uniqueness

Uniqueness Score: -1.00%

Function 025A0CC3 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b09bc8ccafd10341ad16264e7df67bd875e174cca62f0ca4b158683b78b87f3
Instruction ID: 30f81ad6bea9e2ea91b2f5f1a46f3bf6b7de715a4cdd32855c4865c7c8c1a438
Opcode Fuzzy Hash: 0b09bc8ccafd10341ad16264e7df67bd875e174cca62f0ca4b158683b78b87f3
Instruction Fuzzy Hash: 08F0F637A192518FCB264B149435A9ABF71FFD6720319C0EBD444CB562D732D806C715

Uniqueness

Uniqueness Score: -1.00%

Function 025A06D3 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebd84547f420bf770da088a28e5fa90a271e56b80ae5e477837a9dbf28652b7e
Instruction ID: 3b52d96575b237df93d7199b4bf468b7d54f9667cfe13e90683d48f382f07caf
Opcode Fuzzy Hash: ebd84547f420bf770da088a28e5fa90a271e56b80ae5e477837a9dbf28652b7e
Instruction Fuzzy Hash: E0F0902170C2D44FC726572988655567FB69EC712031A80E7C449CF6B3DA65DC06C366

Uniqueness

Uniqueness Score: -1.00%

Function 025A0CE0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06c0a1ec0de8f9954f6abc438117160763d5270bf3925607296d849508ac9505
Instruction ID: b32637bb08aefb75e33c0ca79cea557001532aaa016d98f2ecbe003488a5b51a
Opcode Fuzzy Hash: 06c0a1ec0de8f9954f6abc438117160763d5270bf3925607296d849508ac9505
Instruction Fuzzy Hash: 39F02737B241119B47684A1D853661FBBDAEFD953032DC03AD80A8B750CB73DC01C79A

Uniqueness

Uniqueness Score: -1.00%

Function 025A067F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97ccfe0a18ad4a02d402b934abf1c87a52d2b6a13c21ec0372e51082f16fcae0
Instruction ID: 82e8b6c36f6dfaa6e20cc5575bc46567070d72d5ec73260010f8d2e6b8433f29
Opcode Fuzzy Hash: 97ccfe0a18ad4a02d402b934abf1c87a52d2b6a13c21ec0372e51082f16fcae0
Instruction Fuzzy Hash: 1DF08C20A4E3E14FC702D76848659917FB5AE8712830E40E7D488CB5F3DA688C06C362

Uniqueness

Uniqueness Score: -1.00%

Function 025A07C9 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec81a564ba4b0b4d5fd8d56e2cdf2f07e1128842fb9f09131416c41d8f1e0c2f
Instruction ID: 44119088015885bedf7629d657738f6b2020a0bc840a1c6709cd88a8d9199e11
Opcode Fuzzy Hash: ec81a564ba4b0b4d5fd8d56e2cdf2f07e1128842fb9f09131416c41d8f1e0c2f
Instruction Fuzzy Hash: 01F0922164D3C18FCB034B2488B65A43F716E8712531E40D7D081CF9B3DA2CA846C756

Uniqueness

Uniqueness Score: -1.00%

Function 025A06F0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 747e719ef67c3118a3c296357fd7dec1161b8ee658984a89c67b03e8f6e3eb52
Instruction ID: fbb57b762892408465bc5aec2910ae83b9afebcdbb63044500dca2ffa8720689
Opcode Fuzzy Hash: 747e719ef67c3118a3c296357fd7dec1161b8ee658984a89c67b03e8f6e3eb52
Instruction Fuzzy Hash: B8E0D835B144184B0724852D9536A2FB6DBAFC90313258075D50ECB764DF31DC4187A2

Uniqueness

Uniqueness Score: -1.00%

Function 025A13CD Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d23a53b2bd4eaee02e18c39177dd04373b7d887df1c4c8280728e3020c83e6e
Instruction ID: 9db67d473b2266ee4d897a2d0629f6eb52360908ca958c97e544e82e09e1be32
Opcode Fuzzy Hash: 5d23a53b2bd4eaee02e18c39177dd04373b7d887df1c4c8280728e3020c83e6e
Instruction Fuzzy Hash: 71E0ED2060D7A14FDB1A563848311A9BF727E8314975DC2EBC085CF193D62D8889C717

Uniqueness

Uniqueness Score: -1.00%

Function 025A0517 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 701ff2f1fb7795a188959ca16e505d72a631571baa88a2c61a01a46cc89dfad4
Instruction ID: 398e1293f8ed67e2e38f81f1c1061fb747506a130ac36a2be3cf7a8b836770c8
Opcode Fuzzy Hash: 701ff2f1fb7795a188959ca16e505d72a631571baa88a2c61a01a46cc89dfad4
Instruction Fuzzy Hash: 46F0C22065E7D14FDB1787340C362697F32AA9711875E42DB84D0CF1E3DA29888ACB2B

Uniqueness

Uniqueness Score: -1.00%

Function 025A0A03 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 971673e6b15444852820472d587088fb46547f09d7da4064505d1dcbd1fe71cc
Instruction ID: 1493e52ca76a03d9ef236e11cbd521adad18daf438a795c185b4e87b142bfe15
Opcode Fuzzy Hash: 971673e6b15444852820472d587088fb46547f09d7da4064505d1dcbd1fe71cc
Instruction Fuzzy Hash: DEE0E52571F3814FCB67472419755A93FB2AE8321835D84EBC086CFAA3DA398447E312

Uniqueness

Uniqueness Score: -1.00%

Function 025A10CD Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63eccc9281d100d378920f549e4707d16741e3981776f2f05db28096f9c5cf37
Instruction ID: 6e5e0cefd6df867a48183a755d8d270e3597ca14c058b28275b2d8bb6100012d
Opcode Fuzzy Hash: 63eccc9281d100d378920f549e4707d16741e3981776f2f05db28096f9c5cf37
Instruction Fuzzy Hash: 37E0ED2070E7C14FD7175635083256A7F723E9310575EC1EBC485CBAA3DA298849D357

Uniqueness

Uniqueness Score: -1.00%

Function 025A048B Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccbbf11836b46785cb4ef5d9252a628fc1480a5a17f458565707fe9ec8003a53
Instruction ID: b72d04f1a640b0fa309b5e349fe3b8c691abff030a08383f0e43993f968446b2
Opcode Fuzzy Hash: ccbbf11836b46785cb4ef5d9252a628fc1480a5a17f458565707fe9ec8003a53
Instruction Fuzzy Hash: 42E0122060E7D14FCB17973409352697F717E9311875D46EE84C4CF2D7DA298846C717

Uniqueness

Uniqueness Score: -1.00%

Function 025A092B Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db813db1b7e136bdfe5b4770306e34cdb4aa16723f9007d2c6de247463cfe19
Instruction ID: fb5a024bed4db914e2d598a0506eb7b4c192d60e70a99e0f71036daff449f213
Opcode Fuzzy Hash: 8db813db1b7e136bdfe5b4770306e34cdb4aa16723f9007d2c6de247463cfe19
Instruction Fuzzy Hash: C8E0486698E3C44FCB2347B019B86993F709C2715871E05CFD8C58B8A3D58A884BD722

Uniqueness

Uniqueness Score: -1.00%

Function 025A06A0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73f95752162b86e8450e8b22f7cb9f3d8a76e16ef984d9a7cd8f50c525094183
Instruction ID: b613b996ee63f37b761d4d3ce819ffd09e019c29a0e25ef108d4d261e30a6816
Opcode Fuzzy Hash: 73f95752162b86e8450e8b22f7cb9f3d8a76e16ef984d9a7cd8f50c525094183
Instruction Fuzzy Hash: EEE0C231F105358B4718E64E852265AB79ABFCA13831894B5E80DCB7B2DE30DC008781

Uniqueness

Uniqueness Score: -1.00%

Function 025A02B5 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 439616fb063f39b28f01ef480d62905dea5b8466986a26a5229d0f67f384386f
Instruction ID: 67b725bf8fc925c76f6f0955f40122b2c3fa644af79964c2dd45188186a7ad0a
Opcode Fuzzy Hash: 439616fb063f39b28f01ef480d62905dea5b8466986a26a5229d0f67f384386f
Instruction Fuzzy Hash: EDE08C82A0E3E00FD72353742C380987FB04A57285B4E00EFD4C2CB2A3D4480D8AC363

Uniqueness

Uniqueness Score: -1.00%

Function 025A07E8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f051360fd990055b70f2f7425878fe41591ec56d7ac7b159d75324b79ab693ed
Instruction ID: f13a204769eae17070ce620d3ab579953eca2c96e0514baeffaeafff31eb2a66
Opcode Fuzzy Hash: f051360fd990055b70f2f7425878fe41591ec56d7ac7b159d75324b79ab693ed
Instruction Fuzzy Hash: 43D05E34B1450ACF57548A29C562A2E77A67FC51293184064D0068BB60EF30E840C68A

Uniqueness

Uniqueness Score: -1.00%

Function 025A0950 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.448897771.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25a0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a52f58b12e8763bc5de55ebe42dd3c993b19a80d930e3f6b3880a612370e6f14
Instruction ID: 1a54530c6308f668062832cfd55d5d7da87bf0ae7ccdae996245dc9e53f0fcbd
Opcode Fuzzy Hash: a52f58b12e8763bc5de55ebe42dd3c993b19a80d930e3f6b3880a612370e6f14
Instruction Fuzzy Hash: 5F90223000020C8B820833823808308330CA800000B800000A00C020000E8020000080

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04C15CE8 Relevance: 4.6, Instructions: 4553COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.455321625.0000000004C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c10000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6e42ad5e7b2398f0e3d431751c08db584c1db6fd757a20ef795cf14786c1a5a
Instruction ID: 2390565868f98d18964b459419f450b71527f43fec6dccff0bb9bed043319302
Opcode Fuzzy Hash: f6e42ad5e7b2398f0e3d431751c08db584c1db6fd757a20ef795cf14786c1a5a
Instruction Fuzzy Hash: BCA36374E05628CFCB15EF29D98569DB7B2FB8A305F0085E9D488A3721DB346E88CF45

Uniqueness

Uniqueness Score: -1.00%

Function 04BF0040 Relevance: 4.4, Instructions: 4381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.455232420.0000000004BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bf0000_ORDINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ffa0e3d0f2c0f457dbfa2810888558643546cb041170fb9b828787ee84cdd0
Instruction ID: 411cfda1a476ea32b287620aec0c69a5f2819c01fcd8a437f465ece1c5d169ca
Opcode Fuzzy Hash: 44ffa0e3d0f2c0f457dbfa2810888558643546cb041170fb9b828787ee84cdd0
Instruction Fuzzy Hash: C0935E70E056288FCB29EF29D985A9DBBB1FB44705F0089EAD44CA3711DB346E88CF55

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vbc.exePID: 1164, Parent PID: 5760COMMON

Execution Graph

Execution Coverage:	16.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 0515617C Relevance: 1.6, APIs: 1, Instructions: 92
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 05156252

Memory Dump Source

Source File: 00000006.00000002.680151771.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_vbc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e66b57ad9aab910b2166cdcf176c0456827b3dd1b3b48fb69b16dd15cfdd9f16
Instruction ID: d6e22dfd42e223a8239cadcc03d0434f937c64a57507c5a737c6f308bd6fc9a5
Opcode Fuzzy Hash: e66b57ad9aab910b2166cdcf176c0456827b3dd1b3b48fb69b16dd15cfdd9f16
Instruction Fuzzy Hash: 843157B0D04259CFCF14CF98C88579EBBB1FB48324F548129E825A7340D7B59441CF95

Uniqueness

Uniqueness Score: -1.00%

Function 05153614 Relevance: 1.6, APIs: 1, Instructions: 89
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 05156252

Memory Dump Source

Source File: 00000006.00000002.680151771.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_vbc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1a8b67bd3b05be6ac7d01533253238d67d8cd442f29a3f37da1b3f2108dc0c31
Instruction ID: 7e519e45a4ce7fa780cb96d406eeb07173bbd5c434a978852f067e803694059a
Opcode Fuzzy Hash: 1a8b67bd3b05be6ac7d01533253238d67d8cd442f29a3f37da1b3f2108dc0c31
Instruction Fuzzy Hash: 6D3145B0D04249DFDF14CFA9C8847AEBBB1BB48324F548529E826A7380D7B99845CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00D4D3B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.679694969.0000000000D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d4d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7aed2b38e4eb87691a5e50304542459aea490d894dd0969790cf2ce61141f3d
Instruction ID: c7c756858c3f8fa26f3e6d46f55a7121fad032f6d846ca748236341bbe751e43
Opcode Fuzzy Hash: d7aed2b38e4eb87691a5e50304542459aea490d894dd0969790cf2ce61141f3d
Instruction Fuzzy Hash: 6D2167B2604240DFDF01CF10C8C4F26BB62FB88324F28C569E9094B246C336E846CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00D4D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.679694969.0000000000D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d4d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3dd86551a4608f4c7aacce1c049637d15f3d559af6e7b7312d84a969f1dc449
Instruction ID: f609d85ff3ed1f1a8a002743b8ac3581cdd63533e4539673ee50cf40a18e7557
Opcode Fuzzy Hash: b3dd86551a4608f4c7aacce1c049637d15f3d559af6e7b7312d84a969f1dc449
Instruction Fuzzy Hash: 132137B1504240DFDF05DF14D9C4B27BFA6FB98328F288569E9094B246C736D845CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00D4D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.679694969.0000000000D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d4d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75ad921a90c5a80d0e06afb818f831ed5976852882da7f26f8f1702c903aed74
Instruction ID: b55c445e096e020eeb42c5351b4cef8160e0a01bc66376208f3c4a40a8319048
Opcode Fuzzy Hash: 75ad921a90c5a80d0e06afb818f831ed5976852882da7f26f8f1702c903aed74
Instruction Fuzzy Hash: 3B11B176804280CFDF12CF14D9C4B16BF72FB85324F2886A9D8050B616C336D85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00D4D3AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.679694969.0000000000D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d4d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75ad921a90c5a80d0e06afb818f831ed5976852882da7f26f8f1702c903aed74
Instruction ID: a13f895af6c86c6c56def0667db54d2467467493519a41f455f70cd280eb4c4a
Opcode Fuzzy Hash: 75ad921a90c5a80d0e06afb818f831ed5976852882da7f26f8f1702c903aed74
Instruction Fuzzy Hash: 6611B676504280DFDF16CF10D9C4B16BF72FB94324F28C6A9D8494B656C33AE85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: iexplore.exePID: 2848, Parent PID: 1040COMMON

Execution Graph

Execution Coverage:	30.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	45
Total number of Limit Nodes:	2

Executed Functions

Function 05075720 Relevance: 4.4, Instructions: 4432
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.528345455.0000000005070000.00000040.00000800.00020000.00000000.sdmp, Offset: 05070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5070000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc9065daf784cbba02e65ded90096d14ae6affb9130ae0c1005a8d973ba60442
Instruction ID: 6e4f59c369663b7b3382a2a85efc84019b2b64110a76a319c94087b4b07c680f
Opcode Fuzzy Hash: cc9065daf784cbba02e65ded90096d14ae6affb9130ae0c1005a8d973ba60442
Instruction Fuzzy Hash: 8D932C70E041288FCB58EF28D98569DBBB2FF89305F0045EAD448A3751DB386E99CF59

Uniqueness

Uniqueness Score: -1.00%

Function 05070040 Relevance: 4.4, Instructions: 4412
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.528345455.0000000005070000.00000040.00000800.00020000.00000000.sdmp, Offset: 05070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5070000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: decf11e5fd73aa96b9754c109d77f58a55e691fd426f4fe722f20111e218a200
Instruction ID: 196a793f4cd3921a7316c38422c1bdb99006148f20808f51653c1d60c6752bb7
Opcode Fuzzy Hash: decf11e5fd73aa96b9754c109d77f58a55e691fd426f4fe722f20111e218a200
Instruction Fuzzy Hash: 4F930970E042288FCB55EF28E98569CBBB2FF49205F4045EAD448A3751DF386E89CF59

Uniqueness

Uniqueness Score: -1.00%

Function 05095D40 Relevance: 4.4, Instructions: 4403
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.528492296.0000000005090000.00000040.00000800.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5090000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b271e4d1e19aa86f4812ae473ee9e939f6803f3e3f6ca235e7850521e1d3fe
Instruction ID: 89717c1a9ef21e79823510714b07f7ac8413b4c7e20fce8f8483454b07486fcc
Opcode Fuzzy Hash: f3b271e4d1e19aa86f4812ae473ee9e939f6803f3e3f6ca235e7850521e1d3fe
Instruction Fuzzy Hash: 7B936D70E142288FCB15EF28E98669CBBB2FB89311F0085E9D44CA3755DB385E89CF55

Uniqueness

Uniqueness Score: -1.00%

Function 05095D3F Relevance: 1.4, Instructions: 1445COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528492296.0000000005090000.00000040.00000800.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5090000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef21b918565216674ce1ea3cd385a9561d78e9731df5bd3cb709bdc7856aca90
Instruction ID: 97a2c260c4f1102d1d5ec32293ed0fe259bba67ce08a14665e5089b719c623e7
Opcode Fuzzy Hash: ef21b918565216674ce1ea3cd385a9561d78e9731df5bd3cb709bdc7856aca90
Instruction Fuzzy Hash: 58E20970E142288FCB19EF29D98A69CBBB2FB49310F0085E9D44CA3755DB346E89CF55

Uniqueness

Uniqueness Score: -1.00%

Function 04F90398 Relevance: 2.5, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xql, xrefs: 04F903C4
xql, xrefs: 04F903BA

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID: xql$xql
API String ID: 0-2396326202
Opcode ID: 612d395b37262e13ff63f0a30964d6ebc70fb4ce66c0480977451482588a65ce
Instruction ID: 526b3bd57214da26be688594ccae87da04b3219a2ac6e8b6dd4589d910d1c400
Opcode Fuzzy Hash: 612d395b37262e13ff63f0a30964d6ebc70fb4ce66c0480977451482588a65ce
Instruction Fuzzy Hash: FAF09032F0D2519FEB27062C5815A2A77E20BA6514F2E81BBC181CBB66DD758C47C3A2

Uniqueness

Uniqueness Score: -1.00%

Function 04F90250 Relevance: 2.5, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xql, xrefs: 04F90272
xql, xrefs: 04F9027C

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID: xql$xql
API String ID: 0-2396326202
Opcode ID: 14fec1085abb0ddb2ba52b8da70f3c10b92e64d0f63f873c9dae2d9b9e3bbd75
Instruction ID: 68d9edcb45985c9622b5bb63cb0d5434e458b50000ab64447d1f795b6780a20e
Opcode Fuzzy Hash: 14fec1085abb0ddb2ba52b8da70f3c10b92e64d0f63f873c9dae2d9b9e3bbd75
Instruction Fuzzy Hash: E3F0E923F0C7514FEBAE016C5D2156A77E28FC752472E42BBC441CBB56ED215C478392

Uniqueness

Uniqueness Score: -1.00%

Function 028CF134 Relevance: 1.8, APIs: 1, Instructions: 264
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 028CF3D0

Memory Dump Source

Source File: 0000000E.00000002.521817889.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_28c0000_iexplore.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 04806d0d801466eb25b2b00833ae0358320e109526a1bbdbb8ba3392309918ce
Instruction ID: 710ef2ae2a69d521de8cfc6fc5d23bbe12d49d6402c976f43a18e63d9f5790b2
Opcode Fuzzy Hash: 04806d0d801466eb25b2b00833ae0358320e109526a1bbdbb8ba3392309918ce
Instruction Fuzzy Hash: 16A17A79E002199FEB10CF68C8817DDBBB2FF58318F14816AE918E7690D7749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 028CF140 Relevance: 1.8, APIs: 1, Instructions: 261
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 028CF3D0

Memory Dump Source

Source File: 0000000E.00000002.521817889.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_28c0000_iexplore.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 2bfc59c6fb2adc0de301dc045c745b27920ad2dc489f261b98259ba5fc434ab8
Instruction ID: b2f5b458c000d7b5e912c44aca43e1be2edbfd3f1ed587f3b4e20b8166987c65
Opcode Fuzzy Hash: 2bfc59c6fb2adc0de301dc045c745b27920ad2dc489f261b98259ba5fc434ab8
Instruction Fuzzy Hash: 9EA16A79E002199FEB10CF68C8817DEBBB2FF48318F14816AE918E7690D7749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 028CF731 Relevance: 1.6, APIs: 1, Instructions: 66
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 028CF7C5

Memory Dump Source

Source File: 0000000E.00000002.521817889.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_28c0000_iexplore.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 5ff62a81e235348c92bb445e3762bf098f0d845f2fda7ff7f68dd22caa06f2f3
Instruction ID: a0180c756f3d31ddbfe7752cf57d5155d45e2ed8b90fd447da50319189e4c57a
Opcode Fuzzy Hash: 5ff62a81e235348c92bb445e3762bf098f0d845f2fda7ff7f68dd22caa06f2f3
Instruction Fuzzy Hash: DD2114B5900259DFDB10CF9AD884BDEBBF4FB48324F10842AE918E7640D778A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 028CF738 Relevance: 1.6, APIs: 1, Instructions: 65injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 028CF7C5

Memory Dump Source

Source File: 0000000E.00000002.521817889.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_28c0000_iexplore.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 91d93c021386195ffed28d8879ac6ef35ab7a6232a52b533e0b358fca8a48a5b
Instruction ID: 9ef9509db4760ea9c4d2930a44587cf4c68a6bafdccc139e215b971c83b0ee7f
Opcode Fuzzy Hash: 91d93c021386195ffed28d8879ac6ef35ab7a6232a52b533e0b358fca8a48a5b
Instruction Fuzzy Hash: 272125B5900259DFDB10CF9AC884BDEBBF4FB48324F10842AE918E3640D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 028CF508 Relevance: 1.6, APIs: 1, Instructions: 60threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 028CF587

Memory Dump Source

Source File: 0000000E.00000002.521817889.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_28c0000_iexplore.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: e88b084b388ede754e5697e8e82bb41981eceea43cebea5c084d8f7ce0ef4bc3
Instruction ID: 42521828962f1e7a19b1187f66005c5fcd0ae5284bad523e2f6b3d02d0c40f07
Opcode Fuzzy Hash: e88b084b388ede754e5697e8e82bb41981eceea43cebea5c084d8f7ce0ef4bc3
Instruction Fuzzy Hash: A52156B5D002199FDB10CF9AC884BDEFBF4FB08224F10812AE518E3640D778AA45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 028CF5C8 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 028CF646

Memory Dump Source

Source File: 0000000E.00000002.521817889.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_28c0000_iexplore.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: f12cdd4403a1e4e8b90a1381d9457421835205f2f518681bf9806e19de828f1d
Instruction ID: a40543f998801be94064aa1b897514f3861d615f34a52407db4d32850f544229
Opcode Fuzzy Hash: f12cdd4403a1e4e8b90a1381d9457421835205f2f518681bf9806e19de828f1d
Instruction Fuzzy Hash: BD2127B59002599FCB10DF9AC584BDEBBF4FB48324F10842AE518E7251D3789645CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 028CF510 Relevance: 1.6, APIs: 1, Instructions: 58threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 028CF587

Memory Dump Source

Source File: 0000000E.00000002.521817889.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_28c0000_iexplore.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: f4731f15da0cacddcd1f46e77adf99b67100e2a7bc11b70f2768962463d4ccd2
Instruction ID: a5b7d1fdf4d813d7077b48637be55291dd03af0f4068d55010b8de7f0a3b511e
Opcode Fuzzy Hash: f4731f15da0cacddcd1f46e77adf99b67100e2a7bc11b70f2768962463d4ccd2
Instruction Fuzzy Hash: 1E2136B5D002199FDB10CF9AC984BDEFBF4FB48224F54812AE518E3640D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 028CF5D0 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 028CF646

Memory Dump Source

Source File: 0000000E.00000002.521817889.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_28c0000_iexplore.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 69b02db60425da78afa3be523a1946e42504ea249cf1571424f5729a2dda5e40
Instruction ID: 3555b9fc96cd276b092fb687214fd10efdd10a3dfd1795075bcf49b4afc05c26
Opcode Fuzzy Hash: 69b02db60425da78afa3be523a1946e42504ea249cf1571424f5729a2dda5e40
Instruction Fuzzy Hash: 812117B59002499FDB10DF9AC984BDFFBF4FB48324F14842AE918A3251D378A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 028CF688 Relevance: 1.5, APIs: 1, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 028CF6FB

Memory Dump Source

Source File: 0000000E.00000002.521817889.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_28c0000_iexplore.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f2aad7f3ed0122c35c8b1ecaabeac44db5e9637f62377f71eb32910f1ace0c80
Instruction ID: 2760014d034ea96d4f794d16f23fe5482c6df8c6f7e2b5265b79cf11961315d7
Opcode Fuzzy Hash: f2aad7f3ed0122c35c8b1ecaabeac44db5e9637f62377f71eb32910f1ace0c80
Instruction Fuzzy Hash: E61116B5900259DFCB10CF99D884BDEBBF4FB48324F208419E528A7650C375A554CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 028CF690 Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 028CF6FB

Memory Dump Source

Source File: 0000000E.00000002.521817889.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_28c0000_iexplore.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a3188b3c5a760e3b2f65f32f8dc788348dd695fca754c5104b4b618528e7f024
Instruction ID: 991e0f89d9cc40d55538f109ecd3187bbd4c4cd13e96daf0a642a883e5b6835d
Opcode Fuzzy Hash: a3188b3c5a760e3b2f65f32f8dc788348dd695fca754c5104b4b618528e7f024
Instruction Fuzzy Hash: 121125B59002499FCB10CF9AD884BDFBBF4FB48324F20841AE528A7250C375A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 028CF808 Relevance: 1.5, APIs: 1, Instructions: 45threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 028CF86F

Memory Dump Source

Source File: 0000000E.00000002.521817889.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_28c0000_iexplore.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 801a0e0257a4b1e927e08195714bd468515ca3f804737a3952322d057552a0c3
Instruction ID: a83a98037a990c82b4746104dbfac2832973fee0c696c5a01a42dc0e153c1be0
Opcode Fuzzy Hash: 801a0e0257a4b1e927e08195714bd468515ca3f804737a3952322d057552a0c3
Instruction Fuzzy Hash: E71133B58002498FDB10DF99C848BDEBBF4EB48328F20841AD518A7640C378A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 028CF810 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 028CF86F

Memory Dump Source

Source File: 0000000E.00000002.521817889.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_28c0000_iexplore.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 74d58f288e4b677212db18bb1b74ef315f67aafeab811885de42375fa083bc69
Instruction ID: 734146f28e5fd267b6902828761dd474e23fd3fc04fce19f3f534caf1e460e8f
Opcode Fuzzy Hash: 74d58f288e4b677212db18bb1b74ef315f67aafeab811885de42375fa083bc69
Instruction Fuzzy Hash: AB1112B59002498FDB20CF9AD588BDEFBF4EB48328F20841AD518A7640C778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04F90564 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

xql, xrefs: 04F90590

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID: xql
API String ID: 0-109062218
Opcode ID: c27baa7d4fe15385a7298734984d74949589639bcd026ffb3f0c74b6e1f768dc
Instruction ID: 9c6c5dcad15dd6b3c1a02ac026d943e5855c0cd9a20f5f81fc43a60f0f1e4efd
Opcode Fuzzy Hash: c27baa7d4fe15385a7298734984d74949589639bcd026ffb3f0c74b6e1f768dc
Instruction Fuzzy Hash: 98210A74B083808FDB52CB78C85456E7FF1AF4A214F1905EAC141DB762CB349C05C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 04F90F70 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96e30ca9342de4c6a060ff20c2ad5f4ffb455e7de875ca22e3c476e299319b19
Instruction ID: b1d056f8e374bdd582feae15fcdd1acd8ef994a73504f1e18faf545f85af0236
Opcode Fuzzy Hash: 96e30ca9342de4c6a060ff20c2ad5f4ffb455e7de875ca22e3c476e299319b19
Instruction Fuzzy Hash: 7E210732B08216AFEF218E858942B6F7396EB94714F188029FE155B740CF31ED1297A2

Uniqueness

Uniqueness Score: -1.00%

Function 00EAD3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.513781503.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_ead000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f9e933f4fd19cb307b457ea248e44fa8f3ea534417c71d9d1c2cf5adf4d51c5
Instruction ID: 6e2b86bd741b1922f898221d41f5dc757ac03935a4678b641b45e3d4bc226b58
Opcode Fuzzy Hash: 5f9e933f4fd19cb307b457ea248e44fa8f3ea534417c71d9d1c2cf5adf4d51c5
Instruction Fuzzy Hash: 1C2121B1508204DFDB00DF10CDC0B66BB61FB9C328F24C569E90A5FA46C33AF806CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 04F90F57 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8375f9dbbbc733fb9d5148dc8841a54570ff4094885a8a084994292b94dbb9f0
Instruction ID: d9f68a4151bda42c9e690902bf1439d4f7edf2325b1ea4177d9ced778d634d0d
Opcode Fuzzy Hash: 8375f9dbbbc733fb9d5148dc8841a54570ff4094885a8a084994292b94dbb9f0
Instruction Fuzzy Hash: 11210832A08395AFFF224E048842BAB7BB2EF51314F14805AF91547192DB31AD17D792

Uniqueness

Uniqueness Score: -1.00%

Function 04F905B5 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c7743823f9bbe7c752b5a135699cd05e2410b503e1fd31fd4b64b6fc3d5f4b4
Instruction ID: ec9b2ca954ce3de4a48bb37a74e9bb3ded449b43f0855bdf24f01dd67ef2e47a
Opcode Fuzzy Hash: 0c7743823f9bbe7c752b5a135699cd05e2410b503e1fd31fd4b64b6fc3d5f4b4
Instruction Fuzzy Hash: 5821E771B042958FCB21DB68C8556AEBFF5EF8A310F0401AAE445DB752CB71ED05CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 04F905C8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d49974ee5e183173b7ce395e5099a6b21413b8819e74fb5a72210b19a5ccaa0
Instruction ID: cd9b579babc349887243d18dce61cdd8e14803b02620de35cbf6514b35296a1a
Opcode Fuzzy Hash: 4d49974ee5e183173b7ce395e5099a6b21413b8819e74fb5a72210b19a5ccaa0
Instruction Fuzzy Hash: A111B471B042558FCB20DBA9C85566EBBF5EF89210F04016AD909EB751DF70ED058B92

Uniqueness

Uniqueness Score: -1.00%

Function 04F90B85 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e882bfc4ed305890a4103aa10cacfeabe966ec8dc465eca356db72e7dee8e6b4
Instruction ID: 6dd06dd3636101dac8de0b94f56aa867a12ce3dbcca90f34655131c4f45b9c2d
Opcode Fuzzy Hash: e882bfc4ed305890a4103aa10cacfeabe966ec8dc465eca356db72e7dee8e6b4
Instruction Fuzzy Hash: FB010432B0C2504FAB194E6A186145BB7D7ABD522835E41BB9909CB316DF30DC078392

Uniqueness

Uniqueness Score: -1.00%

Function 00EAD3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.513781503.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_ead000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75ad921a90c5a80d0e06afb818f831ed5976852882da7f26f8f1702c903aed74
Instruction ID: 7eb8b4c0a8161b00f0b9dfbec3c6ae5536c7d379afc9ab53d7ff2afe710e5f1c
Opcode Fuzzy Hash: 75ad921a90c5a80d0e06afb818f831ed5976852882da7f26f8f1702c903aed74
Instruction Fuzzy Hash: 6711B476404280DFDB11CF10D9C4B56BF71FB99324F24C5A9D8095B616C336E856CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04F9081C Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f56f834df1f77bd51ee0f43bf1ef3033bf85915c4cb841f20a193ba1ff0226a9
Instruction ID: 165de22538df50a1932cce38d39b29d1223468bde91ac4346c53e2479acc7c66
Opcode Fuzzy Hash: f56f834df1f77bd51ee0f43bf1ef3033bf85915c4cb841f20a193ba1ff0226a9
Instruction Fuzzy Hash: FAF0C872B0D2904FDB164668586142A7FE6ABC612430D41FFD545CB352DE259C0683A7

Uniqueness

Uniqueness Score: -1.00%

Function 04F900C8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c1df996d3009688474deeae9d49b660d75c166b5e9ba071962c42c83ec9bdf1
Instruction ID: a1fd41e39d4404264d17aea08f59f0bb978d99f808fb86a298278f32ff38ee3b
Opcode Fuzzy Hash: 4c1df996d3009688474deeae9d49b660d75c166b5e9ba071962c42c83ec9bdf1
Instruction Fuzzy Hash: E0F02131F041006FEB34490D8922B2B72D75FD5624F2D8036E9018F754DD71DC4287D2

Uniqueness

Uniqueness Score: -1.00%

Function 04F91180 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 062d8e198d19a3aa64e272bedddc69aca6746970b55d0be61ca357bc7561d5b6
Instruction ID: a6c33da2fd7d131afd09f282e04c363a75b1e5e0f589623197b0e0d593ce383d
Opcode Fuzzy Hash: 062d8e198d19a3aa64e272bedddc69aca6746970b55d0be61ca357bc7561d5b6
Instruction Fuzzy Hash: DFF02422F082035BFB6901091A201AA77EA5BC261034E427B8809D7347D9205C838782

Uniqueness

Uniqueness Score: -1.00%

Function 04F90CE0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c81d208b6d9375bb3ebd9e8fd5d676c771eab80ff6245b62925618c55ef4d22
Instruction ID: 11ae6e955033120b2cc8fa7d401cb4e8dbba82943abd9f5f3f7a4495bba6b327
Opcode Fuzzy Hash: 3c81d208b6d9375bb3ebd9e8fd5d676c771eab80ff6245b62925618c55ef4d22
Instruction Fuzzy Hash: 1CF02736F040129F9F784A1E851441AB6EADFD563032DC037D9098B710CE71FC028792

Uniqueness

Uniqueness Score: -1.00%

Function 04F900C7 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6b9e43e4177650cbb26183789a900cd7e7b2a40962f714dc94b81a87c5001cb
Instruction ID: 2d8aae80a7ee14a1f76cb52998a532ca91280d115012c4f20b5715943e5f85dd
Opcode Fuzzy Hash: d6b9e43e4177650cbb26183789a900cd7e7b2a40962f714dc94b81a87c5001cb
Instruction Fuzzy Hash: 74F0E232B04200AFEB34490D8822F37B7E29FD0B20F24802AE9419B660DD71EC428A91

Uniqueness

Uniqueness Score: -1.00%

Function 04F906F0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2a4f61aa9a5908ca0006b0b2d686310590955633ad4f316647342a0371a3db1
Instruction ID: 2e94437d6b05a42df28736922c57f2112ae502785a5d2791e6bb891c385d42c7
Opcode Fuzzy Hash: f2a4f61aa9a5908ca0006b0b2d686310590955633ad4f316647342a0371a3db1
Instruction Fuzzy Hash: 78E0D836B044184F1B74852D952582BB2DB9FC91303258075D50DCB724EE31EC4287A3

Uniqueness

Uniqueness Score: -1.00%

Function 04F90CDF Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 894e66a4a6f7b930301cded0ba719f1c4bb65aebb3ea7abf649948e5cf205308
Instruction ID: 3025064887e50e63b2b9db82c1678ecf09153da9fb13e2d0a07f6ebf5a111325
Opcode Fuzzy Hash: 894e66a4a6f7b930301cded0ba719f1c4bb65aebb3ea7abf649948e5cf205308
Instruction Fuzzy Hash: BBE06D3AF045169FEF384A1E9010866BBE9DFD5630329816BD8098B620CE72AC429A41

Uniqueness

Uniqueness Score: -1.00%

Function 04F910D0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ebdf28722bb973cebc97b70ba289df097d41a42bcf2e7d924a53deccbe71007
Instruction ID: 499df1f2bc939b6c7cda49a5d18d62a17e799dac6b45371fb6f59fa7cc9469e1
Opcode Fuzzy Hash: 8ebdf28722bb973cebc97b70ba289df097d41a42bcf2e7d924a53deccbe71007
Instruction Fuzzy Hash: 93E01225A0E3C25FFB1706310A720763BF52E8310530E40E784818BA63E92A9C4BE727

Uniqueness

Uniqueness Score: -1.00%

Function 04F90444 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13abbbf61a97121965c289e3c55b00aaedcc4ba8ccd562ec333ec0021fa5aba9
Instruction ID: 3806c363a93d21160e2ccea1c6a2351b0583ca3690378a21b8cc28896851d504
Opcode Fuzzy Hash: 13abbbf61a97121965c289e3c55b00aaedcc4ba8ccd562ec333ec0021fa5aba9
Instruction Fuzzy Hash: 44F0E524A4E3E18FDB17873448250667FB2AE8311431E81EBC0C1CF1A7DA298C4AC727

Uniqueness

Uniqueness Score: -1.00%

Function 04F913D0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8434e92008b5c8b16e61d7485ac8a5ebcd271c37662c14b1296303756d1a863a
Instruction ID: b0d9372eae9deb9ab16e9239db324c106383f1f9d744a66fca52bfba416c649f
Opcode Fuzzy Hash: 8434e92008b5c8b16e61d7485ac8a5ebcd271c37662c14b1296303756d1a863a
Instruction Fuzzy Hash: 94E04F30B0D3A24FFF1B0A2509211A63B72AA8310435E41F78081CF257E93D9C47CB53

Uniqueness

Uniqueness Score: -1.00%

Function 04F90400 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c0bb2cfda792c6e829c695193a019016a1b5f94efbe18a5ef3c8a00863f1e8d
Instruction ID: cf3f9a00d6f68bb1b7aa5a73cd9befebfc21a4fff84257937b8edc007ba0d79a
Opcode Fuzzy Hash: 6c0bb2cfda792c6e829c695193a019016a1b5f94efbe18a5ef3c8a00863f1e8d
Instruction Fuzzy Hash: 35E01A25A0E3D04FEF5B46340C250A63F72AE9310435E41EB84C1CE253E9295D47D723

Uniqueness

Uniqueness Score: -1.00%

Function 04F90A08 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc8521b3d472fe1360477a7e3329900824114e0e986df8785fac48774d9a2b08
Instruction ID: a6ccdc12533aad609cfad31b8cdb0b7ee4810dd58492d2413b300d869323d866
Opcode Fuzzy Hash: bc8521b3d472fe1360477a7e3329900824114e0e986df8785fac48774d9a2b08
Instruction Fuzzy Hash: F7E04F2160E3C04FCB4B47305D754997FB1AE8320138E41EBC085CB2A3DD24484AD753

Uniqueness

Uniqueness Score: -1.00%

Function 04F906A0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92d358a18f862e41f2247e2320ed717827e3b3c1ac5a504b45df698f7d86a013
Instruction ID: 9d196d4312f385cd832dffdd7b612f0d6650ba712880ddb4c91719a5e0a55916
Opcode Fuzzy Hash: 92d358a18f862e41f2247e2320ed717827e3b3c1ac5a504b45df698f7d86a013
Instruction Fuzzy Hash: ADE0C231F045259F5B18DA4E8510456B7DAAFC912031890B5E90DCB732DF30EC024781

Uniqueness

Uniqueness Score: -1.00%

Function 04F90520 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2515e03639221c6ae0d09efb355aa8a297eb27c69f560d9f48acc5daac32629b
Instruction ID: ce01db3ab06e0bd4715f78c51e0b2ba1dfcb4dbe431ed9a627bac0a9deacd7b3
Opcode Fuzzy Hash: 2515e03639221c6ae0d09efb355aa8a297eb27c69f560d9f48acc5daac32629b
Instruction Fuzzy Hash: 00E04625A1E3E14EEF978B384C201697F725E9300434E42E7C0D1CE2A3D9294D8ACB23

Uniqueness

Uniqueness Score: -1.00%

Function 04F902BC Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6be0552059c14b326111a59ef807a388af8b88013a413f4aaa44865c8120619b
Instruction ID: 4d51b8e8e4b9d3de024ed73bd3cd96d3b8802f7807f4e610cd731ffe1335aa95
Opcode Fuzzy Hash: 6be0552059c14b326111a59ef807a388af8b88013a413f4aaa44865c8120619b
Instruction Fuzzy Hash: F2D05E1624D3D00FD75363342C2A1992FA09A4714030A01EBD081EF2A3D4041D0B8763

Uniqueness

Uniqueness Score: -1.00%

Function 04F907E8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27fb38c4d81191db5054870f358752f354fab3ca189063068ca588ef651f2f3
Instruction ID: 6511f48d5db26386b0c7cb264542666a3230fbe56ea2ec19c1bec07a2a5a7414
Opcode Fuzzy Hash: b27fb38c4d81191db5054870f358752f354fab3ca189063068ca588ef651f2f3
Instruction Fuzzy Hash: 8BD05E34F04509CF6B548A29C51182977E76FC51243184064D1068BB60EE30FC818A82

Uniqueness

Uniqueness Score: -1.00%

Function 04F9093C Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd7762a692d578838df675354233568aa03da62bde7182acbff0ca2407fdfde9
Instruction ID: 23d917d88445df4305c6905387185a16a458c21adfbdb5b867df16b6f2b10ec6
Opcode Fuzzy Hash: fd7762a692d578838df675354233568aa03da62bde7182acbff0ca2407fdfde9
Instruction Fuzzy Hash: 50D012A648E3C41FCB0347B02C6AAD83FB0EE37010F0E04DBD495CA0A3E089080BCB22

Uniqueness

Uniqueness Score: -1.00%

Function 04F90950 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.528038649.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f90000_iexplore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b90244cfa0ae9a6261f1ef2a65e7b1bde1d0ac66831d971cc9aa2f889d52afaf
Instruction ID: 95c92dbf9ab58932405b79f4c23d07447f13a240c49579e8f5c02259b5153b0f
Opcode Fuzzy Hash: b90244cfa0ae9a6261f1ef2a65e7b1bde1d0ac66831d971cc9aa2f889d52afaf
Instruction Fuzzy Hash: 7990223000020C8FC20023823808308330CE200000F880802A00C800000A8020000082

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ORDINE.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ORDINE.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\iexplore.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log

C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe

C:\Users\user\AppData\Local\Temp\iexplore\iexplore.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
ORDINE.exe