Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Overview

General Information

Sample Name:	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe
Analysis ID:	756005
MD5:	d55d9c72b27c17af9a53847bec4dad00
SHA1:	dbfa157d95af9d351b7051802e5e80a0a78daa05
SHA256:	36143d6674053884d6bf2ce1e5bc8dd6f31b9d6b4d2fae272e37ac5649d00520
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Telegram RAT

Yara detected AgentTesla

Yara detected AntiVM3

Snort IDS alert for network traffic

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses the Telegram API (likely for C&C communication)

Machine Learning detection for sample

Yara detected Generic Downloader

.NET source code contains very large array initializations

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Yara detected Credential Stealer

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe (PID: 5996 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe MD5: D55D9C72B27C17AF9A53847BEC4DAD00)

SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe (PID: 3096 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe MD5: D55D9C72B27C17AF9A53847BEC4DAD00)

cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot5083863399:AAH9g72QTdN88jNOd6_tBrE8gEd-FpXnfHE/sendMessage"}

Threatname: Agenttesla

{"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot5083863399:AAH9g72QTdN88jNOd6_tBrE8gEd-FpXnfHE/sendDocumentsendMessage?chat_id=document"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000000.357382208.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000000.357382208.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000001.00000000.357382208.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x31109:$a3: MailAccountConfiguration 0x31122:$a5: SmtpAccountConfiguration 0x310e9:$a8: set_BindingAccountConfiguration 0x30057:$a11: get_securityProfile 0x2fef8:$a12: get_useSeparateFolderTree 0x3184c:$a13: get_DnsResolver 0x30307:$a14: get_archivingScope 0x3012f:$a15: get_providerName 0x32837:$a17: get_priority 0x31e0b:$a18: get_advancedParameters 0x31223:$a19: get_disabledByRestriction 0x2fcce:$a20: get_LastAccessed 0x303a1:$a21: get_avatarType 0x31f22:$a22: get_signaturePresets 0x309c8:$a23: get_enableLog 0x301ac:$a26: set_accountName 0x3236d:$a27: set_InternalServerPort 0x2f63d:$a28: set_bindingConfigurationUID 0x31ee8:$a29: set_IdnAddress 0x326eb:$a30: set_GuidMasterKey 0x30207:$a31: set_username
00000001.00000000.357382208.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_f2a90d14	unknown	unknown	0x3dd4:$a: 0B FE 01 2C 0B 07 16 7E 08 00 00 04 A2 1F 0C 0C 00 08 1F 09 FE 01
00000000.00000002.364684955.000000000300C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.366653419.0000000003F6C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.366653419.0000000003F6C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.366653419.0000000003F6C000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x143a89:$a3: MailAccountConfiguration 0x179ca9:$a3: MailAccountConfiguration 0x1afcc9:$a3: MailAccountConfiguration 0x143aa2:$a5: SmtpAccountConfiguration 0x179cc2:$a5: SmtpAccountConfiguration 0x1afce2:$a5: SmtpAccountConfiguration 0x143a69:$a8: set_BindingAccountConfiguration 0x179c89:$a8: set_BindingAccountConfiguration 0x1afca9:$a8: set_BindingAccountConfiguration 0x1429d7:$a11: get_securityProfile 0x178bf7:$a11: get_securityProfile 0x1aec17:$a11: get_securityProfile 0x142878:$a12: get_useSeparateFolderTree 0x178a98:$a12: get_useSeparateFolderTree 0x1aeab8:$a12: get_useSeparateFolderTree 0x1441cc:$a13: get_DnsResolver 0x17a3ec:$a13: get_DnsResolver 0x1b040c:$a13: get_DnsResolver 0x142c87:$a14: get_archivingScope 0x178ea7:$a14: get_archivingScope 0x1aeec7:$a14: get_archivingScope
00000000.00000002.366653419.0000000003F6C000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_f2a90d14	unknown	unknown	0x116754:$a: 0B FE 01 2C 0B 07 16 7E 08 00 00 04 A2 1F 0C 0C 00 08 1F 09 FE 01 0x14c974:$a: 0B FE 01 2C 0B 07 16 7E 08 00 00 04 A2 1F 0C 0C 00 08 1F 09 FE 01 0x182994:$a: 0B FE 01 2C 0B 07 16 7E 08 00 00 04 A2 1F 0C 0C 00 08 1F 09 FE 01
00000000.00000002.361380481.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x2fc84:$s10: logins 0x2fa354:$s11: credential 0x1e62:$m1: yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time 0x2430:$m2: %image/jpg:Zone.Identifier\tmpG.tmp%urlkey%-f \Data\Tor\torrcp=%PostURL%127.0.0.1POST+%2B 0x297c:$m3: >{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\WScript.ShellRegReadg401 0x1f83:$m5: \WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 5996	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 5996	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 5996	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 5996	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x22190:$a3: MailAccountConfiguration 0x221a9:$a5: SmtpAccountConfiguration 0x22170:$a8: set_BindingAccountConfiguration 0x21648:$a11: get_securityProfile 0x2156e:$a12: get_useSeparateFolderTree 0x22673:$a13: get_DnsResolver 0x21874:$a14: get_archivingScope 0x216e4:$a15: get_providerName 0x2311a:$a17: get_priority 0x22a0d:$a18: get_advancedParameters 0x2224b:$a19: get_disabledByRestriction 0x213f4:$a20: get_LastAccessed 0x21904:$a21: get_avatarType 0x22b03:$a22: get_signaturePresets 0x21d02:$a23: get_enableLog 0x21754:$a26: set_accountName 0x22e27:$a27: set_InternalServerPort 0x21256:$a28: set_bindingConfigurationUID 0x22ac9:$a29: set_IdnAddress 0x23053:$a30: set_GuidMasterKey 0x217a2:$a31: set_username
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 3096	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 3096	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 3096	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 3096	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x1a1f5:$s1: get_kbok 0x1aa75:$s2: get_CHoo 0x1b610:$s3: set_passwordIsSet 0x1a0a1:$s4: get_enableLog 0x19512:$g1: get_Clipboard 0x19520:$g2: get_Keyboard 0x1952d:$g3: get_Password 0x1a94f:$g4: get_CtrlKeyDown 0x1a95f:$g5: get_ShiftKeyDown 0x1a970:$g6: get_AltKeyDown 0x2eb29:$m1: yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time 0x30d95:$m1: yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time 0x2f0f7:$m2: %image/jpg:Zone.Identifier\tmpG.tmp%urlkey%-f \Data\Tor\torrcp=%PostURL%127.0.0.1POST+%2B 0x31362:$m2: %image/jpg:Zone.Identifier\tmpG.tmp%urlkey%-f \Data\Tor\torrcp=%PostURL%127.0.0.1POST+%2B 0x2f643:$m3: >{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\WScript.ShellRegReadg401 0x318ae:$m3: >{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\WScript.ShellRegReadg401 0x2ec4a:$m5: \WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera 0x30eb6:$m5: \WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 3096	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x1a6b6:$a3: MailAccountConfiguration 0x1a6cf:$a5: SmtpAccountConfiguration 0x1a696:$a8: set_BindingAccountConfiguration 0x1978f:$a11: get_securityProfile 0x19633:$a12: get_useSeparateFolderTree 0x1ad54:$a13: get_DnsResolver 0x19a3b:$a14: get_archivingScope 0x19867:$a15: get_providerName 0x1bc20:$a17: get_priority 0x1b2e3:$a18: get_advancedParameters 0x1a7d0:$a19: get_disabledByRestriction 0x1943b:$a20: get_LastAccessed 0x19ad5:$a21: get_avatarType 0x1b3fa:$a22: get_signaturePresets 0x1a0a1:$a23: get_enableLog 0x198e4:$a26: set_accountName 0x1b824:$a27: set_InternalServerPort 0x1920f:$a28: set_bindingConfigurationUID 0x1b3c0:$a29: set_IdnAddress 0x1bade:$a30: set_GuidMasterKey 0x1993f:$a31: set_username
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x2efc4:$s1: get_kbok 0x2f8f8:$s2: get_CHoo 0x30553:$s3: set_passwordIsSet 0x2edc8:$s4: get_enableLog 0x33519:$s8: torbrowser 0x31ef5:$s10: logins 0x317c3:$s11: credential 0x2e1bc:$g1: get_Clipboard 0x2e1ca:$g2: get_Keyboard 0x2e1d7:$g3: get_Password 0x2f7a6:$g4: get_CtrlKeyDown 0x2f7b6:$g5: get_ShiftKeyDown 0x2f7c7:$g6: get_AltKeyDown
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x2f509:$a3: MailAccountConfiguration 0x2f522:$a5: SmtpAccountConfiguration 0x2f4e9:$a8: set_BindingAccountConfiguration 0x2e457:$a11: get_securityProfile 0x2e2f8:$a12: get_useSeparateFolderTree 0x2fc4c:$a13: get_DnsResolver 0x2e707:$a14: get_archivingScope 0x2e52f:$a15: get_providerName 0x30c37:$a17: get_priority 0x3020b:$a18: get_advancedParameters 0x2f623:$a19: get_disabledByRestriction 0x2e0ce:$a20: get_LastAccessed 0x2e7a1:$a21: get_avatarType 0x30322:$a22: get_signaturePresets 0x2edc8:$a23: get_enableLog 0x2e5ac:$a26: set_accountName 0x3076d:$a27: set_InternalServerPort 0x2da3d:$a28: set_bindingConfigurationUID 0x302e8:$a29: set_IdnAddress 0x30aeb:$a30: set_GuidMasterKey 0x2e607:$a31: set_username
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.unpack	Windows_Trojan_AgentTesla_f2a90d14	unknown	unknown	0x21d4:$a: 0B FE 01 2C 0B 07 16 7E 08 00 00 04 A2 1F 0C 0C 00 08 1F 09 FE 01
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.2d5072c.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.2d5072c.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0xd37a:$v1: SbieDll.dll 0xd394:$v2: USER 0xd3a0:$v3: SANDBOX 0xd3b2:$v4: VIRUS 0xd402:$v4: VIRUS 0xd3c0:$v5: MALWARE 0xd3d2:$v6: SCHMIDTI 0xd3e6:$v7: CURRENTUSER
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30dc4:$s1: get_kbok 0x66fe4:$s1: get_kbok 0x9d004:$s1: get_kbok 0x316f8:$s2: get_CHoo 0x67918:$s2: get_CHoo 0x9d938:$s2: get_CHoo 0x32353:$s3: set_passwordIsSet 0x68573:$s3: set_passwordIsSet 0x9e593:$s3: set_passwordIsSet 0x30bc8:$s4: get_enableLog 0x66de8:$s4: get_enableLog 0x9ce08:$s4: get_enableLog 0x35319:$s8: torbrowser 0x6b539:$s8: torbrowser 0xa1559:$s8: torbrowser 0x33cf5:$s10: logins 0x69f15:$s10: logins 0x9ff35:$s10: logins 0x335c3:$s11: credential 0x697e3:$s11: credential 0x9f803:$s11: credential
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x31309:$a3: MailAccountConfiguration 0x67529:$a3: MailAccountConfiguration 0x9d549:$a3: MailAccountConfiguration 0x31322:$a5: SmtpAccountConfiguration 0x67542:$a5: SmtpAccountConfiguration 0x9d562:$a5: SmtpAccountConfiguration 0x312e9:$a8: set_BindingAccountConfiguration 0x67509:$a8: set_BindingAccountConfiguration 0x9d529:$a8: set_BindingAccountConfiguration 0x30257:$a11: get_securityProfile 0x66477:$a11: get_securityProfile 0x9c497:$a11: get_securityProfile 0x300f8:$a12: get_useSeparateFolderTree 0x66318:$a12: get_useSeparateFolderTree 0x9c338:$a12: get_useSeparateFolderTree 0x31a4c:$a13: get_DnsResolver 0x67c6c:$a13: get_DnsResolver 0x9dc8c:$a13: get_DnsResolver 0x30507:$a14: get_archivingScope 0x66727:$a14: get_archivingScope 0x9c747:$a14: get_archivingScope
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.raw.unpack	Windows_Trojan_AgentTesla_f2a90d14	unknown	unknown	0x3fd4:$a: 0B FE 01 2C 0B 07 16 7E 08 00 00 04 A2 1F 0C 0C 00 08 1F 09 FE 01 0x3a1f4:$a: 0B FE 01 2C 0B 07 16 7E 08 00 00 04 A2 1F 0C 0C 00 08 1F 09 FE 01 0x70214:$a: 0B FE 01 2C 0B 07 16 7E 08 00 00 04 A2 1F 0C 0C 00 08 1F 09 FE 01
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.2d32f5c.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.2d32f5c.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0x2ab4a:$v1: SbieDll.dll 0x2ab64:$v2: USER 0x2ab70:$v3: SANDBOX 0x2ab82:$v4: VIRUS 0x2abd2:$v4: VIRUS 0x2ab90:$v5: MALWARE 0x2aba2:$v6: SCHMIDTI 0x2abb6:$v7: CURRENTUSER
1.0.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.0.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.0.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.0.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30dc4:$s1: get_kbok 0x316f8:$s2: get_CHoo 0x32353:$s3: set_passwordIsSet 0x30bc8:$s4: get_enableLog 0x35319:$s8: torbrowser 0x33cf5:$s10: logins 0x335c3:$s11: credential 0x2ffbc:$g1: get_Clipboard 0x2ffca:$g2: get_Keyboard 0x2ffd7:$g3: get_Password 0x315a6:$g4: get_CtrlKeyDown 0x315b6:$g5: get_ShiftKeyDown 0x315c7:$g6: get_AltKeyDown
1.0.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.400000.0.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x31309:$a3: MailAccountConfiguration 0x31322:$a5: SmtpAccountConfiguration 0x312e9:$a8: set_BindingAccountConfiguration 0x30257:$a11: get_securityProfile 0x300f8:$a12: get_useSeparateFolderTree 0x31a4c:$a13: get_DnsResolver 0x30507:$a14: get_archivingScope 0x3032f:$a15: get_providerName 0x32a37:$a17: get_priority 0x3200b:$a18: get_advancedParameters 0x31423:$a19: get_disabledByRestriction 0x2fece:$a20: get_LastAccessed 0x305a1:$a21: get_avatarType 0x32122:$a22: get_signaturePresets 0x30bc8:$a23: get_enableLog 0x303ac:$a26: set_accountName 0x3256d:$a27: set_InternalServerPort 0x2f83d:$a28: set_bindingConfigurationUID 0x320e8:$a29: set_IdnAddress 0x328eb:$a30: set_GuidMasterKey 0x30407:$a31: set_username
1.0.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.400000.0.unpack	Windows_Trojan_AgentTesla_f2a90d14	unknown	unknown	0x3fd4:$a: 0B FE 01 2C 0B 07 16 7E 08 00 00 04 A2 1F 0C 0C 00 08 1F 09 FE 01
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3feb360.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3feb360.8.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3feb360.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3feb360.8.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0xc41e4:$s1: get_kbok 0xfa404:$s1: get_kbok 0x130424:$s1: get_kbok 0xc4b18:$s2: get_CHoo 0xfad38:$s2: get_CHoo 0x130d58:$s2: get_CHoo 0xc5773:$s3: set_passwordIsSet 0xfb993:$s3: set_passwordIsSet 0x1319b3:$s3: set_passwordIsSet 0xc3fe8:$s4: get_enableLog 0xfa208:$s4: get_enableLog 0x130228:$s4: get_enableLog 0xc8739:$s8: torbrowser 0xfe959:$s8: torbrowser 0x134979:$s8: torbrowser 0xc7115:$s10: logins 0xfd335:$s10: logins 0x133355:$s10: logins 0xc69e3:$s11: credential 0xfcc03:$s11: credential 0x132c23:$s11: credential
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3feb360.8.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x35337:$s1: file:/// 0x35247:$s2: {11111-22222-10009-11112} 0x352c7:$s3: {11111-22222-50001-00000} 0x344c9:$s4: get_Module 0x34844:$s5: Reverse 0xc3aaf:$s5: Reverse 0xf9ccf:$s5: Reverse 0x12fcef:$s5: Reverse 0x2fc50:$s6: BlockCopy 0xc5dba:$s6: BlockCopy 0xfbfda:$s6: BlockCopy 0x131ffa:$s6: BlockCopy 0xc3d50:$s7: ReadByte 0xf9f70:$s7: ReadByte 0x12ff90:$s7: ReadByte 0x35349:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3feb360.8.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0xc4729:$a3: MailAccountConfiguration 0xfa949:$a3: MailAccountConfiguration 0x130969:$a3: MailAccountConfiguration 0xc4742:$a5: SmtpAccountConfiguration 0xfa962:$a5: SmtpAccountConfiguration 0x130982:$a5: SmtpAccountConfiguration 0xc4709:$a8: set_BindingAccountConfiguration 0xfa929:$a8: set_BindingAccountConfiguration 0x130949:$a8: set_BindingAccountConfiguration 0xc3677:$a11: get_securityProfile 0xf9897:$a11: get_securityProfile 0x12f8b7:$a11: get_securityProfile 0xc3518:$a12: get_useSeparateFolderTree 0xf9738:$a12: get_useSeparateFolderTree 0x12f758:$a12: get_useSeparateFolderTree 0xc4e6c:$a13: get_DnsResolver 0xfb08c:$a13: get_DnsResolver 0x1310ac:$a13: get_DnsResolver 0xc3927:$a14: get_archivingScope 0xf9b47:$a14: get_archivingScope 0x12fb67:$a14: get_archivingScope
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3feb360.8.raw.unpack	Windows_Trojan_AgentTesla_f2a90d14	unknown	unknown	0x973f4:$a: 0B FE 01 2C 0B 07 16 7E 08 00 00 04 A2 1F 0C 0C 00 08 1F 09 FE 01 0xcd614:$a: 0B FE 01 2C 0B 07 16 7E 08 00 00 04 A2 1F 0C 0C 00 08 1F 09 FE 01 0x103634:$a: 0B FE 01 2C 0B 07 16 7E 08 00 00 04 A2 1F 0C 0C 00 08 1F 09 FE 01
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3f6cd88.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3f6cd88.7.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3f6cd88.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3f6cd88.7.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x1427bc:$s1: get_kbok 0x1789dc:$s1: get_kbok 0x1ae9fc:$s1: get_kbok 0x1430f0:$s2: get_CHoo 0x179310:$s2: get_CHoo 0x1af330:$s2: get_CHoo 0x143d4b:$s3: set_passwordIsSet 0x179f6b:$s3: set_passwordIsSet 0x1aff8b:$s3: set_passwordIsSet 0x1425c0:$s4: get_enableLog 0x1787e0:$s4: get_enableLog 0x1ae800:$s4: get_enableLog 0x146d11:$s8: torbrowser 0x17cf31:$s8: torbrowser 0x1b2f51:$s8: torbrowser 0x1456ed:$s10: logins 0x17b90d:$s10: logins 0x1b192d:$s10: logins 0x144fbb:$s11: credential 0x17b1db:$s11: credential 0x1b11fb:$s11: credential
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3f6cd88.7.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0xb390f:$s1: file:/// 0xb381f:$s2: {11111-22222-10009-11112} 0xb389f:$s3: {11111-22222-50001-00000} 0xb2aa1:$s4: get_Module 0xb2e1c:$s5: Reverse 0x142087:$s5: Reverse 0x1782a7:$s5: Reverse 0x1ae2c7:$s5: Reverse 0xae228:$s6: BlockCopy 0x144392:$s6: BlockCopy 0x17a5b2:$s6: BlockCopy 0x1b05d2:$s6: BlockCopy 0x142328:$s7: ReadByte 0x178548:$s7: ReadByte 0x1ae568:$s7: ReadByte 0xb3921:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3f6cd88.7.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x142d01:$a3: MailAccountConfiguration 0x178f21:$a3: MailAccountConfiguration 0x1aef41:$a3: MailAccountConfiguration 0x142d1a:$a5: SmtpAccountConfiguration 0x178f3a:$a5: SmtpAccountConfiguration 0x1aef5a:$a5: SmtpAccountConfiguration 0x142ce1:$a8: set_BindingAccountConfiguration 0x178f01:$a8: set_BindingAccountConfiguration 0x1aef21:$a8: set_BindingAccountConfiguration 0x141c4f:$a11: get_securityProfile 0x177e6f:$a11: get_securityProfile 0x1ade8f:$a11: get_securityProfile 0x141af0:$a12: get_useSeparateFolderTree 0x177d10:$a12: get_useSeparateFolderTree 0x1add30:$a12: get_useSeparateFolderTree 0x143444:$a13: get_DnsResolver 0x179664:$a13: get_DnsResolver 0x1af684:$a13: get_DnsResolver 0x141eff:$a14: get_archivingScope 0x17811f:$a14: get_archivingScope 0x1ae13f:$a14: get_archivingScope
0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3f6cd88.7.raw.unpack	Windows_Trojan_AgentTesla_f2a90d14	unknown	unknown	0x1159cc:$a: 0B FE 01 2C 0B 07 16 7E 08 00 00 04 A2 1F 0C 0C 00 08 1F 09 FE 01 0x14bbec:$a: 0B FE 01 2C 0B 07 16 7E 08 00 00 04 A2 1F 0C 0C 00 08 1F 09 FE 01 0x181c0c:$a: 0B FE 01 2C 0B 07 16 7E 08 00 00 04 A2 1F 0C 0C 00 08 1F 09 FE 01
Click to see the 30 entries

Snort Signatures

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 149.154.167.220

Timestamp:	192.168.2.5149.154.167.220497094432851779 11/29/22-13:52:27.896928
SID:	2851779
Source Port:	49709
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	ReversingLabs: Detection: 34%
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Virustotal: Detection: 27%			Perma Link

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Joe Sandbox ML: detected

Source: 1.0.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.unpack	Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot5083863399:AAH9g72QTdN88jNOd6_tBrE8gEd-FpXnfHE/sendDocumentsendMessage?chat_id=document"}
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3096.1.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot5083863399:AAH9g72QTdN88jNOd6_tBrE8gEd-FpXnfHE/sendMessage"}

Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49709 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3feb360.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3f6cd88.7.raw.unpack, type: UNPACKEDPE

Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://UEYOBD.com
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.588988783.00000000030AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.592198535.0000000006B10000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.588649521.0000000003056000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dv3SXfHRU1tFUjfcDW.net
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.588915905.0000000003098000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000003.325953219.00000000010EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com8
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.588915905.0000000003098000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.366653419.0000000003F6C000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000000.357382208.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot5083863399:AAH9g72QTdN88jNOd6_tBrE8gEd-FpXnfHE/
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.588915905.0000000003098000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot5083863399:AAH9g72QTdN88jNOd6_tBrE8gEd-FpXnfHE/sendDocument
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot5083863399:AAH9g72QTdN88jNOd6_tBrE8gEd-FpXnfHE/sendDocumentdocument-----
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.588915905.0000000003098000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org4
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.366653419.0000000003F6C000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000000.357382208.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown

DNS traffic detected: queries for: api.telegram.org

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_f2a90d14 Author: unknown
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.2d5072c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_f2a90d14 Author: unknown
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.2d32f5c.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 1.0.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.0.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 1.0.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_f2a90d14 Author: unknown
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3feb360.8.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3feb360.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3feb360.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3feb360.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_f2a90d14 Author: unknown
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3f6cd88.7.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3f6cd88.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3f6cd88.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3f6cd88.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_f2a90d14 Author: unknown
Source: 00000001.00000000.357382208.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000001.00000000.357382208.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_f2a90d14 Author: unknown
Source: 00000000.00000002.366653419.0000000003F6C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000000.00000002.366653419.0000000003F6C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_f2a90d14 Author: unknown
Source: 00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 5996, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 3096, type: MEMORYSTR	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 3096, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown

.NET source code contains very large array initializations

Source: 1.0.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bEEE02A64u002dA051u002d4832u002d8500u002dBCB6E03153A3u007d/u003277DE882u002dD82Fu002d4CFAu002d82FDu002d8DA69792B4E8.cs

Large array initialization: .cctor: array initializer size 12005

Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_f2a90d14 reference_sample = ed43ddb536e6c3f8513213cd6eb2e890b73e26d5543c0ba1deb2690b5c0385b6, os = windows, severity = x86, creation_date = 2022-03-11, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = 829c827069846ba1e1378aba8ee6cdc801631d769dc3dce15ccaacd4068a88a6, id = f2a90d14-7212-41a5-a2cd-a6a6dedce96e, last_modified = 2022-04-12
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.2d5072c.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_f2a90d14 reference_sample = ed43ddb536e6c3f8513213cd6eb2e890b73e26d5543c0ba1deb2690b5c0385b6, os = windows, severity = x86, creation_date = 2022-03-11, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = 829c827069846ba1e1378aba8ee6cdc801631d769dc3dce15ccaacd4068a88a6, id = f2a90d14-7212-41a5-a2cd-a6a6dedce96e, last_modified = 2022-04-12
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.2d32f5c.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 1.0.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.0.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 1.0.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_f2a90d14 reference_sample = ed43ddb536e6c3f8513213cd6eb2e890b73e26d5543c0ba1deb2690b5c0385b6, os = windows, severity = x86, creation_date = 2022-03-11, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = 829c827069846ba1e1378aba8ee6cdc801631d769dc3dce15ccaacd4068a88a6, id = f2a90d14-7212-41a5-a2cd-a6a6dedce96e, last_modified = 2022-04-12
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3feb360.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3feb360.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3feb360.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3feb360.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_f2a90d14 reference_sample = ed43ddb536e6c3f8513213cd6eb2e890b73e26d5543c0ba1deb2690b5c0385b6, os = windows, severity = x86, creation_date = 2022-03-11, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = 829c827069846ba1e1378aba8ee6cdc801631d769dc3dce15ccaacd4068a88a6, id = f2a90d14-7212-41a5-a2cd-a6a6dedce96e, last_modified = 2022-04-12
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3f6cd88.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3f6cd88.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3f6cd88.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3f6cd88.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_f2a90d14 reference_sample = ed43ddb536e6c3f8513213cd6eb2e890b73e26d5543c0ba1deb2690b5c0385b6, os = windows, severity = x86, creation_date = 2022-03-11, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = 829c827069846ba1e1378aba8ee6cdc801631d769dc3dce15ccaacd4068a88a6, id = f2a90d14-7212-41a5-a2cd-a6a6dedce96e, last_modified = 2022-04-12
Source: 00000001.00000000.357382208.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000001.00000000.357382208.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_f2a90d14 reference_sample = ed43ddb536e6c3f8513213cd6eb2e890b73e26d5543c0ba1deb2690b5c0385b6, os = windows, severity = x86, creation_date = 2022-03-11, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = 829c827069846ba1e1378aba8ee6cdc801631d769dc3dce15ccaacd4068a88a6, id = f2a90d14-7212-41a5-a2cd-a6a6dedce96e, last_modified = 2022-04-12
Source: 00000000.00000002.366653419.0000000003F6C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000000.00000002.366653419.0000000003F6C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_f2a90d14 reference_sample = ed43ddb536e6c3f8513213cd6eb2e890b73e26d5543c0ba1deb2690b5c0385b6, os = windows, severity = x86, creation_date = 2022-03-11, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = 829c827069846ba1e1378aba8ee6cdc801631d769dc3dce15ccaacd4068a88a6, id = f2a90d14-7212-41a5-a2cd-a6a6dedce96e, last_modified = 2022-04-12
Source: 00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 5996, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 3096, type: MEMORYSTR	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 3096, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_00FDC164	0_2_00FDC164
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_00FDE5B0	0_2_00FDE5B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_00FDE5A1	0_2_00FDE5A1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_02CD4948	0_2_02CD4948
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_02CD493B	0_2_02CD493B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_07610040	0_2_07610040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_07610006	0_2_07610006
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 1_2_01081970	1_2_01081970
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 1_2_0108B9F0	1_2_0108B9F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 1_2_01085FDC	1_2_01085FDC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 1_2_0108EBE0	1_2_0108EBE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 1_2_01088E31	1_2_01088E31
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 1_2_01083EF8	1_2_01083EF8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 1_2_02D247A0	1_2_02D247A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 1_2_02D23E58	1_2_02D23E58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 1_2_02D24710	1_2_02D24710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 1_2_02D24730	1_2_02D24730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 1_2_05F87538	1_2_05F87538
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 1_2_05F894F8	1_2_05F894F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 1_2_05F86920	1_2_05F86920
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 1_2_05F86C68	1_2_05F86C68
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 1_2_01080040	1_2_01080040

Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.366653419.0000000003F6C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCollins.dll8 vs SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.366653419.0000000003F6C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamejMwFIuasQmBRssQfxHWfZPad.exe4 vs SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000000.316326791.00000000006F2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameXanU.exeB vs SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.361380481.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePrecision.dll6 vs SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.361380481.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameInspector.dllN vs SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.361380481.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamejMwFIuasQmBRssQfxHWfZPad.exe4 vs SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.370119547.00000000073D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCollins.dll8 vs SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000000.357615147.0000000000438000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamejMwFIuasQmBRssQfxHWfZPad.exe4 vs SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.585579631.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Binary or memory string: OriginalFilenameXanU.exeB vs SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	ReversingLabs: Detection: 34%
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Virustotal: Detection: 27%

Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@1/0

Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000000.316326791.00000000006F2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: insert into User_Transportation(UserID,TransportationID) values (@UserID,@TransID);
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000000.316326791.00000000006F2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: insert into TourPlace(Name,Location,TicketPrice) values (@name,@location,@ticket);
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000000.316326791.00000000006F2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: insert into User_TourPlace(UserID,TourPlaceID) values (@UserID,@TourplaceID);
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.588624388.0000000003051000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	String found in binary or memory: AddUserButton'AddUserPhoneTextbox'AdduserEmailtextbox-Adduserpasswordtextbox
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	String found in binary or memory: Username:-AddusertextBoxUsernameCash

Source: 1.0.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.0.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_00FDF972 pushad ; iretd	0_2_00FDF979
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_02CD0365 push es; retf	0_2_02CD0366
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_02CDA319 push esi; iretd	0_2_02CDA31A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_02CDA31B push esi; iretd	0_2_02CDA322
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_02CDA0F9 push ebp; iretd	0_2_02CDA0FA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_02CDA188 push esi; iretd	0_2_02CDA18A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_02CDA18B push esi; iretd	0_2_02CDA192
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_02CDADEF pushad ; iretd	0_2_02CDADF2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_02CD5478 push ecx; retf	0_2_02CD5486
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_02CDF401 push ecx; ret	0_2_02CDF415
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_02CDBAE3 push 691402CFh; iretd	0_2_02CDBAEA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_02CD3A40 push ds; iretd	0_2_02CD3A42
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_02CD3A21 push ds; iretd	0_2_02CD3A22
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_02CD9E89 push eax; iretd	0_2_02CD9E8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_02CD9E90 push eax; iretd	0_2_02CD9E92
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_02CD9EB8 push esp; iretd	0_2_02CD9EBA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 0_2_02CD9EBB push esp; iretd	0_2_02CD9EC2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 1_2_0108DDF1 push FFFFFF83h; ret	1_2_0108DDF3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 1_2_0108D761 pushad ; iretd	1_2_0108D75D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 1_2_0108DEDF push FFFFFF83h; ret	1_2_0108DEE1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Code function: 1_2_0108D6E9 pushad ; iretd	1_2_0108D75D

Source: initial sample

Static PE information: section name: .text entropy: 7.661127653184342

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.2d5072c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.2d32f5c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.364684955.000000000300C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.361380481.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 5996, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.364684955.000000000300C000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.361380481.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.364684955.000000000300C000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.361380481.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe TID: 4528	Thread sleep time: -38122s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe TID: 4444	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe TID: 2248	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe TID: 2248	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe TID: 2492	Thread sleep count: 9856 > 30	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Window / User API: threadDelayed 9856

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Thread delayed: delay time: 38122	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.361380481.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.361380481.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.361380481.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.586019812.0000000001272000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.361380481.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Code function: 1_2_05F8C720 KiUserExceptionDispatcher,LdrInitializeThunk,KiUserExceptionDispatcher,

1_2_05F8C720

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Code function: 1_2_05F8516C GetUserNameW,

1_2_05F8516C

Stealing of Sensitive Information

Yara detected Telegram RAT

Source: Yara match	File source: 00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 5996, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 3096, type: MEMORYSTR

Yara detected AgentTesla

Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3feb360.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3f6cd88.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.357382208.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.366653419.0000000003F6C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 5996, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 3096, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Source: Yara match	File source: 00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 3096, type: MEMORYSTR

Remote Access Functionality

Yara detected Telegram RAT

Source: Yara match	File source: 00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 5996, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 3096, type: MEMORYSTR

Yara detected AgentTesla

Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.407e780.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3feb360.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.3f6cd88.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.357382208.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.366653419.0000000003F6C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 5996, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe PID: 3096, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	Path Interception	11 Process Injection	1 Masquerading	2 OS Credential Dumping	211 Security Software Discovery	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	1 Web Service	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	1 Credentials in Registry	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	Exfiltration Over Bluetooth	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	131 Virtualization/Sandbox Evasion	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Data from Local System	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	3 Software Packing	DCSync	114 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	34%	ReversingLabs	Win32.Trojan.AgentTesla
SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	28%	Virustotal		Browse
SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
1.0.SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.tiro.com8	0%	URL Reputation	safe
http://www.tiro.com8	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
https://api.telegram.org4	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://dv3SXfHRU1tFUjfcDW.net	0%	Avira URL Cloud	safe
http://UEYOBD.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.telegram.org	149.154.167.220	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.apache.org/licenses/LICENSE-2.0	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://DynDns.comDynDNS	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.588915905.0000000003098000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com8	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000003.325953219.00000000010EC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot5083863399:AAH9g72QTdN88jNOd6_tBrE8gEd-FpXnfHE/	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.366653419.0000000003F6C000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000000.357382208.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.tiro.com	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot5083863399:AAH9g72QTdN88jNOd6_tBrE8gEd-FpXnfHE/sendDocument	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.588915905.0000000003098000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot5083863399:AAH9g72QTdN88jNOd6_tBrE8gEd-FpXnfHE/sendDocumentdocument-----	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org4	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.588915905.0000000003098000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://dv3SXfHRU1tFUjfcDW.net	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.588649521.0000000003056000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://api.telegram.org	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.588988783.00000000030AD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.588915905.0000000003098000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.368884338.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000000.00000002.366653419.0000000003F6C000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000000.357382208.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://UEYOBD.com	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe, 00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	756005
Start date and time:	2022-11-29 13:49:17 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@1/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 97% Number of executed functions: 116 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:50:36	API Interceptor	630x Sleep call for process: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
api.telegram.org	scan Document_SA26844823746789e.PDF.html	Get hash	malicious	Browse	149.154.167.220
	Ziraat-bankasiSwiftMessaji2911202245344.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.Win32.PWSX-gen.7918.18477.exe	Get hash	malicious	Browse	149.154.167.220
	AWB DHL 7214306201 Shipment.pdf (432).exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.Win32.PWSX-gen.7585.24753.exe	Get hash	malicious	Browse	149.154.167.220
	IMG_2022028022-0120.vbs	Get hash	malicious	Browse	149.154.167.220
	hesaphareketi-01.pdf.exe	Get hash	malicious	Browse	149.154.167.220
	PO.exe	Get hash	malicious	Browse	149.154.167.220
	500 126.html	Get hash	malicious	Browse	149.154.167.220
	500 126.html	Get hash	malicious	Browse	149.154.167.220
	Carta de pago.exe	Get hash	malicious	Browse	149.154.167.220
	INVOICE SHIPPING-PACKING LIST.exe	Get hash	malicious	Browse	149.154.167.220
	FedEx Express AWB#53053232097Receipt.exe	Get hash	malicious	Browse	149.154.167.220
	Rfq#Specification.exe	Get hash	malicious	Browse	149.154.167.220
	SHIPPING INVOICE-PACKING LIST DOCS.exe	Get hash	malicious	Browse	149.154.167.220
	IMG_202202811-0443.vbs	Get hash	malicious	Browse	149.154.167.220
	hesaphareketi-01.exe	Get hash	malicious	Browse	149.154.167.220
	DHLDOCUMENTS27011222.exe	Get hash	malicious	Browse	149.154.167.220
	Halkbank.exe	Get hash	malicious	Browse	149.154.167.220
	Ziraat-bankasiSwiftMessaji2811202245678765.exe	Get hash	malicious	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.654515371669624
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe
File size:	943616
MD5:	d55d9c72b27c17af9a53847bec4dad00
SHA1:	dbfa157d95af9d351b7051802e5e80a0a78daa05
SHA256:	36143d6674053884d6bf2ce1e5bc8dd6f31b9d6b4d2fae272e37ac5649d00520
SHA512:	e4be587979e4d0496ccbfe158fb4577b0cbdc8b28b938575a513e852232a2e055ad99f2c731d2aa3efe2fb86f36a9b03ee61a556e389467d316adeb4f33f2413
SSDEEP:	12288:e2UqU+5xyB55eq8/XzIutu3GpEqqJCLkLdVBm9DuN3TnQT8QzDdzoa1cfN:RIe7/st3cEqqgkZ/mINj0rDdEPf
TLSH:	2A15DF8073A6AF75F52967F32422810827B63C2EA5F1D2296DDDF0DE2572B5109F0B27
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~..c..............0..^..........Z}... ........@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x4e7d5a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6385B67E [Tue Nov 29 07:36:30 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe7d08	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe8000	0x388	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xea000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xe5d60	0xe5e00	False	0.8267634414083741	data	7.661127653184342	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe8000	0x388	0x400	False	0.369140625	data	2.8500524693535905	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xea000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xe8058	0x32c	data

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.5149.154.167.220497094432851779 11/29/22-13:52:27.896928	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49709	443	192.168.2.5	149.154.167.220

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2022 13:52:27.724504948 CET	56751	53	192.168.2.5	8.8.8.8
Nov 29, 2022 13:52:27.741775990 CET	53	56751	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 29, 2022 13:52:27.724504948 CET	192.168.2.5	8.8.8.8	0x3a9	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 29, 2022 13:52:27.741775990 CET	8.8.8.8	192.168.2.5	0x3a9	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	13:50:22
Start date:	29/11/2022
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe
Imagebase:	0x6f0000
File size:	943616 bytes
MD5 hash:	D55D9C72B27C17AF9A53847BEC4DAD00
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.364684955.000000000300C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.366653419.0000000003F6C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.366653419.0000000003F6C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_AgentTesla_d3ac2b2f, Description: unknown, Source: 00000000.00000002.366653419.0000000003F6C000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_AgentTesla_f2a90d14, Description: unknown, Source: 00000000.00000002.366653419.0000000003F6C000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.361380481.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	13:50:41
Start date:	29/11/2022
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe
Imagebase:	0x980000
File size:	943616 bytes
MD5 hash:	D55D9C72B27C17AF9A53847BEC4DAD00
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000000.357382208.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000001.00000000.357382208.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_AgentTesla_d3ac2b2f, Description: unknown, Source: 00000001.00000000.357382208.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_AgentTesla_f2a90d14, Description: unknown, Source: 00000001.00000000.357382208.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AgentTeslaV3, Description: AgentTeslaV3 infostealer payload, Source: 00000001.00000002.586418495.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low

Show Windows behavior

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5%
Total number of Nodes:	222
Total number of Limit Nodes:	12

Executed Functions

Function 02CD4948 Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.361232665.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4805dae85b14c86f1c5fcd4a0f08f52079c9f8258a97c9b6152a0bd5cdfddd7
Instruction ID: 1d5fb7d3c12fb06aafe5a5dadfacaeac1742e5cbeffea47596c9af50484dcf26
Opcode Fuzzy Hash: b4805dae85b14c86f1c5fcd4a0f08f52079c9f8258a97c9b6152a0bd5cdfddd7
Instruction Fuzzy Hash: 1632C574A00218CFDB64DFA8C994B9DB7B2FF89300F1585A9D509AB365DB30AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02CD493B Relevance: .5, Instructions: 508COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.361232665.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a36fb9e855a3f2a37c8bda9266915679ad2c8963ce69144dae119bc3b40809c5
Instruction ID: 8a9a96dd238a3d0625f2b2a568e5ea977fe27128acc365fa6bad18d6c02313c6
Opcode Fuzzy Hash: a36fb9e855a3f2a37c8bda9266915679ad2c8963ce69144dae119bc3b40809c5
Instruction Fuzzy Hash: A432C574A00218CFDB64DFA8C994B9DB7B2FF89300F1585A9D509AB365DB30AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00FDB6C1 Relevance: 6.1, APIs: 4, Instructions: 124
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00FDB730
GetCurrentThread.KERNEL32 ref: 00FDB76D
GetCurrentProcess.KERNEL32 ref: 00FDB7AA
GetCurrentThreadId.KERNEL32 ref: 00FDB803

Memory Dump Source

Source File: 00000000.00000002.360006081.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 58867b8ed41ce173e3e2c36415a73bf9aaa9d963168c3fa7929de5307dad26e5
Instruction ID: a6febc4dcab8d580bb56206712d445b1e885ead28b49ab0315cb8ac63f31f225
Opcode Fuzzy Hash: 58867b8ed41ce173e3e2c36415a73bf9aaa9d963168c3fa7929de5307dad26e5
Instruction Fuzzy Hash: 6F5157B0D00249CFDB10CFA9D588BDEBBF2AF88314F24856AE409A7751D774A884CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00FDB6D0 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00FDB730
GetCurrentThread.KERNEL32 ref: 00FDB76D
GetCurrentProcess.KERNEL32 ref: 00FDB7AA
GetCurrentThreadId.KERNEL32 ref: 00FDB803

Memory Dump Source

Source File: 00000000.00000002.360006081.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a7b214252380348de7db505a9126a300a1003d96f6b8b533cb6cb5405ee5e9e5
Instruction ID: f8d4f39d4907f9b593da813d0f4cca9b92186e893c85f7515919708a117e7256
Opcode Fuzzy Hash: a7b214252380348de7db505a9126a300a1003d96f6b8b533cb6cb5405ee5e9e5
Instruction Fuzzy Hash: 7A5145B0D00249CFDB20CFA9D548BDEBBF2AF88314F24856AE409A7751D774A984CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00FDFD38 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00FDFE4A

Memory Dump Source

Source File: 00000000.00000002.360006081.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: cf59a12d01ef20250d13fd5236f9bff769b314588c5ab5addffafa228200dff1
Instruction ID: 7e97609ceb27777ad624b4226dc68b0a9904b1c882dbd7876b8fda06237d0e86
Opcode Fuzzy Hash: cf59a12d01ef20250d13fd5236f9bff769b314588c5ab5addffafa228200dff1
Instruction Fuzzy Hash: BF41B2B1D003099FDF14CF99C984ADEBBB6BF88314F24852AE819AB351D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00FDFD37 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00FDFE4A

Memory Dump Source

Source File: 00000000.00000002.360006081.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ba5617aed858854ba2da88c03d40f150dcef35ffa133c395a5070715f259f926
Instruction ID: 5013f4c63beee044e044f0e46dcd6b335f19cfd4ca8a2bf23e94ad499c14eec3
Opcode Fuzzy Hash: ba5617aed858854ba2da88c03d40f150dcef35ffa133c395a5070715f259f926
Instruction Fuzzy Hash: E741C2B1D003099FDF14CFA9C984ADEBBB2BF88314F24852AE419AB311D7749845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00FD5364 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00FD5421

Memory Dump Source

Source File: 00000000.00000002.360006081.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d288ddc75dc39ce4977c75f1868efaec11263be5ed51e39618c81a251c94a230
Instruction ID: b74c906246d470afcce6692311d1883aba565742009600777b442a09d89252e3
Opcode Fuzzy Hash: d288ddc75dc39ce4977c75f1868efaec11263be5ed51e39618c81a251c94a230
Instruction Fuzzy Hash: 96412471C00618CFDB20CFA9C9847DEBBB5BF49304F64816AD408AB351DB75598ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 00FD3DE4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00FD5421

Memory Dump Source

Source File: 00000000.00000002.360006081.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b809bbdc8c16ec74d7673971d92784adc2b1a6cf1d6cbebb68031ae25d877501
Instruction ID: 79beb3aef57cf0b0c98447c29d2f001d8f07e292df95e627d8cbd18dcf391481
Opcode Fuzzy Hash: b809bbdc8c16ec74d7673971d92784adc2b1a6cf1d6cbebb68031ae25d877501
Instruction Fuzzy Hash: 2B411471D00618CFDB20DFA9C9447DEBBB6BF49308F64816AD408AB351DBB16989CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02CD23B0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 02CD2471

Memory Dump Source

Source File: 00000000.00000002.361232665.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cd0000_SecuriteInfo.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 71db448ecb36e0da8970d16a3194b063ae97ca4da62d91adc156b0fb7d160265
Instruction ID: 996a56da76fa8efd9c076c0316f3f744af765bddf72e06c0156dcfa67044dffe
Opcode Fuzzy Hash: 71db448ecb36e0da8970d16a3194b063ae97ca4da62d91adc156b0fb7d160265
Instruction Fuzzy Hash: 1F413AB4A003058FCB14CF99C448BAABBF5FF88314F15C559E919AB321D774A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02CD0006 Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,?), ref: 02CD009D

Memory Dump Source

Source File: 00000000.00000002.361232665.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cd0000_SecuriteInfo.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 178bc5dea2ecc7be2dcf91ea7f73969308e2c42e47d978354e938fd02cec95bd
Instruction ID: 9603e184f86a5273a3b58dbbe28a298b594c91dc70fdf296dcb919d1c146ffa8
Opcode Fuzzy Hash: 178bc5dea2ecc7be2dcf91ea7f73969308e2c42e47d978354e938fd02cec95bd
Instruction Fuzzy Hash: 1421F2B08043888FDB12CFA9C4957EEBFF4EF4A320F05849AC844A7252C3786805CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FDB8F2 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00FDB97F

Memory Dump Source

Source File: 00000000.00000002.360006081.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fe2cc4d83ee99244a05eead7ba22cd24737d71fcadea9b07a3cd9c8d5ff84e81
Instruction ID: dd0ba4472686d6271a22e4704c69840e5947fcb786376baca7fae13090372b35
Opcode Fuzzy Hash: fe2cc4d83ee99244a05eead7ba22cd24737d71fcadea9b07a3cd9c8d5ff84e81
Instruction Fuzzy Hash: 5821F2B5900259DFCF10CF99D984ADEFBF5EB48320F14842AE914A7710D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FDB8F8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00FDB97F

Memory Dump Source

Source File: 00000000.00000002.360006081.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9ed44e206b10494f71fa9994e9f69ade1368015852a2a7512f05e87fb8f87d19
Instruction ID: 332b40aa8a66effa89f0d30e6fb525a49f7a820c50b2fc54dbb8ac8eb5ee1f24
Opcode Fuzzy Hash: 9ed44e206b10494f71fa9994e9f69ade1368015852a2a7512f05e87fb8f87d19
Instruction Fuzzy Hash: 1E21E2B5D002489FDF10CFAAD984ADEBBF9EB48324F14842AE914A7750D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FD9B30 Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00FD9991,00000800,00000000,00000000), ref: 00FD9BA2

Memory Dump Source

Source File: 00000000.00000002.360006081.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 02c4c43ed574f6f89ed8c6f9a1a90285f64cf9e7ac6f5f51db7ae9f08f4803ed
Instruction ID: dab577f1d5d694166e1744414c1484f2db860690cec5ab22b5745b114f79af7f
Opcode Fuzzy Hash: 02c4c43ed574f6f89ed8c6f9a1a90285f64cf9e7ac6f5f51db7ae9f08f4803ed
Instruction Fuzzy Hash: E42117B6D002098FDB20CF9AD444ADEFBF5EF88364F14842AD415A7700D3B5A949CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FD94B8 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00FD9991,00000800,00000000,00000000), ref: 00FD9BA2

Memory Dump Source

Source File: 00000000.00000002.360006081.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9d6f8621085e5007f8d03434d48a63831ae608698ff82ff244340ea19c1271c3
Instruction ID: 0ae05228aa76aa832d91b04c12860147ffc903d501114da7824208531a4abc27
Opcode Fuzzy Hash: 9d6f8621085e5007f8d03434d48a63831ae608698ff82ff244340ea19c1271c3
Instruction Fuzzy Hash: 8D1103B69042488FCB20CF9AD444ADEFBF5AB88324F15842AD819A7700C3B5A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FD98A8 Relevance: 1.6, APIs: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00FD9916

Memory Dump Source

Source File: 00000000.00000002.360006081.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ba45ee652c17a5692a768e7125394f707f2dd49538b2097e6e7f22e8ab5edcda
Instruction ID: 25993bac1db8a99bdc15fcdc0bc1907fefd98c7bd1c34157e8761e7b663e08c6
Opcode Fuzzy Hash: ba45ee652c17a5692a768e7125394f707f2dd49538b2097e6e7f22e8ab5edcda
Instruction Fuzzy Hash: CC11F3B6D002498FCB20CF9AC484ADEFBF5EF89324F14856AD459A7700D375A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FD98B0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00FD9916

Memory Dump Source

Source File: 00000000.00000002.360006081.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8a39fea31733971f97ff791605ab15bfc9aa111ba758deefe4183a9198fb199d
Instruction ID: 17f95bcf1f4b0329234da1c0bceea2f1d5b9ff9be3933cea756697bd350dd015
Opcode Fuzzy Hash: 8a39fea31733971f97ff791605ab15bfc9aa111ba758deefe4183a9198fb199d
Instruction Fuzzy Hash: 891102B6D002498FCB20CF9AC444ADEFBF5EB89324F14842AD419B7700C3B4A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02CD0040 Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,?), ref: 02CD009D

Memory Dump Source

Source File: 00000000.00000002.361232665.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cd0000_SecuriteInfo.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: a091f2d9fdb650957df36b85a4f3515c31912a50bd50d923350c013a3a4a1155
Instruction ID: 4d61bbe9207781029c0afe6cf0e67d2bd0457cbfc7244f32d35c5c82851ddd15
Opcode Fuzzy Hash: a091f2d9fdb650957df36b85a4f3515c31912a50bd50d923350c013a3a4a1155
Instruction Fuzzy Hash: 6C11E2B59002499FDB20DF9AD585BEFBBF8EB88324F14841AD915A7740C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 076183D8 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 07618435

Memory Dump Source

Source File: 00000000.00000002.370826515.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_SecuriteInfo.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: c6b4dc1a76fdf9b6d4d3aedbadfaee534827c0fec122565db2777976db56e29e
Instruction ID: 0d325e416e6ce87acb12cae48869a04c6e5d09b65cfcc38d590465f9dcaa2113
Opcode Fuzzy Hash: c6b4dc1a76fdf9b6d4d3aedbadfaee534827c0fec122565db2777976db56e29e
Instruction Fuzzy Hash: F811E5B58003499FDB20CF99D585BDEBBF8EB48324F148819D855A7700C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07610040 Relevance: 2.6, Strings: 2, Instructions: 98COMMON

Download Yara Rule

Strings

~, xrefs: 07610142
K, xrefs: 07614D0A

Memory Dump Source

Source File: 00000000.00000002.370826515.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: K$~
API String ID: 0-3319465646
Opcode ID: 82b7f09dd74453c2abf279ea175ccbb6c3dada2990b7abf2d1ab241e62ca290b
Instruction ID: 47267fbd7cb25617090330107e1217bea8117ec65474ed9b0bf6ff3e9b4a7fbb
Opcode Fuzzy Hash: 82b7f09dd74453c2abf279ea175ccbb6c3dada2990b7abf2d1ab241e62ca290b
Instruction Fuzzy Hash: 794144B1D05A588BEB5CCF6B8C4529AFAF7BFC9301F18C1B9880DA6254EB3405868F11

Uniqueness

Uniqueness Score: -1.00%

Function 07610006 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

~, xrefs: 07610142

Memory Dump Source

Source File: 00000000.00000002.370826515.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ~
API String ID: 0-1707062198
Opcode ID: add2661952ea191820e312d30898f86bd6c36f19d415c5095340f69c5f9bcf94
Instruction ID: 594ff592a3097c9b0a784a00bbe823ed6be8b5b44100960789fd8167e33e141c
Opcode Fuzzy Hash: add2661952ea191820e312d30898f86bd6c36f19d415c5095340f69c5f9bcf94
Instruction Fuzzy Hash: A4419171D05B588FEB59CF678D0128AFAF3AFC9211F18C1B6C44CAA265EB3405468F11

Uniqueness

Uniqueness Score: -1.00%

Function 00FDE5B0 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.360006081.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26218f9456e0d4d6f5592370e9b3409717452008e40dc00853b4231f60ddf75b
Instruction ID: 90f03347412173a97cbc348c0921ef06da075e79464c42f531793243443b2e52
Opcode Fuzzy Hash: 26218f9456e0d4d6f5592370e9b3409717452008e40dc00853b4231f60ddf75b
Instruction Fuzzy Hash: A312C3F1CE17468AD330CF65E9881893BB1F7C53A8BD04A19D2716BAD4D7B811AACF44

Uniqueness

Uniqueness Score: -1.00%

Function 00FDC164 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.360006081.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0c58f75f94544b3dcbc2cc4b4391d022fec2cd165212b8a025afd5fa67d0287
Instruction ID: d91a1ba42ab094ede0a5c9893fba2de5d14f5df30f39c4bc2a4894684007149b
Opcode Fuzzy Hash: c0c58f75f94544b3dcbc2cc4b4391d022fec2cd165212b8a025afd5fa67d0287
Instruction Fuzzy Hash: 32A16E32E0021A8FCF05DFA5C8445DEBBB3FF85311B19856AE805BB361EB35A955DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00FDE5A1 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.360006081.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6800aba940686b4037eb2f8108b65dbdc1bbcf3fef9af52c7b5bf93f45d9f93
Instruction ID: a6f24b0d76fb6c371a86ececa110e17d8c847ea090095e996f1e2a582a359abf
Opcode Fuzzy Hash: c6800aba940686b4037eb2f8108b65dbdc1bbcf3fef9af52c7b5bf93f45d9f93
Instruction Fuzzy Hash: C1C136F1CE17468BD320CF65E9881893B71FBC53A8FD04A19D2616B6D4D7B811AACF84

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exePID: 3096, Parent PID: 5996COMMON

Execution Graph

Execution Coverage:	22.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	86
Total number of Limit Nodes:	5

Executed Functions

Function 05F8C720 Relevance: 5.5, APIs: 3, Instructions: 963
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 05F8C870
LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 2a5f0e635ad4846e32e4e9bb9871d70921ed2fb2cc8a543fafd3d493c2a6fc7a
Instruction ID: 5a05be9e2b55ddb4f141c59aad8017dcc30468e06af4d981c4598b9fb21048af
Opcode Fuzzy Hash: 2a5f0e635ad4846e32e4e9bb9871d70921ed2fb2cc8a543fafd3d493c2a6fc7a
Instruction Fuzzy Hash: 80A23AB4A05228CFCB24EF30D9596ADB7B6BF49305F1080E9E54AA3344DB399E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 01083EF8 Relevance: 5.4, Strings: 4, Instructions: 404
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\, xrefs: 01084136
\, xrefs: 010840FB
\, xrefs: 01083F71
\, xrefs: 01084041

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: \$\$\$\
API String ID: 0-3238275731
Opcode ID: 0deb9686da4cc4f290a3530982c7516b5dc2f31614f2112a1850e314e38a314e
Instruction ID: b2e8d2a1e4f58237a06b5da248cf23983133677deef2528bf44c773083cc59c0
Opcode Fuzzy Hash: 0deb9686da4cc4f290a3530982c7516b5dc2f31614f2112a1850e314e38a314e
Instruction Fuzzy Hash: D7E1FF31B042158BCB24EF78C8457AEBAF2AFC4354F148569E496DB384EF79DC068B90

Uniqueness

Uniqueness Score: -1.00%

Function 01081970 Relevance: 1.7, Instructions: 1734COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5711465240ca4d26653dd75b91e52043fe989b968d7f94c4e4e5d4f9e8693a7d
Instruction ID: c7de01c040f6b13984c8c76212046dc9b4c27dc9e8331cb128022eeb07c9b827
Opcode Fuzzy Hash: 5711465240ca4d26653dd75b91e52043fe989b968d7f94c4e4e5d4f9e8693a7d
Instruction Fuzzy Hash: FCE2E134B083448FDB56AB74C85876D7BF2AF85304F1584AAE489DB396DB38DC06CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05F8516C Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 05F8B63B

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 91e69657937236679fdc0d1ebd231fb595bd6464fc1814d4fa1edc2530b6677a
Instruction ID: caf8666dc28c595dc83fcb3e28b8c6fec685aebd4f1870f6a1c287c2645c1afe
Opcode Fuzzy Hash: 91e69657937236679fdc0d1ebd231fb595bd6464fc1814d4fa1edc2530b6677a
Instruction Fuzzy Hash: DD514571D102188FDB14DFA9C889BAEFBB1BF48314F148029E816BB394D778A844CF94

Uniqueness

Uniqueness Score: -1.00%

Function 01080040 Relevance: 1.1, Instructions: 1102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2255ac3cf27f0c9da971ff1099f690f0e22c642d7b8ff21736f4714a02521455
Instruction ID: 2b54571ddc0d2618d856cf55b1bb4a80feeee77cb2c800138ee4d7713070e034
Opcode Fuzzy Hash: 2255ac3cf27f0c9da971ff1099f690f0e22c642d7b8ff21736f4714a02521455
Instruction Fuzzy Hash: 0E926D74F002148FDB64EF78C8587AEBAF2AF85354F1084A8E44AAB384DF799D458F51

Uniqueness

Uniqueness Score: -1.00%

Function 0108B9F0 Relevance: 1.0, Instructions: 1032COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a59852d6315ebee3cb12121b33d7b163c424dfd33bb4eca7d96aa1ad96663ab
Instruction ID: 0947368f4cc56935c8f4bb956aac1f39902606a96383c94a92a4e38ea2c4d4d1
Opcode Fuzzy Hash: 4a59852d6315ebee3cb12121b33d7b163c424dfd33bb4eca7d96aa1ad96663ab
Instruction Fuzzy Hash: 4E72E430B042049FEB25EB68C9547EEBBF2AF85314F148469E1CADB395CB74DC468B61

Uniqueness

Uniqueness Score: -1.00%

Function 01085FDC Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8912b753f477478e55209f2f4d03baa0515191648adc7322cb71f9fc2e8aec5
Instruction ID: f4b3a68126e9b88792a334d0a66b2046fd4ede645fbf065d5c69f4101baabbba
Opcode Fuzzy Hash: f8912b753f477478e55209f2f4d03baa0515191648adc7322cb71f9fc2e8aec5
Instruction Fuzzy Hash: 5A42D470A042448FDB64EFA8C4547AEBBF2AF85304F1581A9D0899F386DF7ADC49CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0108EBE0 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 276ca8465285599001e5329eed5d63ad13d1fcc9af8c657d2894b193ca184dd2
Instruction ID: fa1e92264f7739b991d1898004c1eaf3d6c2e8c4b0c249692dbaf49e1a972c2f
Opcode Fuzzy Hash: 276ca8465285599001e5329eed5d63ad13d1fcc9af8c657d2894b193ca184dd2
Instruction Fuzzy Hash: E3D1B230B002155FD764AF7888587AFBAE3EFC4754F148868E48A9B784DF799C068B91

Uniqueness

Uniqueness Score: -1.00%

Function 01088E31 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68480e40d441542f9c272cb4db192a95de23db59e570d113f1b6e78f9cd24b68
Instruction ID: df7631d1b2944ead2784f6140bf84b6b8540130d1d30d51bc1453a934b671eec
Opcode Fuzzy Hash: 68480e40d441542f9c272cb4db192a95de23db59e570d113f1b6e78f9cd24b68
Instruction Fuzzy Hash: 9CC1E630B042148FDB64BB78C8587BEBAE3AFC5358F148479D4899B395DF798C458B82

Uniqueness

Uniqueness Score: -1.00%

Function 02D26B1F Relevance: 6.1, APIs: 4, Instructions: 137
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02D26BB0
GetCurrentThread.KERNEL32 ref: 02D26BED
GetCurrentProcess.KERNEL32 ref: 02D26C2A
GetCurrentThreadId.KERNEL32 ref: 02D26C83

Memory Dump Source

Source File: 00000001.00000002.586354636.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2d20000_SecuriteInfo.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b9d90dcec53a57dd8be407db8238ef867339820f455f5953a103a226652a114a
Instruction ID: 2b2eb222e27e500319112de627fa88c7e1a2f08adec5f4b3df75073723e43a20
Opcode Fuzzy Hash: b9d90dcec53a57dd8be407db8238ef867339820f455f5953a103a226652a114a
Instruction Fuzzy Hash: 1D5177B09003488FCB10CFA9DA487DEBFF1AF59318F248499E448A7791D774A848CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D26B50 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02D26BB0
GetCurrentThread.KERNEL32 ref: 02D26BED
GetCurrentProcess.KERNEL32 ref: 02D26C2A
GetCurrentThreadId.KERNEL32 ref: 02D26C83

Memory Dump Source

Source File: 00000001.00000002.586354636.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2d20000_SecuriteInfo.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 56de5835eb5b0065fe575303fb0d691ef61a3284c2c15ff3fe0e36b81c1307b6
Instruction ID: 775cdc0fe5d5bb79c36cb86590258e2f83869ceb972488b53f8b0a1e73b8f4c0
Opcode Fuzzy Hash: 56de5835eb5b0065fe575303fb0d691ef61a3284c2c15ff3fe0e36b81c1307b6
Instruction Fuzzy Hash: D85134B4A003488FDB24DFA9D6487DEBBF5EF58318F208459E409A7750D774A888CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05F8C741 Relevance: 5.1, APIs: 3, Instructions: 635
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 05F8C870
LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: c46d8444eb7472945fd5ec32590714f8a3f2aed6f9d7fa6e2782c4bf4e97281c
Instruction ID: 81ab9419c0b08d21b0a7817bd89b9267e9f59184a1b1dd07adf4e02dbc941a72
Opcode Fuzzy Hash: c46d8444eb7472945fd5ec32590714f8a3f2aed6f9d7fa6e2782c4bf4e97281c
Instruction Fuzzy Hash: EC624AB5905228CFCB24EF30D9996ADB7B6BF49345F1080EAE54A93340DB399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05F8C77D Relevance: 5.1, APIs: 3, Instructions: 630
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 05F8C870
LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 20e3491f3c46da9abb3c057c0581d3fdbbdf0b188182f2817a1f5575483a8db5
Instruction ID: 67b0c6fa7e92692819d6fc0452284841e5eb90183bef15049d03e6473b20ae30
Opcode Fuzzy Hash: 20e3491f3c46da9abb3c057c0581d3fdbbdf0b188182f2817a1f5575483a8db5
Instruction Fuzzy Hash: CC624BB5905228CFCB24EF30D9996ADB7B6BF49345F1080EAE54993340DB399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05F8C7C2 Relevance: 5.1, APIs: 3, Instructions: 623
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 05F8C870
LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: ab721266d166f02cb2d5e1be7794bb5ab65cb4d94382fb283c4fffd5773e64be
Instruction ID: c51fdb889227cfcc654a2ce29c48d5c3e379f838db4f96b3b4578e15fbfe4d1c
Opcode Fuzzy Hash: ab721266d166f02cb2d5e1be7794bb5ab65cb4d94382fb283c4fffd5773e64be
Instruction Fuzzy Hash: 6F524BB5905228CFCB24EF30D9996ADB7B6BF49345F1080EAE54993340DB399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05F8C84C Relevance: 5.1, APIs: 3, Instructions: 609
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 05F8C870
LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: e4e1536682afaf7c35ad6f9c42f54e99f335e570b95cedbf185c0805d0915e99
Instruction ID: 261d4eb9f4fba8be50de8d04b22d61bfa91f6f46c3dc76831699db80ee2d48af
Opcode Fuzzy Hash: e4e1536682afaf7c35ad6f9c42f54e99f335e570b95cedbf185c0805d0915e99
Instruction Fuzzy Hash: D3524BB5A05228CFCB24EF30D9996ADB7B6BF49345F1080EAE54993344DB398E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05F8C891 Relevance: 3.6, APIs: 2, Instructions: 602
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: e63c1c416f075101e4db71dd6f6f29b44f061ed2f1d16d998cc8bedfbfa5e366
Instruction ID: 34c9cce6cb911fd9eb263f45ea2e15210a4994fce62f5bd72f95172ce40b5e26
Opcode Fuzzy Hash: e63c1c416f075101e4db71dd6f6f29b44f061ed2f1d16d998cc8bedfbfa5e366
Instruction Fuzzy Hash: 90524BB5A05218CFCB24EF30D9996ADB7B6BF49345F1080EAE54993344DB398E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05F8C8D6 Relevance: 3.6, APIs: 2, Instructions: 595
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: cd56493255693c645d6295659269123a34cd1e9d66c05ff8affba00dda7a30e8
Instruction ID: e984d0a497b2a8f064bb6c5fe2658140aeb55a386aae2ca6aad03d1a017da7f8
Opcode Fuzzy Hash: cd56493255693c645d6295659269123a34cd1e9d66c05ff8affba00dda7a30e8
Instruction Fuzzy Hash: 6F525BB5A05228CFCB24EF30D9996ADB7B6BF49345F1080EAE54993344DB398E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05F8C931 Relevance: 3.6, APIs: 2, Instructions: 584
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 1c37092c79288cd948e46cd767d5d05130770ef3a3d707be58a078235d16358d
Instruction ID: 5502a65739f909834088e320f4b6aefc09c547be2ce43d8d15f09b90067d037a
Opcode Fuzzy Hash: 1c37092c79288cd948e46cd767d5d05130770ef3a3d707be58a078235d16358d
Instruction Fuzzy Hash: A7525BB5A05228CFCB24EF30D9996ADB7B6BF49345F1080EAE54993344DB398E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05F8C976 Relevance: 3.6, APIs: 2, Instructions: 575
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 755f6aaad09f62031ea747276e99b2b8344dcb2aad2f5816a326ec1d5ef7c3c3
Instruction ID: 6cb24834bebc2d0966c06eb7b6b840075f0f65a135aabc1b9dd3e61968896c69
Opcode Fuzzy Hash: 755f6aaad09f62031ea747276e99b2b8344dcb2aad2f5816a326ec1d5ef7c3c3
Instruction Fuzzy Hash: 2F424BB5A05228CFCB24EF30D9996ADB7B6BF49345F1080EAE54993344DB398E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05F8C9B2 Relevance: 3.6, APIs: 2, Instructions: 570
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 552e55fecbb2ba04e5546ce8d712f9353d09a1da7cc2aecc2264cccde0c494ff
Instruction ID: ed1c56a3fa2d6a5cfd1022bc98a7aee2aba5e43a0bf597c9e058f7fc5cb471e7
Opcode Fuzzy Hash: 552e55fecbb2ba04e5546ce8d712f9353d09a1da7cc2aecc2264cccde0c494ff
Instruction Fuzzy Hash: 13425CB5A05218CFCB24EF30D9596ADB7B6BF49345F1080EAE54993344DB398E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05F8C9F7 Relevance: 3.6, APIs: 2, Instructions: 563
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: e05ad1ba0ed1f331f36cbc93fc8d005cc72bb88ca7ca4b4313923ca6241c67f2
Instruction ID: 3ab6077f917ee09a2b7f36587b77f222bbd6423f116cad7f8652437038abd78f
Opcode Fuzzy Hash: e05ad1ba0ed1f331f36cbc93fc8d005cc72bb88ca7ca4b4313923ca6241c67f2
Instruction Fuzzy Hash: 2D425CB5A05228CFCB24EF30D9996ADB7B6BF49345F1080EAE54993344DB398E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05F8CC40 Relevance: 3.5, APIs: 2, Instructions: 500
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: a27e6b963b7db3d58a2915e50d76b393bd1d7e0d2317f8738d4eb0c3084edaf4
Instruction ID: 6c8ca836cd076a3f4d4b188009a84fbbf69d5324bc64165593a1b7ba23a5895d
Opcode Fuzzy Hash: a27e6b963b7db3d58a2915e50d76b393bd1d7e0d2317f8738d4eb0c3084edaf4
Instruction Fuzzy Hash: 79323BB5A05228CFCB24EF30D9996ADB7B6BF48305F1084E9E54993344DB399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05F8CC85 Relevance: 3.5, APIs: 2, Instructions: 493libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: e8b46185d5045677f2a00a872a1e19a718558aeee69ce231c2c6654cb1753d0a
Instruction ID: 93e93b04918e8f490a00210e394ac96a70931534bedaa12d72e7b0b679ef4c0a
Opcode Fuzzy Hash: e8b46185d5045677f2a00a872a1e19a718558aeee69ce231c2c6654cb1753d0a
Instruction Fuzzy Hash: BF323AB5A05228CFCB24EF30D9996ADB7B6BF48305F1084E9E54A93344DB399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05F8CCCA Relevance: 3.5, APIs: 2, Instructions: 486libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: cdf651e766121ebc81e620dfa31df6f16ad914f827707e9794b9f97e00e04193
Instruction ID: f276f435142660d70f7011d359512c9405dfc4ba243e6f8b5f87977914dcc4eb
Opcode Fuzzy Hash: cdf651e766121ebc81e620dfa31df6f16ad914f827707e9794b9f97e00e04193
Instruction Fuzzy Hash: F0323AB5A05228CFCB24EF30D9596ADB7B6BF48305F2084E9E54993344DB399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05F8CD0F Relevance: 3.5, APIs: 2, Instructions: 479libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 6f11e0ee8efcc3f44ed07893454464bf8f803d31795178d654188ff5efb34f66
Instruction ID: 8de520f3c684e3a0be9c583c545a27cb156d9e930bf0ffb34590cb25f8f5d951
Opcode Fuzzy Hash: 6f11e0ee8efcc3f44ed07893454464bf8f803d31795178d654188ff5efb34f66
Instruction Fuzzy Hash: E62239B5A05228CFCB24EF30D9996ADB7B6BF48305F1084E9E54A93344DB399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05F8CD54 Relevance: 3.5, APIs: 2, Instructions: 472libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 112ecac19c3f017929951aef0416346c71aad13a19b24c08b9cdd687d7f217f1
Instruction ID: a2836773ba3825055e786e4710ac81173f7c359290fbebaea66df3ef1492f3f8
Opcode Fuzzy Hash: 112ecac19c3f017929951aef0416346c71aad13a19b24c08b9cdd687d7f217f1
Instruction Fuzzy Hash: 852239B5A05228CFCB24EF30D9996ADB7B6BF48305F1084E9E54A93344DB399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05F8CD99 Relevance: 3.5, APIs: 2, Instructions: 465libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 23b4a2f4b28ee0b13cc3e3ef34bbb2d1558779633e8507dae5fd5af2ab7d58d4
Instruction ID: db2fa4a705efb444341bb06f904bb30187b8ca01294d3729293260a3b177cb1f
Opcode Fuzzy Hash: 23b4a2f4b28ee0b13cc3e3ef34bbb2d1558779633e8507dae5fd5af2ab7d58d4
Instruction Fuzzy Hash: D12239B0A05228CFCB24EF30D9996ADB7B6BF48305F1084E9E54A93344DB398E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05F8CDDE Relevance: 3.5, APIs: 2, Instructions: 458libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 9b408ed91d8d01970d5f766e4091c99973fc393a1b087a5fd9bd6e0962f42cc1
Instruction ID: bb582924904bbd202e1d851be424b3df1242e86e46bab01160acdc982257e517
Opcode Fuzzy Hash: 9b408ed91d8d01970d5f766e4091c99973fc393a1b087a5fd9bd6e0962f42cc1
Instruction Fuzzy Hash: 15223AB5A05228CFCB24EF30D9596ADB7B6BF48305F2084E9E54A93344DB399E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05F8CE23 Relevance: 3.5, APIs: 2, Instructions: 451libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: d110d5d0e6f40a381f4870ac9e3224ae210897fed7a7fe0e54c123c247efa46c
Instruction ID: ec0473193a23c6a6684696badf695cf1487d2a32f414112ea6c79e8f02344a29
Opcode Fuzzy Hash: d110d5d0e6f40a381f4870ac9e3224ae210897fed7a7fe0e54c123c247efa46c
Instruction Fuzzy Hash: DC2239B5A05228CFCB24EF30D9596ADB7B6BF48305F1084E9E54A93344DB398E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05F8CE68 Relevance: 3.4, APIs: 2, Instructions: 444libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: b675f549a80155c4355de0eaf26778b3e736494ee08826993b82509a43582ade
Instruction ID: f353f87b9bfcc33dcd0b54da9471ef09d4a9a9df3fececcd11c34b5f9a577c5e
Opcode Fuzzy Hash: b675f549a80155c4355de0eaf26778b3e736494ee08826993b82509a43582ade
Instruction Fuzzy Hash: CC1238B5A05228CFCB24EF30D9996ADB7B6BF48305F1084E9E54A93344DB398E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05F8CEAD Relevance: 3.4, APIs: 2, Instructions: 437libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 03a00cba913ea2830cfa211de2aec9b6aec22b6ec53d5d8ba9d0ad2ffa9673b9
Instruction ID: 47d17005efa840b07b32903c2ad5366786b2ff2c7417885d77236f92d697b437
Opcode Fuzzy Hash: 03a00cba913ea2830cfa211de2aec9b6aec22b6ec53d5d8ba9d0ad2ffa9673b9
Instruction Fuzzy Hash: DB1238B1A052288FCB24EF30D9996ADB7B6BF48305F1084E9E54A93344DB398E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05F8CEF5 Relevance: 3.4, APIs: 2, Instructions: 428libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 3cc2e12066e9ceafab9fc16a982eeedc8663c9feb5e2f61699d03894facbae41
Instruction ID: 485ac6209558156d2d959063ad97cea6cead854032b6e8722e5728b3a2a09139
Opcode Fuzzy Hash: 3cc2e12066e9ceafab9fc16a982eeedc8663c9feb5e2f61699d03894facbae41
Instruction Fuzzy Hash: E51237B5A052288FCB24EF30D9597ADB7B6AF48305F2084E9E54A93344DF398E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 05F8CF31 Relevance: 3.4, APIs: 2, Instructions: 423libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: f09a21465b19837889eb1aa112cff12d262db0a27d4f66f72561b972655efec7
Instruction ID: d6c8b927d8fa498ce308a3c4f90902753d8db118ca7f7e80d3812cfc2eac2433
Opcode Fuzzy Hash: f09a21465b19837889eb1aa112cff12d262db0a27d4f66f72561b972655efec7
Instruction Fuzzy Hash: E51227B5A052288FCB24EF30D9597ADB7B6AF48305F2084E9E54A93344DF399E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05F8CF79 Relevance: 3.4, APIs: 2, Instructions: 416libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05F8D0CB
KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 2a5d27b0d0c72d3a4f66f72c2c12ead37fa12e59db06db99deab5cb0a1214b6c
Instruction ID: f237df76dab7460da11201b2da5316399e806209a1543e1041b8d1ba80f81027
Opcode Fuzzy Hash: 2a5d27b0d0c72d3a4f66f72c2c12ead37fa12e59db06db99deab5cb0a1214b6c
Instruction Fuzzy Hash: 421226B5A052288FCB24EF30D9597ADB7B6AF48205F2084E9E54A93344DF398E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 05F8D42C Relevance: 1.7, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8f5195f3f65402ffa62d7ffb5963d4ef2c92874461a85e123bfb2c16c42a6cae
Instruction ID: 18b5551f9513a4dd0e510cacb9da86492afe30fdefd5a2bcd4bbf4c3c253be0b
Opcode Fuzzy Hash: 8f5195f3f65402ffa62d7ffb5963d4ef2c92874461a85e123bfb2c16c42a6cae
Instruction Fuzzy Hash: F4B139B5A05218CBCB24EF30C9997ADB7B6BF48305F1084E9E50993340DB399E85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 05F8D474 Relevance: 1.7, APIs: 1, Instructions: 237COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 2315edbb3fa09f5fd3b9d8a0b8b977cda64acda05761acbf5792d41e41c1ac68
Instruction ID: 98ce41585263f5dbba558ceb970fa5fa4c933172886ad2fe454f650226361c46
Opcode Fuzzy Hash: 2315edbb3fa09f5fd3b9d8a0b8b977cda64acda05761acbf5792d41e41c1ac68
Instruction Fuzzy Hash: ABB13AB1A05218CBCB24EF30D9997ADB7B6BF48345F2084E9E50993340DB399E85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 05F8D4BC Relevance: 1.7, APIs: 1, Instructions: 230COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 43b189add8bd145a568677173bc03515bb334f01495a4e54ffd8273aa19b3c6a
Instruction ID: 0b1c234ba1c92f83b99f46ef69ffec1372ed6fbab68382f14bde3fca0784ba34
Opcode Fuzzy Hash: 43b189add8bd145a568677173bc03515bb334f01495a4e54ffd8273aa19b3c6a
Instruction Fuzzy Hash: 85A12AB1A05218CBCB24EF30D9997ADB7B6BF48205F5084E9E50993340DF399E85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 05F8D504 Relevance: 1.7, APIs: 1, Instructions: 223COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 54292e16dfe559586d472795599b7ab3738b710ded6b49fca99a5283c0f7e69c
Instruction ID: ec2f83f8b0329001daec5a161a324ad935aae8d6722a339524c319ccc9ab6336
Opcode Fuzzy Hash: 54292e16dfe559586d472795599b7ab3738b710ded6b49fca99a5283c0f7e69c
Instruction Fuzzy Hash: 06A13BB1A05228CBCB24EF30D9997ADB7B6BF48205F5084E9E50993340DF399E85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 05F8D54C Relevance: 1.7, APIs: 1, Instructions: 216COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 64e9b3e7a6c581260b4ad50e2d2e85629c7271aac1936936034cac2e67f61cf2
Instruction ID: 7a9b2a35e5e83671baa03cf32689305566882800caa63a5290dcd30e01486199
Opcode Fuzzy Hash: 64e9b3e7a6c581260b4ad50e2d2e85629c7271aac1936936034cac2e67f61cf2
Instruction Fuzzy Hash: C2913AB1A05228CBCB24EF30D99976DB7B6BF88205F5084E9E50993340DF399E85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 05F8D594 Relevance: 1.7, APIs: 1, Instructions: 209COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05F8D5BB

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: fac112a86495d13198e6d85d603af226401a962c0aadc43c1ba8fb267d0183f3
Instruction ID: 0c0f824a3825a1c994f128db5adb1494ee8fa8ecbf456aa8c1ffed184c576684
Opcode Fuzzy Hash: fac112a86495d13198e6d85d603af226401a962c0aadc43c1ba8fb267d0183f3
Instruction Fuzzy Hash: D4914CB5A05218CBCB24EF30C9997ADB7B6BF88205F6084E9E54993340DF389E85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 05F8B4F4 Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 05F8B63B

Memory Dump Source

Source File: 00000001.00000002.591705513.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5f80000_SecuriteInfo.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: b211666158f392226c44e20147b75406c84b9e254c36528d9d3775fcd3e4fd3a
Instruction ID: 40cc7935649c12b4308debfe0c09852bf39abc8abfa0b22f4d299431c37b710f
Opcode Fuzzy Hash: b211666158f392226c44e20147b75406c84b9e254c36528d9d3775fcd3e4fd3a
Instruction Fuzzy Hash: 6F5144B1D102188FDB14DFA9C899BEDBBB1BF48314F14846AE816BB394D7789844CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02D25184 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02D252A2

Memory Dump Source

Source File: 00000001.00000002.586354636.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2d20000_SecuriteInfo.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ecb49f6566cfaae23a3d2b0f3dade34baa62c498c12ce11bf602c56722e1866a
Instruction ID: 594bbd6b06bdaa2d3cc8b4acf5936718d07a5ecfd3669c8c61d821397e25e511
Opcode Fuzzy Hash: ecb49f6566cfaae23a3d2b0f3dade34baa62c498c12ce11bf602c56722e1866a
Instruction Fuzzy Hash: F65100B1D103189FDF14CFAAD984ADEBBB1BF58314F64812AE819AB350D774A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02D25190 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02D252A2

Memory Dump Source

Source File: 00000001.00000002.586354636.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2d20000_SecuriteInfo.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 21dbbcf4a41934b726e9d7613661f7f92b78dcb62505c08fefe8fdc62a393797
Instruction ID: 720be197d943bb086382c5b8858acf24893d9aac24e4b6b0add0cce1112669d1
Opcode Fuzzy Hash: 21dbbcf4a41934b726e9d7613661f7f92b78dcb62505c08fefe8fdc62a393797
Instruction Fuzzy Hash: E541F1B1D103189FDF14CF99D984ADEBBB5BF48314F64812AE819AB350D774A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02D26964 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 02D27D01

Memory Dump Source

Source File: 00000001.00000002.586354636.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2d20000_SecuriteInfo.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: dcd326abaa1deafc973a276195e61546625f6e65a218f3626b7f601077f6a516
Instruction ID: 927a77461ed928ae016f3550ff5c55bbcee009974a0eabdb2098df23848de77b
Opcode Fuzzy Hash: dcd326abaa1deafc973a276195e61546625f6e65a218f3626b7f601077f6a516
Instruction Fuzzy Hash: C7414AB5A00215DFDB24CF99C488AAAFBF5FF88318F148458E419AB361C774A845CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D2C3B9 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 02D2C442

Memory Dump Source

Source File: 00000001.00000002.586354636.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2d20000_SecuriteInfo.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: d2d484ee12f2ccf4a7d07e1707fcdbed9edc2cbfd4068010637c52dd698c0bda
Instruction ID: cd94481b16cd094637cfd4e6f8f44a9190fa167e4b403a60ce5253cafb19510b
Opcode Fuzzy Hash: d2d484ee12f2ccf4a7d07e1707fcdbed9edc2cbfd4068010637c52dd698c0bda
Instruction Fuzzy Hash: 6D31AF758153448FDB10DF68E90939E7FF4AF56318F04806AD444A7341C7B9A809CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D26D72 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02D26DFF

Memory Dump Source

Source File: 00000001.00000002.586354636.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2d20000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3412a986be3e9625b289703ecc87fc54303d61cad3b1315a92c28042665c0667
Instruction ID: 7a1b4294c6af6415b8d3c965e50ed6bfef3fcd5dd3c032006115de35f0744023
Opcode Fuzzy Hash: 3412a986be3e9625b289703ecc87fc54303d61cad3b1315a92c28042665c0667
Instruction Fuzzy Hash: CB21E4B59002089FDF10CF9AD984BDEBBF9FB48324F14841AE914A7750D379A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D26D78 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02D26DFF

Memory Dump Source

Source File: 00000001.00000002.586354636.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2d20000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d7c0069cd1f4c303d2bf4cdc5f21388955baa3cb29d7b9a73e6be7ab583e3e3b
Instruction ID: 9dad7bfe28951b0220b5e76f93014d3c3a6f631b236e96cb2679347a463d0811
Opcode Fuzzy Hash: d7c0069cd1f4c303d2bf4cdc5f21388955baa3cb29d7b9a73e6be7ab583e3e3b
Instruction Fuzzy Hash: AF21F5B59002089FDB10CF9AD984ADEBBF9FB48324F14841AE914A7750D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D2C3C8 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 02D2C442

Memory Dump Source

Source File: 00000001.00000002.586354636.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2d20000_SecuriteInfo.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 6b6e25af9186571758497fdd81d22dd959d7eeea41b32f7e9703e3f6ba601cc8
Instruction ID: b28777808e00d4b5a5ea5d71f89f09fd531637e37cc7ea2094cf102d524385c2
Opcode Fuzzy Hash: 6b6e25af9186571758497fdd81d22dd959d7eeea41b32f7e9703e3f6ba601cc8
Instruction Fuzzy Hash: D41189709113048FDB20DFA9D90879FBBF4EB49328F14842AD405B3740CB79A949CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01083E48 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

\, xrefs: 01083F71

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: \
API String ID: 0-2967466578
Opcode ID: da6aab546d68f643f870df315dc276e777158ed8fe8182fb80db0d868b83f682
Instruction ID: 467b8b0fd1895cf02947f10055923bebb1d072d37f3117cb645e4af6b932b2fa
Opcode Fuzzy Hash: da6aab546d68f643f870df315dc276e777158ed8fe8182fb80db0d868b83f682
Instruction Fuzzy Hash: 9341E371B083455FD706EB7888007AEBBF5AF85744F1580AAE584CB292EB34DC068791

Uniqueness

Uniqueness Score: -1.00%

Function 0108E639 Relevance: .5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c715c7c26a9447b63e10932aa0bc2c9324722dc3adff475576386e3f9900307
Instruction ID: f1b2b3c956810f7dc00c860286b9f47d5d2ef3555ed70209c9af1dc140b90373
Opcode Fuzzy Hash: 5c715c7c26a9447b63e10932aa0bc2c9324722dc3adff475576386e3f9900307
Instruction Fuzzy Hash: A3F10930F081154BDF75AA7CC8947AE7BE6EF85214F200876E8C9DB392DA69DC41C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 01084910 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9708fbd48cf2f8f2d5905dc3a7cb25ae5be8cc2e82d21b1e30f09dc9c8e2c102
Instruction ID: 29c42d45d3faf70c263724d3c8245150fbbd44d1e31bb8f4f1ad7282ad26eee7
Opcode Fuzzy Hash: 9708fbd48cf2f8f2d5905dc3a7cb25ae5be8cc2e82d21b1e30f09dc9c8e2c102
Instruction Fuzzy Hash: C3D1AE30B042098FCB55EFB8D9597AE7BF2AF89214F1484A9E485DB395EB39DC01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0108F160 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f638175cf9fb6ce50f91aba1c410cae296ca4d85c9ce31aa3a4290e83a31ba9
Instruction ID: d38b3833026fab80adbbb099371bd16292d83004b1b82d90316e50c7fdc58df0
Opcode Fuzzy Hash: 1f638175cf9fb6ce50f91aba1c410cae296ca4d85c9ce31aa3a4290e83a31ba9
Instruction Fuzzy Hash: A4C11335B042158FC725EB78D8547AEBBE6AF85204F08846AE496CB785CF38DC06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0108A8B0 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b052a8f88b2683cd104de6071275c9845c21e744ef3788e0a5939810a60d362a
Instruction ID: a9f1de1ac1039736069abf50a697fddfd23003dd0b9c9eed79633bf95309b42a
Opcode Fuzzy Hash: b052a8f88b2683cd104de6071275c9845c21e744ef3788e0a5939810a60d362a
Instruction Fuzzy Hash: 9CC1F334708605CFC701DB68C980AAABBE6EF85314F1585A6D9D4CBB52D734EC16CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010830E0 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30848f7d4fe3b1bc0f09b2e8f0fa385889493814f9ca4ba803fb8de722f277cc
Instruction ID: 61d640b19f2aa84ec3176897ed786f803e2a0be7b6e4fc8c59c6b9654956dcc6
Opcode Fuzzy Hash: 30848f7d4fe3b1bc0f09b2e8f0fa385889493814f9ca4ba803fb8de722f277cc
Instruction Fuzzy Hash: C5A1EF35B083448FDB55AB78885829E7BF2AF86204F1484A9E485CB396EF39DC06CB51

Uniqueness

Uniqueness Score: -1.00%

Function 010844E8 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1114cc8fb0ea9fc5c17bf65f0b13c711371993875ee9e869cee52a05a18dd35d
Instruction ID: 42ea3cc9b39d3ead1ee65ce366768a4c8ea25023f17449fa2331f00d87dda733
Opcode Fuzzy Hash: 1114cc8fb0ea9fc5c17bf65f0b13c711371993875ee9e869cee52a05a18dd35d
Instruction Fuzzy Hash: 73A19C34B002059BDB60AF74D859BAD7BE2EF84325F208629E9959B3D4DF398C41CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0108B038 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c41044ed374232758ae76f52b0bf0a4a24411410ec3eee57f497b950a3f851ef
Instruction ID: 98cf8472e9ff9ada7bb78d4b157204470e69f22be5f74d9c456a024811baf84f
Opcode Fuzzy Hash: c41044ed374232758ae76f52b0bf0a4a24411410ec3eee57f497b950a3f851ef
Instruction Fuzzy Hash: 30910830F042089FDB246BB8C8543AEBAE7EFC9314F108969E199DB395DF794C058B91

Uniqueness

Uniqueness Score: -1.00%

Function 01088308 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ffb40cf615f18d37f5cb9f7e60829620018e50e6edd493943f7a7485f76c8e9
Instruction ID: 700b0975d03c48d1bf6c10cd5759d87f75a3d29a740e197cf66ee9177756d7ed
Opcode Fuzzy Hash: 2ffb40cf615f18d37f5cb9f7e60829620018e50e6edd493943f7a7485f76c8e9
Instruction Fuzzy Hash: 5491BB317001149FCB19EF68C864AAE7BA7AF88354F44C469F5868B395CF74DD06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01085C49 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23c7f40377786a72bd4964b3fb2c87ab7bb03f9895daa2fa160678f20e19c968
Instruction ID: 7f9e7bd47933c2f3309df3328b3ad12ba87b9c83c6f8a71853e0f6c434b69aaa
Opcode Fuzzy Hash: 23c7f40377786a72bd4964b3fb2c87ab7bb03f9895daa2fa160678f20e19c968
Instruction Fuzzy Hash: B2818835B002048FDB64ABB4D91876E7AE3AFC8344F244479E986DB395EF39CC028751

Uniqueness

Uniqueness Score: -1.00%

Function 010870B8 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4b27e7315350cda60ef3e38bca30085be5ff9972738509ed26d42afd25e5718
Instruction ID: b4cdb36ae70ad80462c3b2a615eced5263fc61afcd77f518e0aa59cf81906558
Opcode Fuzzy Hash: e4b27e7315350cda60ef3e38bca30085be5ff9972738509ed26d42afd25e5718
Instruction Fuzzy Hash: 6CA1AF71A08249DFCF05DFA8C845ADEBFF2BF89300F148156E885AB369D734A955CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01086958 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e72f2c0810fd5f8f5035622d914928bf7f7ea98d0eff78b4cbdd571c3f06794c
Instruction ID: 6843e3577bb96df7857c5e51bb643688295ce60afbf00ca70f15fa8e30ef52ed
Opcode Fuzzy Hash: e72f2c0810fd5f8f5035622d914928bf7f7ea98d0eff78b4cbdd571c3f06794c
Instruction Fuzzy Hash: 13817A307182058FDB55EF6DC884BAD7BE5AF89305B1A40A9E981CB3B1DB76DC81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01085CA8 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c07539645e22677a263e4c0fe85e1d0ce0f2def7095b28d6de1e482c0ef300c9
Instruction ID: 26867ea22f31244aea8bcc1040c1b19ee3f03fcf452968c6eac58514c17679e6
Opcode Fuzzy Hash: c07539645e22677a263e4c0fe85e1d0ce0f2def7095b28d6de1e482c0ef300c9
Instruction Fuzzy Hash: D8718435B002048BDB64ABB8D95876E76E3AFC8344F244439E946DB394EF789C028B91

Uniqueness

Uniqueness Score: -1.00%

Function 01083080 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9454359e5d81aaecb8e845952f2a971c25e1f133cfcfb8ea7e54822ed7e821ee
Instruction ID: 747b872454ecbc4be55710e2b320fa272c4c287d0890cbe3c9ea8e8955bcd7ff
Opcode Fuzzy Hash: 9454359e5d81aaecb8e845952f2a971c25e1f133cfcfb8ea7e54822ed7e821ee
Instruction Fuzzy Hash: 3B71C034B042058FCB65AF74C95826E7BE2AFC5604B148879E486DB399EF39DD06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01087A28 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dfef3ab3d38f3ef0a15effa63049e972337aa516ffef998da0b3917e7e664e3
Instruction ID: 07d3eb5afc2414e1b3c41132b9d0b33082ddf5263f56f80b44fb586d4b01d378
Opcode Fuzzy Hash: 0dfef3ab3d38f3ef0a15effa63049e972337aa516ffef998da0b3917e7e664e3
Instruction Fuzzy Hash: 92619D70E083498FDB16DFA9C5407AEBBF2AF89300F208659E995AB346D770A945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0108FC80 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598c6a0b3c902675c39d8f7f508a004eb91549f962f73d4023f2369c0af452c2
Instruction ID: f3b62fb93e228f747f09362c73d2220eb55851e92681ee241a5ec8f2dd289c03
Opcode Fuzzy Hash: 598c6a0b3c902675c39d8f7f508a004eb91549f962f73d4023f2369c0af452c2
Instruction Fuzzy Hash: 5C518271A0D3859FC742ABB8C8546E97FB2AF4B304F1580E6D184DB793DA399C0AC761

Uniqueness

Uniqueness Score: -1.00%

Function 01083BA8 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5964ffc123e5cca717ab8ccc1cfaa39ea20f7df40db6caf81544a2272a47c99a
Instruction ID: db5e3e9cd5f81b0b1c0686a39ba06f8cf94b9131df07c5c16a0dd64bf30a7060
Opcode Fuzzy Hash: 5964ffc123e5cca717ab8ccc1cfaa39ea20f7df40db6caf81544a2272a47c99a
Instruction Fuzzy Hash: BF61C574D00218DFCB64EFB4D859A9DBBB2FF48311F20846AE54AA7354DB399941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01080011 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71605810ba077ad0b680314d5ce6b3832b0805af95f96cac2d26803bd04bc4a5
Instruction ID: 043b0132ebdfcaae0bc8782c48d5671d63a3c39919ac575e8e3334c1b4eceef5
Opcode Fuzzy Hash: 71605810ba077ad0b680314d5ce6b3832b0805af95f96cac2d26803bd04bc4a5
Instruction Fuzzy Hash: A0518C74E043489FDB60AF74D91879EBBF2AF49200F1084AAE946DB395EB398D41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01087A18 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6850344f0bb7b8f9a149046784211d428970f3562080158e060e5d2576427ea8
Instruction ID: 6c9891cdc4f81b64fcd8e5ba74bc84971cb9297109679abe219509d02a3a11b2
Opcode Fuzzy Hash: 6850344f0bb7b8f9a149046784211d428970f3562080158e060e5d2576427ea8
Instruction Fuzzy Hash: C4519071E0478D8FDF16CFA9C54079DBBF2AF8A300F248659E994AB246D770A981CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01085F94 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 173dea7237aa618c1b138c14a79826f97d248ac9b769abbba2e609234bf5c246
Instruction ID: 56527761dfee34c502f09344f9bd1c793e7d13db8b5cb4692b25c4020d501bd5
Opcode Fuzzy Hash: 173dea7237aa618c1b138c14a79826f97d248ac9b769abbba2e609234bf5c246
Instruction Fuzzy Hash: DB418535B102148FDB64AB74D81876E7AE7AF88744F244439E986DB385DF788C018B91

Uniqueness

Uniqueness Score: -1.00%

Function 0108720B Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79da75c39349760ff544ee545aab4afa88d1188845d6fdb5d2797f338fc2875a
Instruction ID: 4d0a6aed2b97668a9173e297bb533722b8ae5d56bc9f7241c6775c0dba85e435
Opcode Fuzzy Hash: 79da75c39349760ff544ee545aab4afa88d1188845d6fdb5d2797f338fc2875a
Instruction Fuzzy Hash: 3B41BF31A08249DFCF16DFA8C841ADDBFB2AF49350F148151F995AB2A9D334E911CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01085B29 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83f3e1148fe2ec2610b413a3d2fcc9dccc6516d67928d11e6938ad3f223fd123
Instruction ID: befba2de622dcf9c88c0d57233c4e0f9b419ab14b807fd82356ec5e76a9b69ac
Opcode Fuzzy Hash: 83f3e1148fe2ec2610b413a3d2fcc9dccc6516d67928d11e6938ad3f223fd123
Instruction Fuzzy Hash: 87318175B042458FC742EF78DC457AE7BF2AF8A214F1584A9E589D7396EB388C018B60

Uniqueness

Uniqueness Score: -1.00%

Function 01085647 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50431e9361a6aff3a599deec74ff2967d900a247b10379b9cb1503e2ebe17ef9
Instruction ID: 9699aceb0ffa0a27989eb41b4100c41797519784c83282e59e649615fcaaa576
Opcode Fuzzy Hash: 50431e9361a6aff3a599deec74ff2967d900a247b10379b9cb1503e2ebe17ef9
Instruction Fuzzy Hash: 3E31C275B092568FC742EB7CDC4179D7BF1AF89314F0584A5D548DB396EB388C028BA0

Uniqueness

Uniqueness Score: -1.00%

Function 010882C0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d951c2246581663b7ba0ba54d4cbf9c267f1ceb120821db6ce9adf84df50290f
Instruction ID: 7a57c1c9e2e3eed90d1b5116c752b6af4d0a7dd2729319e0916b4c0c3e665c04
Opcode Fuzzy Hash: d951c2246581663b7ba0ba54d4cbf9c267f1ceb120821db6ce9adf84df50290f
Instruction Fuzzy Hash: 422127317086148FC712AB2C9808B6EBBE2AF85310F85C1AAE8D5CF392DB30DC41C791

Uniqueness

Uniqueness Score: -1.00%

Function 01084489 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8655ee8773237ac92fa12c9fe9edf43ad6939898f6c806a9c279d994160b9adc
Instruction ID: 0d767bb7e71c9c3127cb876759f3041d61adc22cd3d65e0faaa196da0cc32a78
Opcode Fuzzy Hash: 8655ee8773237ac92fa12c9fe9edf43ad6939898f6c806a9c279d994160b9adc
Instruction Fuzzy Hash: 70212535B083945FD7126B78982879E7FF19F82300F1585BAE884DB3C2DE388C058791

Uniqueness

Uniqueness Score: -1.00%

Function 01081347 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12b41e93a777c45eab1e2f405f01f2acedacd9841aa1bb682382ef4d2f26abda
Instruction ID: d3d259af5abec8fda45bb70bda63f5ee2bccab08c2a9cbacbff50b90433f2b05
Opcode Fuzzy Hash: 12b41e93a777c45eab1e2f405f01f2acedacd9841aa1bb682382ef4d2f26abda
Instruction Fuzzy Hash: 9721483560D3C04FD747A778982465A7FB59F93204F5AC0E7D0C8CBAA3E6298C0AC721

Uniqueness

Uniqueness Score: -1.00%

Function 0101D53C Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585199729.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_101d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 314d81c63bd14e64c6a226b1463a3d7376b05da4ea1e1bbfc5e5b956467ef1f2
Instruction ID: 9b5227dfc2805a0e6ed93ddeb54a32b70c215d5540db03b7733258115dea78fd
Opcode Fuzzy Hash: 314d81c63bd14e64c6a226b1463a3d7376b05da4ea1e1bbfc5e5b956467ef1f2
Instruction Fuzzy Hash: 63212871500240DFDF41DF54D9C4B1ABFA5FB88328F2489A9E8454B24AC33AD856C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0101D450 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585199729.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_101d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07f529f115ffff001e4f18d2b9c98d58018a7321052f2b6b99c36c12638c61b9
Instruction ID: e9982eae2135339c121b3dc3ec5b7c1145c3a6186067a1da30ddf34e2745123e
Opcode Fuzzy Hash: 07f529f115ffff001e4f18d2b9c98d58018a7321052f2b6b99c36c12638c61b9
Instruction Fuzzy Hash: 5D213671540200DFDB11DF54D9C4B67BBA1FB84324F2085A8E8450B20AC73AE85AC7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0102D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585243953.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_102d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0ab36c2cb443d5097b75c1df0acf2b34923a3b886580dfb128ab7c53ebf7a13
Instruction ID: db16f1e9a26783ccc24a8143ab6312c1a1061f12639337938de769ec980776a2
Opcode Fuzzy Hash: d0ab36c2cb443d5097b75c1df0acf2b34923a3b886580dfb128ab7c53ebf7a13
Instruction Fuzzy Hash: A4212571604240DFCB51DFA4D9C0B16BBA5FB84354F20C9A9E8894B756C33ADC4BCBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0108A4F8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d27c736c7aa818ada5f94c5b02c1f3dbe17330e8b2e42dd496c424787074f36d
Instruction ID: ea5dce3cb792c4bbfa01685d292e4f3b3bc1b5b13bbd786a8423ae6c22d41a1a
Opcode Fuzzy Hash: d27c736c7aa818ada5f94c5b02c1f3dbe17330e8b2e42dd496c424787074f36d
Instruction Fuzzy Hash: C0218270B04209DBEB14EFA5D844BAEBFB5BF44304F10442AE981B7748DB74DA45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010838A8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 726d92e70195ca6533258688368b161077eb4821ef9dc748b298628632cdd4b3
Instruction ID: 7cd5b6a0bead02f51dc6133adb54d55b5e2ce4f26daeb78155a1eed31cf7a515
Opcode Fuzzy Hash: 726d92e70195ca6533258688368b161077eb4821ef9dc748b298628632cdd4b3
Instruction Fuzzy Hash: F3118131B0411857CB14BBB898296DE76A6ABC8755B104978E482EB384EF39CD058B91

Uniqueness

Uniqueness Score: -1.00%

Function 0102D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585243953.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_102d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b65dca9c5016cbaf9b20ff554ce8b4fc4707ab48d15e93b2247af2c5fc095ec
Instruction ID: a41cf7695b89f58a1a54cbea9ca9167b620bb265680464f38fa86423d25a4ef5
Opcode Fuzzy Hash: 8b65dca9c5016cbaf9b20ff554ce8b4fc4707ab48d15e93b2247af2c5fc095ec
Instruction Fuzzy Hash: 5D2180755083809FCB12CF64D9D4B11BFB1EB46214F28C5DAD8858B667C33A985ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 010872F0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afed37b78de4547ad616d0be83908ddeeded0e43c4b73dcd17f5cf5ef46adde7
Instruction ID: 301c720835701e49ea37a99c869d6fecd952d02b8d068664b56030bd985c1cae
Opcode Fuzzy Hash: afed37b78de4547ad616d0be83908ddeeded0e43c4b73dcd17f5cf5ef46adde7
Instruction Fuzzy Hash: B1110631608205DBDB15DF68C882B9EBBE2AF85324F24C655D9D46B29AD370F810C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 01083B98 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27427eb64396e0f8b8619c3cd6e56d52183f017aca1125bbd1b8f4550f9e7bbd
Instruction ID: 1cd993e58dbe9ab9a7c6c8d0e500c9e572bd55385fb397874b9e5a69020733bc
Opcode Fuzzy Hash: 27427eb64396e0f8b8619c3cd6e56d52183f017aca1125bbd1b8f4550f9e7bbd
Instruction Fuzzy Hash: 96212974E002588BDF20EFB4D9696ADBBB1BF88300F5084ADE545AB345EF395945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0108FDED Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d832d85a7991cc6dd22b627c90f7e73adb47b419c50eb36c9523153a8b012beb
Instruction ID: bb1b437cc6a6ffcaed4c4b4a407ea61ee388358ba6e18bb7579da0bd7c4a7885
Opcode Fuzzy Hash: d832d85a7991cc6dd22b627c90f7e73adb47b419c50eb36c9523153a8b012beb
Instruction Fuzzy Hash: 23115E70A162498FCB05DFB8E4646DCBFB2EF49715F24409AE085EB392CB754D09CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0101D537 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585199729.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_101d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1193202f6d84514e7bee289ffa5d34f3f61fc8f37f39928f4f0d259a97e51c54
Instruction ID: 4d748698acef79d885b9a6a9141ab78b7c4c8b1f0a940906e583edcf6bd66842
Opcode Fuzzy Hash: 1193202f6d84514e7bee289ffa5d34f3f61fc8f37f39928f4f0d259a97e51c54
Instruction Fuzzy Hash: 9811D376504280CFCB42DF54D5C4B16BFB2FB88324F24C6A9D8494B61AC33AD55ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0101D44B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585199729.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_101d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1193202f6d84514e7bee289ffa5d34f3f61fc8f37f39928f4f0d259a97e51c54
Instruction ID: 009929b91ce1b06ca1606ba9df220e1413cdced7c774aef6a8fc7a9517ab3e2b
Opcode Fuzzy Hash: 1193202f6d84514e7bee289ffa5d34f3f61fc8f37f39928f4f0d259a97e51c54
Instruction Fuzzy Hash: 0611BE76504280CFDB12CF54D9C4B16BFB1FB84324F28C6A9D8454B61BC33AD45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0108F100 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eed8587fdc871737576d5b8bc479a712903a72f6335dceffb061724c094d3701
Instruction ID: 1014a14b313bebd67ff6073a4422dd4c861532a2461a1233955aef4a44a54a8d
Opcode Fuzzy Hash: eed8587fdc871737576d5b8bc479a712903a72f6335dceffb061724c094d3701
Instruction Fuzzy Hash: 0111ED35B0C3824FD752A739DC207663BE24B97204F1980FAD5C8CB2A3EA64CC0A8360

Uniqueness

Uniqueness Score: -1.00%

Function 0108A4E9 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 811f62a92f2931b06fa1700f904daaa79b0c85512b426c26ad7c9cb7786745cd
Instruction ID: 919c4822368d17fe4d64f6e3a08f5a254c0ca0af5cf64e3b82f53a3b2ae596de
Opcode Fuzzy Hash: 811f62a92f2931b06fa1700f904daaa79b0c85512b426c26ad7c9cb7786745cd
Instruction Fuzzy Hash: D7110470F14218DBDB18DFA8D84079EBBB2BF80304F10482AD981AB388DF74C945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01085B88 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26abc6d0d4e25a2a713c74563f7fd47f26aa2740e3713f80eba8bc56fda3a0cc
Instruction ID: 3582869ba16a46e2edf39f9ba4e4ce3b7725592176b3eb0acb6f836255f8386f
Opcode Fuzzy Hash: 26abc6d0d4e25a2a713c74563f7fd47f26aa2740e3713f80eba8bc56fda3a0cc
Instruction Fuzzy Hash: 9A115235F001198F8B50EF7DDC559AE77F1BB8C2147508469E149E7354EB389D028F91

Uniqueness

Uniqueness Score: -1.00%

Function 010856A8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cab10e4518e6c97aaeb60cbe1e5bc4e118f92e3cfb7e3252cd60e6997e13e3be
Instruction ID: 2668b89213cf9dfa764e13cc726927e3f2f56a0119916d2cc272a71151893fe6
Opcode Fuzzy Hash: cab10e4518e6c97aaeb60cbe1e5bc4e118f92e3cfb7e3252cd60e6997e13e3be
Instruction Fuzzy Hash: C9110C75F002198F8B50FFBDDC95A9EB7F6BB882107508469E549E7344EB389D028BA1

Uniqueness

Uniqueness Score: -1.00%

Function 01083898 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70a42826eaaa19824f9f9559ef6b09bc52749f3c25f1eeca42ceb29efae34e05
Instruction ID: 7138c514474d3d8d1354bd547be87b7c3926ca17c752f55132bc4aab9913de6f
Opcode Fuzzy Hash: 70a42826eaaa19824f9f9559ef6b09bc52749f3c25f1eeca42ceb29efae34e05
Instruction Fuzzy Hash: E4014732B0011857DB1266B8991939E3AA36F88710F010579E9C2E7390FF3D8D018381

Uniqueness

Uniqueness Score: -1.00%

Function 010870A8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 040f0dd4bdf7338f0bfb2ebf20ba69d26894717c1672cdca7006f83444fb7328
Instruction ID: 5c324061ee3023a4b8bc798e900cf52aea6628d077183a34127163037ac1db24
Opcode Fuzzy Hash: 040f0dd4bdf7338f0bfb2ebf20ba69d26894717c1672cdca7006f83444fb7328
Instruction Fuzzy Hash: 99015371A0025C8FCF09CF98D9009DDBBB6FF89310F00816AE945AB264D7359919CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01084D87 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13f1d0655cae12f6978ddeaedf6609bdead3ebb338d031e38d8a8c8ea45af0d4
Instruction ID: e28b5ce49c160710bc1fe06c8288539ef7f8a65d2cd293b17e5cfc21b42c821b
Opcode Fuzzy Hash: 13f1d0655cae12f6978ddeaedf6609bdead3ebb338d031e38d8a8c8ea45af0d4
Instruction Fuzzy Hash: 3CE0ED35F001298F8F50FBB9D8A55DDB3E2EFC8225B108065E546E7354DE389C168BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0108301F Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54fd458f1634bd595244d4625947e8aa68066cb7d5b9af623baf734ee6bc773c
Instruction ID: 479b13f0119fb3341808c270e976986b07b0768133b9bbf5d1930933dd83ee39
Opcode Fuzzy Hash: 54fd458f1634bd595244d4625947e8aa68066cb7d5b9af623baf734ee6bc773c
Instruction Fuzzy Hash: CAE0ED35F001248B8F50FBB9D8A54DD73F2FFCC225B1044A5E546E7394DE289D158BA1

Uniqueness

Uniqueness Score: -1.00%

Function 01085707 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8142c1be3dd02ee2e1411ade010adde8d9f5418a07152b777e7d840a17757
Instruction ID: 62d95470be2a948dc418ade1834244eff25a95b6aedec40418ffdf4c0558103c
Opcode Fuzzy Hash: d8f8142c1be3dd02ee2e1411ade010adde8d9f5418a07152b777e7d840a17757
Instruction Fuzzy Hash: E8E0C935F001248F8F54FBB9D8A55DDB3E2EBC8225B108065E54AE7354DA289C168BA1

Uniqueness

Uniqueness Score: -1.00%

Function 01085BE7 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91670dffcb7b70c383ff4d3bb5ee3d56290ef3722eaf70243d811830c9b7338f
Instruction ID: fb7ccd738b95dd34cf97c98ba61ef0a891d3be4848d852ab021702a30fe5dfa4
Opcode Fuzzy Hash: 91670dffcb7b70c383ff4d3bb5ee3d56290ef3722eaf70243d811830c9b7338f
Instruction Fuzzy Hash: 93E0C935F001288B8F50EBB9D8A54DD73E2EBC8229B508065E54AE7354DA289C168BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0108DC20 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26f54f6f6dd6509e866f99deec6e8a3d6ed9ae295ee43374fadaf02d2ee9998
Instruction ID: cd7eca310898530c500eb61d11ab3ca84a659061ca97e5e9f0fb98e9f6001075
Opcode Fuzzy Hash: e26f54f6f6dd6509e866f99deec6e8a3d6ed9ae295ee43374fadaf02d2ee9998
Instruction Fuzzy Hash: 63E0CD2134530B17E7449079989073979D69BD1170B48C275E5888B681D818D8049365

Uniqueness

Uniqueness Score: -1.00%

Function 0108D0EA Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35bf42aba340661a1bf77941b5a4634ef573e480d051a79e7c7eec937d5391c
Instruction ID: 46b048112877a06a97f2d2e304e3d892d2dbcb8e4c8980fbae67d244db90f37e
Opcode Fuzzy Hash: c35bf42aba340661a1bf77941b5a4634ef573e480d051a79e7c7eec937d5391c
Instruction Fuzzy Hash: FFE0863AB150248FC744DB74B8885AC7BA6EBCC111B18C57BFA5AD3344DF348C068B40

Uniqueness

Uniqueness Score: -1.00%

Function 0108419C Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.585336947.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Offset: 01080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1080000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f88fceaf53f4ad76a81b3f2d4a4bf4364fece6a837153e76aa9990eeeee4430
Instruction ID: 6fdece2841d55873d7d172583ff85548dcfb46278adc59047074b2d2eef71652
Opcode Fuzzy Hash: 5f88fceaf53f4ad76a81b3f2d4a4bf4364fece6a837153e76aa9990eeeee4430
Instruction Fuzzy Hash: C2D022007002074A4F1822BB06203BE30C30BA00DAB800C765882CFFC5FE2CC88C2352

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network protocol analysis, Packet capture, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe

Function 00FDB6C1 Relevance: 6.1, APIs: 4, Instructions: 124
threadCOMMON

Function 00FDB6D0 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Function 00FDFD38 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 00FDFD37 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 00FD5364 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Function 00FD3DE4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 02CD23B0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Function 02CD0006 Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Function 00FDB8F2 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 00FDB8F8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 00FD9B30 Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Function 00FD94B8 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 00FD98A8 Relevance: 1.6, APIs: 1, Instructions: 51
COMMON

Function 00FD98B0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 02CD0040 Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Function 05F8C720 Relevance: 5.5, APIs: 3, Instructions: 963
libraryCOMMON

Function 01083EF8 Relevance: 5.4, Strings: 4, Instructions: 404
COMMON

Function 02D26B1F Relevance: 6.1, APIs: 4, Instructions: 137
threadCOMMON

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre